10 NDA red flags every founder should know in 2026

NDAs are not boilerplate

The phrase "it's just an NDA" has cost more founders more equity than any other six words in startup history. An NDA is the first document where you learn how the other side negotiates — and it often sets the tone for every contract that follows. Treat it as a small but real legal instrument, not a formality.

Red flag 1 — One-way disclosure with mutual obligations

Watch for clauses that bind only you to confidentiality while letting the other party freely use, share, or publish your information. A genuinely one-way NDA (you're the only one disclosing anything sensitive) is legitimate. A disguised one-way — where you sign mutual on the cover but the defined terms only protect their information — is not.

Red flag 2 — Indefinite or perpetual term

Most jurisdictions enforce confidentiality obligations for a defined period — typically 2 to 5 years for ordinary commercial information, indefinitely only for trade secrets. A blanket "perpetual" obligation is unenforceable in many U.S. states under the doctrine of unreasonable restraint of trade, and it's a signal the drafter copy-pasted without thinking.

Red flag 3 — Overbroad definition of Confidential Information

If the definition includes "any information disclosed orally, visually, or in writing, marked or unmarked," you've effectively agreed that everything you ever hear from them, including their dinner order, is confidential. Push for a narrower definition that requires either written marking or written follow-up confirmation within 30 days.

Red flag 4 — No standard carve-outs

A well-drafted NDA always carves out information that is (a) already public, (b) independently developed, (c) received from a third party without restriction, or (d) required to be disclosed by law. Missing carve-outs make routine business activities — like talking to investors about market trends — a technical breach.

Red flag 5 — Non-solicit hidden inside an NDA

Some "NDAs" smuggle in a 12-month non-solicit of employees and customers. That is a substantive restraint, not a confidentiality clause, and it should be negotiated separately and consciously. The American Bar Association has flagged this practice as a recurring drafting concern.

Red flag 6 — Injunctive relief without bond

Standard NDAs grant injunctive relief — court orders to stop a breach immediately. Aggressive NDAs waive the requirement that the plaintiff post a bond. That means the other side can shut down your business with a court order and you have no recourse if they're wrong. Always preserve your right to require a reasonable bond.

Red flag 7 — Governing law in their backyard

If you're a Bangalore founder signing an NDA governed by Delaware law with exclusive jurisdiction in San Francisco, you have effectively waived your ability to enforce or defend the contract. Push for neutral arbitration (Singapore or London) or your home jurisdiction.

Red flag 8 — Residuals clause that swallows the NDA

A residuals clause says "information retained in the unaided memory of your employees is not confidential." Big-tech NDAs love this clause because it lets them hire your former employees and not violate the NDA when those employees use what they learned. Strike it or define "unaided memory" very narrowly.

Red flag 9 — Liquidated damages of a fixed sum

"Breach of this NDA results in liquidated damages of $500,000." These clauses are often unenforceable in the U.S. (they look like penalties, not damages estimates) but they're meant to intimidate. Replace with "actual damages plus reasonable attorneys' fees."

Red flag 10 — Survival of all clauses, forever

Look for the "Survival" section. Reasonable NDAs survive confidentiality, IP ownership, and limitation of liability. Aggressive ones survive everything, including indemnities, non-solicits, and arbitration clauses, with no time limit. The Practical Law standard form is a useful reference for what survives and what doesn't.

The 60-second NDA test

Before signing any NDA, ask three questions: (1) Could I show this to my employees without worrying? (2) If they breached it the same way, would I sue? (3) Does it expire in my lifetime? If the answer to any of those is no, send it back. Better yet, drop it into ContractScan AI for an instant scorecard.