What Is a Non-Disclosure Agreement in M&A? The 10-Clause Owner Guide (2026)

A what is a non-disclosure agreement question almost never comes up in the abstract for a business owner. It comes up the week a buyer or banker asks for financials, and the owner is staring at a 6 to 12 page PDF that needs to be signed before a single P&L crosses the table. In M&A, the NDA is the first binding document of the deal. It governs every conversation, every data room login, and every diluted-coffee meeting that follows. According to the American Bar Association 2025 Private Target Mergers and Acquisitions Deal Points Study, 100% of sampled deals were preceded by a confidentiality agreement, and 67% of them used a mutual structure once both parties were exchanging non-public information. This guide opens the standard 10 clauses, gives sample scaffold language, and flags the eight mistakes that hand value back to the buyer before the LOI is even drafted. Nothing here is legal advice. It is the operating context an owner needs so the buyer’s draft does not become the deal.

What This Actually Means

A non-disclosure agreement, sometimes called a confidentiality agreement or CA, is a legally binding contract that obligates one or both parties to keep specified information confidential and to use it only for a defined purpose. In M&A, the purpose is almost always evaluation of a potential transaction. The information ranges from customer lists, supplier terms, and unit economics to the simple fact that the company is for sale, which on its own can damage employee morale, customer renewals, and lender relationships if it leaks.

The contract is doing three jobs at once. First, it creates an enforceable duty of confidentiality on top of any background trade secret protection the seller already has under state law and the federal Defend Trade Secrets Act of 2016, codified at 18 USC Section 1836. Second, it defines a permitted purpose so the buyer cannot quietly use the data to compete, recruit, or replicate the business. Third, it sets the procedural floor for the rest of the deal: who gets information, in what format, for how long, and how it gets returned or destroyed when talks end.

The legal teeth come from contract law, supplemented by trade secret statutes. Under the Defend Trade Secrets Act, 18 USC Section 1839, a trade secret is information that the owner has taken reasonable measures to keep secret and that derives independent economic value from not being generally known. A signed NDA is a near-universal example of a reasonable measure. Without one, an owner who shares a customer list and pricing schedule with a strategic buyer may have given up trade secret status by failing to protect it. With one, the owner preserves both contract remedies and statutory trade secret remedies, including injunctive relief, damages, and in willful misappropriation cases, exemplary damages and attorneys’ fees.

For lower middle market deals, the NDA is typically signed at one of three points: before a teaser is sent (rare and aggressive), after the teaser but before the Confidential Information Memorandum (the standard sell-side broker pattern), or after a non-binding Indication of Interest is delivered (the standard for direct buyer outreach). Whoever drafts the NDA tilts the document. Sellers who let the buyer drive the first draft routinely accept asymmetric terms they would have negotiated out in 20 minutes if they had drafted first.

Mutual vs Unilateral: Which Structure Fits the Deal

An NDA is either unilateral (one party discloses, one party receives) or mutual (both parties disclose and receive). The choice is not stylistic. It changes which party carries the obligations and which party can sue if something leaks.

A unilateral NDA fits the early stage of a sell-side process. The seller is the only party with material non-public information at that moment. The buyer is just signing to receive the CIM. The buyer’s identity, fund size, or strategic plans are usually not yet on the table in a way that justifies symmetrical protection. The ABA 2025 study found that 33% of NDAs at first contact in a broker-run process were unilateral, dropping to under 10% after the IOI when both sides started exchanging diligence.

A mutual NDA fits the later stages and direct strategic-to-strategic conversations. Once the buyer is sharing investment criteria, sources of capital, planned synergies, or its own customer list (in a roll-up scenario), the buyer wants and deserves the same protection. Strategic buyers in particular insist on mutual structure because they are often disclosing proprietary go-to-market plans during diligence. The 2019 Salesforce-Tableau pre-deal NDA, later disclosed in Tableau’s proxy filing on Schedule 14A, was mutual and ran for two years on transaction information with a separate twelve-month standstill, which is a representative middle market and large-cap pattern.

