Non-Disclosure Agreements in Ontario: What They Protect and Their Limits

A non-disclosure agreement, or NDA, is a contract that restricts how confidential information shared between parties can be used or disclosed. NDAs come up constantly in business — before a partnership discussion, during due diligence for a potential investment or acquisition, when engaging a contractor who will see sensitive systems, or simply when two companies are exploring whether to work together, or when a startup pitches a new idea to a potential investor or partner.

The core purpose is straightforward: it lets parties share information they wouldn’t otherwise be comfortable disclosing, on the understanding that the recipient won’t use it for any purpose beyond what’s agreed, or share it further without permission. Without this kind of protection, many business conversations that require some disclosure of sensitive information simply wouldn’t happen at all.

An NDA can stand alone as a simple, single-purpose document, or it can be incorporated as a clause within a larger agreement, such as a service agreement or a shareholder agreement. Which approach makes sense depends on the context — a standalone NDA is often used early in a relationship, before any broader agreement exists, while a confidentiality clause embedded in a larger contract is common once the parties are already committing to a defined relationship.

A one-way NDA applies where only one party is disclosing confidential information — for example, a business sharing proprietary information with a prospective contractor who has nothing comparable to share in return. A mutual NDA applies where both parties expect to share sensitive information with each other, such as two companies exploring a potential partnership or merger.

Using the wrong type of NDA can leave one side under-protected. If both parties will actually be sharing sensitive information but only a one-way NDA is signed, the party who signed as the “recipient” may have no contractual obligation covering what they disclose to the other side, which defeats much of the purpose of having an NDA in the first place.

Before signing, it’s worth thinking honestly about what each side will actually be sharing over the course of the relationship, not just at the moment of signing. Early discussions may seem one-sided, but if the relationship is likely to evolve into something more collaborative, negotiating a mutual NDA from the outset can save the trouble of renegotiating protection later once both sides are already sharing freely.

A well-drafted NDA defines confidential information clearly enough that both parties understand what’s actually covered. Some agreements use a broad definition covering essentially all information disclosed in connection with the relationship; others require information to be specifically marked or identified as confidential to receive protection.

A definition that’s too vague can be hard to enforce, since a court needs to be able to determine what specific information was actually protected and allegedly misused. A definition that’s too narrow can leave real gaps in protection. Striking the right balance — specific enough to be enforceable, broad enough to cover what actually matters — is one of the more important drafting choices in any NDA.

Most NDAs exclude certain categories of information from protection, even if it would otherwise qualify as confidential. Common exclusions include information that was already public before disclosure, information the recipient already knew before receiving it, information independently developed without reference to the disclosed information, and information the recipient is legally required to disclose, such as under a court order.

These exclusions exist for good reason — without them, an NDA could be used to claim ownership over information that was never actually secret, or to prevent someone from complying with a legal obligation. Reviewing these exclusions carefully helps clarify what the agreement is really protecting, as opposed to what it might appear to protect at first glance.

Some NDAs also carve out an exclusion for information that must be disclosed to professional advisors — lawyers, accountants, or auditors — bound by their own independent confidentiality obligations. Without this kind of carve-out, an overly strict NDA could technically prevent a party from getting basic professional advice about the very agreement they’ve signed, which is rarely anyone’s actual intention.

NDAs typically specify how long the confidentiality obligation lasts — sometimes a fixed period like two or five years, and sometimes indefinitely for particularly sensitive categories of information, such as trade secrets. It’s worth thinking realistically about how long the information will actually remain sensitive, since an unreasonably long term can be harder to enforce, while too short a term may leave genuinely sensitive information unprotected once it expires.

It’s also worth distinguishing the term of the NDA itself (how long the agreement remains in effect for new disclosures) from the duration of the confidentiality obligation for information already disclosed, since these two periods don’t necessarily need to match and are sometimes conflated in poorly drafted agreements.

For trade secrets specifically, some agreements specify that protection continues for as long as the information remains a genuine trade secret, rather than a fixed calendar term — reflecting the reality that a formula, process, or method might remain commercially sensitive far longer than any fixed number of years would reasonably capture.

If confidential information is disclosed or used in breach of an NDA, the injured party can generally pursue damages for any loss caused — though proving the exact financial harm from an information leak can be genuinely difficult, since the damage is often reputational or competitive rather than a simple, quantifiable dollar figure.

Because damages can be hard to prove and calculate, many NDAs include a clause allowing the injured party to seek an injunction — a court order stopping further disclosure or use — without necessarily having to prove specific monetary loss first, reflecting the reality that stopping ongoing harm quickly can matter more than a damages award that arrives long after the information has already spread.

Some NDAs also include a liquidated damages clause, specifying a pre-agreed amount payable for a breach, which can simplify enforcement considerably compared to proving actual loss from scratch. As with any liquidated damages provision, the amount needs to reflect a genuine, reasonable pre-estimate of likely harm rather than functioning as an arbitrary penalty, or a court may decline to enforce it as written.

An NDA is a valuable tool, but it isn’t a complete solution to every confidentiality concern. It relies on the other party actually complying, and enforcement after a breach can be difficult, costly, and slow — by the time a court process concludes, sensitive information may already have caused significant competitive harm that money can’t fully undo.

For this reason, NDAs work best as one layer of protection alongside practical safeguards — limiting who internally has access to sensitive information, being thoughtful about what’s actually necessary to disclose in the first place, and using separate, more specific agreements (like a proper licensing or intellectual property assignment agreement) where the situation calls for something more than a simple promise of confidentiality.

It’s also worth accepting that an NDA works best as a deterrent and a framework for recourse, rather than a guarantee that information will never leak. Parties who sign NDAs in good faith rarely need to rely on enforcement at all — the more important function is setting clear expectations upfront, so everyone understands what’s expected before any disclosure happens.

Before signing an NDA, confirm which type applies to your situation (mutual or one-way), read the definition of confidential information closely, and check the duration of the obligation against how long the information will realistically remain sensitive. If the agreement seems unusually one-sided given the actual information being exchanged, that’s worth raising directly rather than assuming it’s standard.

Finally, keep a copy of every NDA you sign, organized in a way you can actually find again, along with a note of what information was shared under it and when. This might seem like unnecessary record-keeping in the moment, but it becomes genuinely valuable if a question about confidentiality ever arises months or years down the line.

For related agreements covering broader business relationships, see our guides to service agreements and independent contractor agreements, both of which often incorporate confidentiality terms alongside their other provisions.