Introduction

Non-Disclosure Agreements (NDAs) are essential tools for protecting confidential information shared between parties. A common question arises regarding whether the recipient’s employees must sign separate NDAs for each agreement the recipient enters into. This practice note explores the best practices for defining authorized recipients under NDAs and the practical approaches to ensuring confidentiality obligations are effectively managed within organizations.

Defining Authorized Recipients

Best practice under NDAs is to limit authorized recipients to those with a genuine “need-to-know” basis. This typically includes employees, officers, directors, professional advisors and approved subcontractors who are directly involved in the project or transaction. The receiving party must ensure these individuals are bound by confidentiality obligations that are at least as strict as those in the NDA itself.

Scope of Authorized Recipients

• Employees & Officers: Only those directly involved in the project or transaction.
• Professional Advisors: Lawyers, accountants, auditors or consultants, provided they are bound by professional or contractual confidentiality duties.
• Affiliates/Subcontractors: Only if necessary, and usually subject to prior written consent from the disclosing party.
• Regulators/Authorities: Disclosure permitted only when legally required, with notice to the disclosing party where possible.

Need-to-Know Principle

Confidential information should be shared only with individuals who require it to perform their role. This prevents blanket access across the organization and reduces the risk of leaks.

Receiving Party’s Arrangements

The receiving party should implement contractual flow-down mechanisms, internal controls, training, and monitoring to ensure confidentiality obligations are upheld:

• Contractual Flow-Down: Ensure recipients sign confidentiality agreements or are otherwise legally bound.
• Internal Controls: Limit access through secure systems, passwords and access rights.
• Training & Awareness: Educate employees and contractors on confidentiality obligations.
• Monitoring & Enforcement: Keep records of who accessed the information and enforce compliance.

Risks and Mitigation

• Overly broad definitions of recipients can lead to uncontrolled dissemination. Mitigation involves narrowing definitions and requiring prior consent for third parties.
• Advisors or contractors not bound by NDA may cause leakage. Mitigation includes requiring written undertakings or confirming professional obligations.
• Employees unaware of obligations may cause accidental disclosure. Mitigation involves training, access controls and compliance audits.

Practical Drafting Tips

• Use clear language limiting disclosure to those with a need-to-know and bound by confidentiality obligations no less restrictive than the NDA.
• Require written consent before disclosure to affiliates or subcontractors.
• Include notification obligations if disclosure is compelled by law.

Conclusion

Employees do not need to sign separate NDAs for each agreement if the receiving party ensures they are already bound by confidentiality obligations that meet or exceed the NDA’s requirements. Implementing contractual flow-downs, internal controls, and training effectively manages confidentiality risks and ensures compliance.

References

• https://legal.thomsonreuters.com/en/insights/articles/confidentiality-agreements
• https://www.debeerattorneys.com/post/non-disclosure-agreement-nda
• https://smesouthafrica.co.za/understanding-non-disclosure-agreements-ndas-in-south-africa/

Disclaimer

This practice note is for informational purposes only and does not constitute legal advice. For specific legal guidance, consult a qualified attorney.