Owners who let a strategic competitor sign a unilateral NDA in a sell-side process are giving up power. If the deal dies and the competitor uses what it learned, the seller has a contract claim. If the same deal had been mutual and the seller had received any reciprocal information about the buyer’s business, the seller would have had two-way pressure and a more credible threat of litigation.

The 10 Standard Clauses You Need to Understand

1. Parties and Recitals

The opening identifies the legal entities (not the trade names) and recites why the parties are talking. The ABA Mergers and Acquisitions Committee model mutual NDA names the exact corporation or LLC, state of formation, principal office, and then a short recital block describing the contemplated transaction in deliberately vague terms (“a possible negotiated transaction”). Vague is intentional. A specific recital like “the acquisition of all the outstanding stock of Seller by Buyer for $25 million” creates a written admission of valuation discussions that the seller may not want preserved if the deal dies and the buyer comes back two years later at half the price.

Sample scaffold: “This Mutual Non-Disclosure Agreement, dated as of [Date], is entered into by and between Acme HVAC Holdings, LLC, a Delaware limited liability company (Party A), and Smith Mechanical Services, Inc., a Texas corporation (Party B). WHEREAS, the parties wish to explore a possible negotiated business transaction (the Transaction); and WHEREAS, in connection with the Transaction, each party may disclose to the other certain confidential and proprietary information.”

2. Definition of Confidential Information

This is the most contested clause in any NDA. A narrow definition lets the buyer treat half the data room as outside the agreement. A broad definition captures everything but may be unenforceable if it sweeps in obviously public information. The Cooley M&A NDA template, which is publicly available, uses an inclusive list followed by a catch-all: financial information, customer and supplier identities, pricing, business and marketing plans, employee compensation, technology, intellectual property, and “any other information that a reasonable person would understand to be confidential given the nature of the information and circumstances of disclosure.”

Owners should resist any definition that requires the disclosing party to mark each item “Confidential” before it qualifies. In a live data room with thousands of files and verbal management presentations, that marking requirement is unworkable and usually a buyer-friendly trap. The standard middle market position is that all information disclosed is confidential by default, with a narrow set of exclusions in clause 3.

3. Exclusions from Confidentiality

Every NDA carves out information that is not protected. The five standard exclusions are (a) information that is already public through no fault of the receiving party, (b) information the receiving party already had before disclosure with documented evidence, (c) information independently developed without use of the disclosed material, (d) information lawfully received from a third party with no confidentiality obligation, and (e) information required to be disclosed by law, court order, or regulatory authority.

The fifth carveout (compelled disclosure) needs a notice and cooperation hook. The standard ABA language requires the receiving party to (i) promptly notify the disclosing party in writing, (ii) cooperate with the disclosing party’s effort to seek a protective order, and (iii) disclose only the minimum required and use reasonable efforts to obtain confidential treatment. Without the notice hook, a buyer served with a subpoena could hand over the seller’s data without the seller ever knowing.

4. Permitted Disclosures and Representatives

The receiving party needs to share information with its own people: deal team, lawyers, accountants, lenders, investors, and sometimes consultants. The clause defines who counts as a Representative (officers, directors, employees, attorneys, accountants, financial advisors, and potential financing sources) and requires the receiving party to (a) inform each Representative of the confidential nature of the information, (b) direct them to comply with the agreement, and (c) be responsible for any breach by any Representative as if it were the receiving party’s own breach.

The financing-source carveout is sensitive. A private equity buyer wants to share the data with potential debt lenders and equity co-investors. A seller wants to know who that pool actually includes and whether any of them are direct competitors. The standard middle market negotiation lands on a written list of approved financing sources delivered before disclosure, with the seller having a reasonable approval right (not to be unreasonably withheld) over the list.

5. Term and Duration

An NDA has two clocks. The first is how long the confidentiality obligation lasts. The second is how long the agreement itself stays in force for purposes of the standstill and non-solicit provisions. For general transaction information, the ABA 2025 study reports a median confidentiality term of 2 to 3 years, with 24 months being the most common single value. For information that meets the statutory definition of a trade secret under the Defend Trade Secrets Act and state-law adoptions of the Uniform Trade Secrets Act, the obligation should be perpetual or “until the information ceases to be a trade secret,” because a fixed term lets the buyer freely use the trade secret on day 1,096.

