Your client wants you to sign an NDA, but is it really an NDA? And should you sign it anyway?
Clients often use NDA as a catch-all term for almost any document about confidential information. But the document they send may do much more than ask you to keep their information confidential. It may deal with personal data, claim ownership of your work, restrict who else you can work with, or make you responsible for losses that are completely out of proportion to the value of the work.
Before you sign it, you need to know what it actually covers, whether you have already dealt with the same issues in your own terms, and whether signing it would leave you with two contracts trying to govern the same piece of work.
What is an NDA?
NDA stands for non-disclosure agreement. In the UK, we also call it a confidentiality agreement. Its basic job is to identify information that must be kept confidential and explain who can use it, what they can use it for and how long they must keep it confidential.
Some NDAs work in one direction because only one side is sharing confidential information. Others are mutual because both sides will be sharing it. Either can be perfectly sensible. The problem is assuming that a document is only about confidentiality because somebody has saved it as NDA.pdf.
When would a client ask you to sign one?
There are two common points at which a client may ask for an NDA. The first is before they have decided to work with you. The second is when the work is about to start, or sometimes after it has already started. Those are quite different situations, and the document should not automatically cover both.
Before a discovery call or proposal
A potential client may need to tell you something sensitive so that you can understand the work and prepare a proposal. They might need to discuss a product that has not launched, a difficult situation in the business, their pricing, their customers or plans that are not yet public. It is reasonable for them to want that conversation kept confidential.
A short confidentiality agreement can work well here, but it should be clear that it covers the preliminary conversation. Its purpose is to let you discuss the possible work safely. It should not quietly turn into the contract for a project that has not yet been agreed.
Your KoffeeKlatch terms already include confidentiality
If you use KoffeeKlatch terms, confidentiality is already covered. You need to make sure the potential client sees those terms before confidential information is shared, rather than sending them afterwards and hoping they apply retrospectively.
You can link to your terms when somebody books a discovery call and include the link again in the confirmation. We explain how that fits into the wider booking process in Is Calendly GDPR Compliant? Have You Checked?.
If the client still wants you to sign their NDA before the call, check that it is limited to the pre-sale discussion. If they later hire you, the project itself should be covered by the contract you both deliberately agree to use for the work.
What if they send an NDA after signing your terms?
This is where things can become messy. Your KoffeeKlatch terms already cover confidentiality during the work and after it ends. If the client then sends another document that is meant to apply to the whole project, it may repeat your terms, contradict them or add a much wider set of promises.
We see VAs and other service providers say, ‘They signed my terms and I signed their NDA.’ It sounds as though everybody is protected. In reality, it may mean that two agreements are trying to control the same work.
Do not assume their NDA can sit harmlessly beside your contract. Check what it covers and whether it says that it overrides any other agreement. Our blog Never Sign Two Contracts explains why piling one agreement on top of another can create more uncertainty rather than more protection.
Sometimes ‘NDA’ really means a data processing agreement
Clients also use NDA when what they really need is a data processing agreement, often shortened to DPA. The two documents are not interchangeable.
A confidentiality agreement deals with information the parties want to keep confidential. A DPA deals with personal data that one business processes on behalf of another. Personal data might include information about the client’s prospects, customers, members, staff, associates or suppliers.
There can be an overlap because personal data must be kept secure and confidential. But a general promise not to disclose information is not enough to deal with all the data protection points that need to be agreed between a controller and a processor.
What does a DPA need to cover?
A DPA should describe the personal data you will handle, what you will do with it, why you are doing it and how long the processing will last. It also needs to cover the client’s instructions, confidentiality, security, the software providers and other subprocessors you use, help with people’s data rights, data breaches, audits and what happens to the information when the work ends.
You do not need a DPA simply because a client has your name and email address, or because you have theirs. It becomes relevant when you are processing personal data for the client as part of the service. A VA managing a client’s customer database is an obvious example. The precise roles depend on what you are actually doing, not the job title on your website.
Use their DPA or create one from your KoffeeKlatch pack
Some clients have a suitable DPA ready to use. Many smaller businesses do not. KoffeeKlatch contract packs are set up so that you can use the client’s agreement, or use the Data Processing Form and the accompanying documents in your pack to create one when they do not have one.
You do not need two DPAs covering the same work. Before you use the client’s version, compare it with your KoffeeKlatch documents. Make sure it describes the service you are actually providing, the personal data you will really handle, the systems you use and the security measures you can genuinely deliver.
What else might be hiding in an NDA?
Many client NDAs were written for large suppliers carrying out major projects. They are then sent unchanged to a sole trader doing a few hundred pounds of work. The title may say NDA, but the clauses can reach into almost every part of your business relationship.
Check what information is covered and what you are allowed to do with it. Make sure you can share information where necessary with your team, associates, software providers, insurer and professional advisers. Look at how long the obligations last and whether sensible exceptions have been included for information that is already public or that you developed independently.
Pay particular attention to intellectual property. An NDA should not casually hand ownership of your existing templates, systems or ways of working to the client. Look for restrictions on working with other businesses, approaching people or mentioning the client in your portfolio. Those are substantial commercial terms, even if they have been tucked into a document labelled NDA.
If the document goes much further than confidentiality, our guide to understanding the contract your client wants you to sign explains more of the wording and documents you may need to check.
Watch out for liability and indemnities
This is often where the biggest risk sits. We have seen documents that try to place millions of pounds of potential liability on a small service provider doing work worth a few hundred pounds. Others include unlimited indemnities or try to make you responsible for every loss the client connects with a breach.
Do not assume that an extreme clause does not matter because nobody is likely to use it. If the client wants you to accept a level of risk that has no sensible relationship to the work or your fees, raise it before you sign.
Will your insurance cover it?
Check the document against your professional indemnity and cyber insurance. Look at the type of work covered, any geographical limits or exclusions, the maximum amount the insurer will pay and any requirement to tell the insurer about a problem quickly.
No insurer can give you genuinely unlimited cover. If you agree to unlimited liability, insurance does not make the extra risk disappear. Your policy may also exclude liabilities you accepted only because you signed a contract. If you are unsure, ask your broker or insurer about the actual clause instead of assuming that every promise in the client’s NDA is covered.
What should you say when a client sends one?
You do not have to sign immediately, and you do not need to turn the request into a confrontation. Tell the client you need to check what the document covers and how it fits with the terms already proposed or agreed.
Thanks for sending this over. I need to check what the document covers and how it fits with the terms for the project. If it is only intended to protect information shared before we decide whether to work together, we can make that clear. If it is intended to cover the project or our handling of personal data, we need to make sure it works with the main contract rather than creating overlapping obligations.
Compare the documents before you sign
If your client’s NDA, DPA or wider contract overlaps with your KoffeeKlatch terms, our Client Contract Comparison can help you understand the important differences and identify points that may need to be clarified or negotiated before you agree.
Remember it is really hard to get those ducks in a row if you and the client don’t even have the same ducks!
