Startups share sensitive information all the time with prospective partners, customers, acquirers and sometimes investors. A confidentiality agreement sets the rules for how the other side may use that information while both parties decide whether to work together. I think it is a useful tool, but it works best alongside good judgement about what to share and when.
My usual advice is to share information in stages, starting with enough for a serious conversation and sharing more sensitive material as the commercial relationship becomes firmer. The NDA itself should fit what is actually being shared, and the other side should be able to comply with it in practice.
The recipient and the purpose
The NDA should name the company receiving the information and say which of its people may see it. If the recipient's affiliates or advisers are included, the agreement should either bind them directly or make the recipient responsible for how they use the information.
A one‑way NDA protects only the party that is disclosing information, while a mutual NDA places duties on both sides. Under a mutual NDA your own team also has to keep the other side's information confidential, so those obligations should be read as carefully as the protection you receive.
The permitted purpose should be defined narrowly, around evaluating the particular deal or project, so that any use outside that purpose requires written permission.
A definition that matches how you share
The agreement should say whether information must be marked "confidential" to be protected. If marking is required, it is worth thinking about demonstrations and calls, where nothing is marked, because many NDAs require oral disclosures to be confirmed in writing within a set number of days, and someone on the team has to remember to send that confirmation.
The usual exceptions cover information the recipient already knew, information that becomes public without any breach, information received lawfully from someone else, and information the recipient develops independently. A recipient who relies on independent development should be able to show how its own work was produced.
It also helps to share only what the discussion actually needs. A demonstration may answer the other side's questions without giving them source code, and a summary may answer them without handing over a full customer list. Personal data needs its own lawful basis for sharing under the Nigeria Data Protection Act, whatever the NDA says.
Watch for permissions inside the NDA
Some NDAs, particularly those drafted by large companies, include a residuals clause, which allows the recipient's staff to use anything they remember without referring to notes. If the value of your business lies in know‑how, that clause can remove much of the protection the NDA appears to give, so it should be narrowed or removed before anything distinctive is shared.
The NDA should also make clear that no licence is granted beyond evaluating the information. If reverse engineering is a concern, it should be prohibited as far as the law allows, and if the conversation turns into joint development, ownership of the resulting work should be agreed in a separate contract before the work begins.
Commercial terms are sometimes included as well, such as exclusivity or a ban on hiring each other's staff. These may be reasonable, but they are business commitments that go beyond confidentiality, so their scope and length should be read carefully and checked for enforceability.
A process the recipient can follow
Access should be limited to people who need the information and who are bound by confidentiality duties, and the recipient's file‑sharing and collaboration tools should be compatible with the restrictions in the agreement.
If a court or regulator orders the recipient to disclose the information, the recipient should notify you where the law allows, so that you can seek protection. Some laws prevent the recipient from telling you, and the clause should allow for that.
Return and deletion clauses also need to be realistic. Most companies cannot delete backups immediately, so the clause should allow copies kept in backups or for legal retention, with confidentiality continuing to apply to them.
Duration and remedies
The agreement should separate the period during which information may be shared from the period for which the confidentiality duty lasts. Trade secrets should be protected for as long as they remain secret, while ordinary commercial information may justify a period of two to five years.
It is also worth thinking about where you would go to court if you needed an urgent injunction. A startup in Lagos sharing information with a company in London should consider whether a Nigerian court order would actually help, or whether it needs a forum where the recipient has assets. In either case, the signed NDA and a record of what was shared will be the main evidence.
If the discussions turn into a real project, the parties will need a proper commercial agreement covering the work and its ownership. I explain that agreement in agreeing ownership in a customer development project, and the product side in making sure the company has the rights to its software, while the NDA continues to apply to confidential information within its scope.
Keep a record of what you shared
The signed NDA should be kept with a log of what was shared and with whom, and any written confirmations the NDA requires after calls should be sent on time. If there is ever a dispute, that record is what shows the information was protected and that the other side actually received it.
If you suspect a breach, the first steps are to preserve the evidence and take advice before writing to the other side. Communications should stay factual while you establish what happened and decide whether urgent action is needed.
This article is general information and not legal advice. For guidance on your specific circumstances, speak with us directly.