The split-term structure is the cleanest answer: a fixed 2 to 5 year term for ordinary confidential information, and an indefinite term for any information that constitutes a trade secret under applicable law. Owners who accept a flat 2 year term across all information categories are gifting their trade secrets to the buyer on the third anniversary.

6. Return or Destruction of Materials

When discussions end, the receiving party must either return all confidential information or destroy it and certify the destruction in writing. The standard language requires return or destruction within 10 to 30 days of written request, with a narrow exception for (a) one archival copy retained by outside counsel for compliance purposes and (b) information embedded in automatic electronic backup systems that cannot be reasonably segregated, which remains subject to the confidentiality obligation for as long as it exists in those systems.

The destruction certificate matters. A buyer who walks away with the seller’s customer list and pricing on a laptop is a real risk. A written, dated, officer-signed certification that the data has been destroyed creates contract evidence the seller can point to if data later surfaces, and it gives a court a clean breach to enforce. Without the certification, the seller is litigating in the fog.

7. Non-Solicitation of Employees

The buyer has just been introduced to the seller’s CFO, head of operations, and top three salespeople. If the deal dies, the seller does not want a recruitment campaign two months later. The non-solicit clause prohibits the receiving party from soliciting for employment any employee of the disclosing party for a defined period, typically 12 to 24 months after the agreement is signed. The ABA 2025 study reports a median non-solicit period of 18 months and a maximum frequently negotiated of 24 months.

Two standard carveouts protect the receiving party: (a) general solicitations not specifically targeted at the disclosing party’s employees (job ads on LinkedIn and Indeed), and (b) employees who respond to such general solicitations without being individually approached. A third sometimes-negotiated carveout is for employees who have been terminated by the disclosing party for at least 3 to 6 months. Owners should resist any carveout that lets the buyer hire any employee who “approaches” the buyer, because the line between approach and approach-after-coffee is impossible to police.

8. Non-Solicitation of Customers and Non-Tampering with Relationships

Less common than the employee non-solicit but increasingly standard in strategic-to-strategic NDAs, this clause prohibits the buyer from using confidential information to solicit the seller’s customers, suppliers, or other counterparties during the term of the agreement. The clause is narrower than a true non-compete (it does not prohibit competing for the same customers through ordinary channels, only the use of confidential information to target them), which makes it more enforceable in courts skeptical of restraints on competition.

The non-tampering language adds a duty not to interfere with the seller’s contractual relationships. If the buyer learns in diligence that the seller has a 3-year supply contract with a key vendor coming up for renewal in 9 months, non-tampering prevents the buyer from quietly approaching that vendor with a competing offer during the NDA term. Together, the two clauses form a soft non-compete that is enforceable in most jurisdictions because it is tied to use of confidential information rather than blanket commercial restraint.

9. Standstill

The standstill is the buyer’s commitment not to acquire securities of the seller, propose a transaction, or otherwise take hostile action for a defined period. It originated in public-company M&A to prevent a friendly diligence process from converting into an unsolicited bid based on the information learned in the data room. In private middle market deals, standstills are less universal but show up in roughly 35% of NDAs where the buyer is a strategic competitor or a public company per the ABA 2025 study, with a typical duration of 12 to 24 months.

The negotiated centerpiece is the fall-away clause. A “hard” standstill bars hostile action regardless of intervening events. A “soft” standstill (also called a fall-away or “don’t ask, don’t waive”) terminates if a third party launches a competing offer, the seller engages in a public sale process, or the seller’s board approves an alternative transaction. The ABA 2025 study reports fall-away provisions in 64% of public-company NDAs and a smaller but growing share of private deals. Sellers who include a soft standstill keep the pricing power of a credible auction; sellers who accept a hard standstill have effectively granted exclusivity without negotiating for it.

10. Remedies, Injunctive Relief, and Governing Law

The remedies clause acknowledges that money damages may be inadequate for breach of confidentiality and entitles the disclosing party to seek injunctive relief and specific performance without posting a bond. This is critical. Proving the dollar value of harm from a leak is nearly impossible. The customer who stopped renewing might have left anyway. The employee who got recruited might have departed independently. Damages are abstract, and the seller usually loses on causation even when the breach is obvious.

Injunctive relief is the practical remedy. A court can order the buyer to stop using the information, return it, and refrain from contacting the listed customers or employees, and that order can come within days through a temporary restraining order or preliminary injunction. The Defend Trade Secrets Act, 18 USC Section 1836(b)(3), also authorizes federal injunctive relief and, in cases of willful and malicious misappropriation, exemplary damages of up to twice the actual damages plus attorneys’ fees. Governing law and venue should be set to the seller’s home state and a friendly forum; sellers who accept the buyer’s home jurisdiction are litigating away from their evidence and witnesses.

Typical Term Lengths: What 2026 Middle Market Deals Look Like

The right term lengths are not a single number. They depend on the type of information and the type of obligation. The table below summarizes the prevailing middle market patterns reported in the ABA 2025 Private Target M&A Deal Points Study and cross-referenced against the publicly available Cooley M&A NDA template and ABA Mergers and Acquisitions Committee model mutual NDA.

The mistake owners make is treating the term lengths as one knob to negotiate. They are five separate knobs, each protecting a different value. Cutting the confidentiality term from 3 years to 2 years feels like a small concession until the buyer launches a competing service in month 25 using the seller’s customer segmentation data.

Residual Clauses: The Knowledge-in-the-Head Carveout

A residual clause permits the receiving party’s personnel to use general knowledge, skills, and experience they retain in unaided memory after the engagement, even if it was originally derived from the confidential information. Buyers love residuals. They let the buyer’s deal team move on to the next target without performing a memory wipe.

For sellers, residuals are dangerous. A poorly drafted residual clause can hand the buyer’s M&A team a license to use everything they learned about pricing, customer segmentation, and operating margins, as long as no one wrote it down. The standard middle market compromise is (a) no residual clause for trade secrets, (b) a narrow residual clause limited to general industry knowledge, skills, and experience that does not embody specific confidential information, and (c) explicit confirmation that the residual carveout does not grant any license to intellectual property.

An aggressive seller position is to refuse any residual clause. A more pragmatic position is to limit it to the buyer’s outside advisors (lawyers, accountants, bankers) who genuinely move between deals, and exclude it for the buyer’s internal personnel who will continue to operate competitively. The Cooley M&A NDA template includes a residual clause by default; the ABA model mutual NDA does not. Owners should know which side of that line the buyer’s draft starts on.

Breach Remedies: Why Injunctions Beat Damages

The legal reality of NDA enforcement is that confidentiality damages are almost impossible to prove with the certainty courts require. The seller has to show (a) what information was misused, (b) what economic harm followed, and (c) that the harm was caused by the misuse rather than by independent market factors. Each element is contested, expensive, and slow.

Injunctive relief is the practical remedy. A federal court can issue a temporary restraining order within 14 days, followed by a preliminary injunction after a hearing on the merits. The order can compel return of the information, prohibit further use, bar contact with named customers or employees, and freeze the buyer’s parallel product development. The Defend Trade Secrets Act, 18 USC Section 1836(b)(3)(A), explicitly authorizes injunctive relief to prevent actual or threatened misappropriation, and most state adoptions of the Uniform Trade Secrets Act do the same.

The NDA should explicitly waive any requirement that the disclosing party prove inadequacy of money damages or post a bond as a condition of injunctive relief. Without that waiver, the seller spends two weeks at the front of the case arguing about preliminary procedure instead of arguing about the breach. The ABA model language is clear: “Each party acknowledges that money damages would be an inadequate remedy and that the disclosing party shall be entitled to seek injunctive relief, specific performance, or other equitable remedies without the necessity of proving actual damages or posting any bond.”

Damages remain on the table as a backup. They include actual losses, unjust enrichment to the buyer, and under the Defend Trade Secrets Act for willful and malicious misappropriation, exemplary damages up to twice the actual damages plus reasonable attorneys’ fees. Sellers should also negotiate a fee-shifting clause that awards attorneys’ fees to the prevailing party in any contract claim, not just the trade secret claim, so the contract itself supplies a financial deterrent.

The 8 Most Common Mistakes Owners Make

1. Signing the buyer’s first draft without negotiation

The buyer’s first draft is the buyer’s wish list. It will favor the buyer on definition of confidential information, residual carveouts, term length, governing law, and (sometimes) absence of any non-solicit. The owner’s bargaining power is highest before signature and effectively zero after. Twenty minutes with deal counsel on the first draft saves real money later.

2. No outside-counsel and outside-advisor carveout

The owner needs to share information with deal counsel, M&A advisors, accountants, and tax counsel. The NDA needs an explicit carveout permitting disclosure to the seller’s own Representatives on the same terms the buyer enjoys. Without it, the seller technically breaches by handing the same financials to their own banker.

3. No return-or-destruction mechanic with certification

An NDA that does not require written, dated, officer-signed certification of destruction leaves the seller with no evidence of compliance and no clean breach to litigate if data later surfaces. Verbal assurance does not survive a deposition.

4. Omitting the employee non-solicit

The buyer just met the seller’s three best people. The non-solicit protects against opportunistic recruiting if the deal dies. Twelve to 24 months is standard. Owners who agree to “no non-solicit” because the buyer claims it is non-market are usually being misinformed; the ABA 2025 study reports non-solicits in 76% of M&A NDAs sampled.

5. Weak or narrow definition of “confidential information”

If the definition requires marking each item “Confidential” before disclosure, half the data room is unprotected the moment it is uploaded. The standard middle market definition is broad and inclusive, with the five carveouts listed in clause 3 doing the limiting work.

6. Perpetual confidentiality term on all information (overreach)

A flat perpetual term across all information is often unenforceable because courts find it overly broad. The cleaner structure is fixed term (2 to 5 years) for general transaction information and perpetual for trade secrets defined by reference to applicable law. Overreach can void the entire clause.

7. No standstill in a strategic-buyer NDA

When the buyer is a direct competitor or a public company, the absence of a standstill is an invitation to use the data to construct a hostile bid or an interfering tender offer. Twelve to 24 months with a fall-away on competing offer is the middle market norm.

8. Accepting the buyer’s home jurisdiction for governing law and venue

The seller’s witnesses, documents, and counsel are in the seller’s home state. Litigating in the buyer’s home jurisdiction adds cost, delay, and home-court risk. The seller should hold for its own state’s law and venue, or at minimum a neutral jurisdiction like Delaware.

Sample 10-Clause M&A NDA Scaffold

The skeleton below illustrates how the 10 clauses fit together in a typical mutual M&A NDA. It is a starting point only. Specific language must be drafted by qualified counsel familiar with the owner’s jurisdiction and the specific transaction.

Two additional boilerplate sections that show up in nearly every M&A NDA but are not numbered above: (a) “No Obligation to Proceed” makes clear that nothing in the agreement obligates either party to enter into a transaction, and (b) “Entire Agreement and Amendment” requires any modification to be in writing signed by both parties. Both are standard, neither is heavily negotiated, but both should be in the document.

Frequently Asked Questions

How long does an M&A NDA last?

The confidentiality obligation for general transaction information typically runs 2 to 5 years, with a median of 24 months per the ABA 2025 Private Target M&A Deal Points Study. For information that qualifies as a trade secret under the Defend Trade Secrets Act or applicable state law, the obligation should be perpetual or “until the information ceases to be a trade secret.” Non-solicit and standstill obligations typically run 12 to 24 months.

Should I sign the buyer’s NDA or send my own?

Send your own when possible. The party that drafts first sets the defaults on the most expensive clauses: definition of confidential information, term length, residuals, standstill, and governing law. If you must sign the buyer’s draft, expect to negotiate. The 30 to 90 minutes deal counsel spends on a buyer-drafted NDA is the cheapest legal spend in the entire transaction.

Is a unilateral NDA enough at the start of a sell-side process?

For the teaser and the Confidential Information Memorandum stage, yes. The buyer has not yet disclosed material non-public information. Once the IOI is signed and the parties begin exchanging diligence (the buyer sharing capital structure, investment criteria, planned synergies), the NDA should convert to mutual or be replaced with a mutual version. A strategic buyer who insists on unilateral structure after the IOI is signaling a weak position on its own confidentiality and should be pushed for mutuality.

What happens if the buyer breaches the NDA?

The practical remedy is injunctive relief: a court order compelling the buyer to stop using the information, return it, and refrain from contacting named customers or employees. Money damages are also available but difficult to prove because confidentiality harm is hard to quantify. Under the Defend Trade Secrets Act, 18 USC Section 1836, willful and malicious misappropriation also exposes the buyer to exemplary damages up to twice the actual damages and reasonable attorneys’ fees.

Do I need a separate NDA for each potential buyer?

Yes. Each NDA is a separate contract between the seller and one specific buyer (and the buyer’s Representatives). Running a broad sell-side process means signing 10 to 40 NDAs over the course of a few weeks. The broker or M&A advisor typically uses a standard form to keep terms consistent and reduce per-buyer negotiation time, but the form should still allow buyer-specific amendments where warranted.

Can an NDA prevent the buyer from competing with me?

Not directly. An NDA is not a non-compete. It restricts use of confidential information and the solicitation of employees and customers, but it does not bar the buyer from competing for the same market through independent channels. A true non-compete would require separate consideration and is far harder to enforce against a potential buyer who has not yet bought anything. The non-solicit and non-tampering clauses do most of the practical anti-competitive work in an NDA.

What is a standstill and do I need one?

A standstill prohibits the receiving party from acquiring securities of the disclosing party, proposing a transaction, or otherwise taking hostile action for a defined period. It matters most when the buyer is a strategic competitor or a public company, where the risk of the data room being weaponized into a hostile bid is real. For purely financial-sponsor buyers in private deals, standstills are less common. When included, they typically run 12 to 24 months with a fall-away on a competing offer.

Does the NDA cover the existence of the deal itself?

It should. The fact that the company is for sale, the identity of the buyer, the price discussed, and the existence of the negotiation are all confidential information and should be covered by the agreement’s definition. Leakage of the deal itself can damage employee retention, customer renewals, lender relationships, and supplier terms before any data even changes hands. Most M&A NDAs include explicit “no announcement” language covering the parties, the Transaction, and the negotiations themselves.

How CT Acquisitions Approaches This

CT Acquisitions is buyer-paid. Sellers pay nothing for the advisory work. The firm has reviewed and negotiated more than 300 M&A NDAs across HVAC, plumbing, electrical, MEP, landscaping, and other home services verticals, and the team walks owners through every clause in plain English before signature. Owners come into the negotiation knowing the ABA 2025 benchmarks, the typical landing zones on term length and standstill, and the trade-offs on residual clauses and non-solicit scope.

The firm does not replace the owner’s deal counsel. The lawyer is essential, especially on definitional language and jurisdiction-specific enforceability questions. CT Acquisitions sits next to the owner during NDA negotiation and translates between the legal vocabulary and the business decision. When the buyer’s first draft proposes a 12-month term, a residual clause without trade secret carveout, and the buyer’s home state for venue, the owner already knows that 24 to 36 months, a narrow residual limited to outside advisors, and the seller’s home state are the standard counter, and what each move is worth.

What to Do Next

The NDA is the first binding document in any M&A process and the contract that governs every conversation that follows. It is also the document where a thoughtful seller can preserve real bargaining power from an opportunistic first draft. Owners who sign the buyer’s NDA cold lose ground on term length, residuals, standstill, and governing law before the data room is even opened. Owners who walk in with the benchmarks and the playbook sign on terms that reflect the value of the information they are about to disclose.

Nothing in this guide is legal advice. Non-disclosure agreements should be drafted and negotiated by qualified counsel familiar with the owner’s jurisdiction and specific transaction context.