Lawizer

NDA for Startups: When You Need One, What It Should Say, and What It Can’t Do

Every week, somewhere in Bengaluru, Mumbai, or Delhi, a founder shares their product roadmap with a potential investor — without an NDA. Sometimes nothing happens. Sometimes that “investor” builds the same product six months later. An NDA won’t guarantee you never face that situation, but signing one correctly — before the conversation — means you have legal standing if things go wrong. Not signing one means you don’t.

Here’s the thing: most startup NDAs in India are either never signed, signed too late, or drafted so vaguely they wouldn’t survive a courtroom. This guide fixes all three problems.

📌 TL;DR: An NDA (Non-Disclosure Agreement) is a legally binding contract under the Indian Contract Act, 1872 that prevents the receiving party from disclosing or misusing your confidential information. For Indian startups, NDAs are essential before sharing details with employees, contractors, vendors, co-founders, or potential investors. A valid NDA must clearly define what counts as confidential, set a reasonable duration, include exclusions, and specify dispute resolution. Critically, an NDA cannot protect information already in the public domain, stop a genuine whistleblower, or substitute for broader IP protection like patents or trademarks. Lawizer can draft a watertight, India-specific NDA for your startup quickly and affordably.

What You’ll Learn

What an NDA actually is under Indian law — and the two main types startups use
Exactly when your startup needs one, and with whom
Every clause a strong, India-specific NDA must include to be enforceable
What an NDA legally cannot do — the limits most founders don’t know about
Common NDA drafting mistakes that make the agreement worthless in court

What Is an NDA and How Does It Work Under Indian Law?

An NDA — Non-Disclosure Agreement — is a legally binding contract between two or more parties that establishes a confidential relationship. The receiving party agrees not to disclose or misuse specific information shared by the disclosing party. In India, NDAs are governed primarily by the Indian Contract Act, 1872 — which means for your NDA to hold up in court, it must satisfy the basic conditions of a valid contract under Section 10: a clear offer and acceptance, lawful consideration (can be a simple promise of mutual benefit), free consent from all parties, and a legal purpose.

Indian courts do uphold NDAs — but only when the terms are specific, reasonable, and don’t restrain trade. This is where Section 27 of the Indian Contract Act comes in. It prohibits agreements that unreasonably restrain a person’s right to carry on a trade or profession. So an NDA that says “you can never work in fintech again” will likely be struck down. An NDA that says “you cannot share our proprietary payment algorithm with third parties for three years” stands on much firmer ground. The distinction matters enormously when drafting.

Unilateral vs. Mutual NDA — Which One Does Your Startup Need?

A unilateral NDA (one-way) binds only one party — typically used when a startup shares information with an employee, contractor, or vendor. A mutual NDA (bilateral) binds both parties — used when two startups are exploring a partnership, merger, or collaboration and both sides are sharing sensitive information. For most early-stage Indian startups, unilateral NDAs cover the majority of situations: hiring, freelancer engagements, vendor negotiations, and early investor conversations.

When Does Your Startup Actually Need an NDA?

Not every conversation requires an NDA. But there are specific situations where skipping one is a serious legal risk. Let’s break this down by relationship type.

Employees and Co-Founders

Every full-time employee who will have access to your codebase, customer data, pricing models, or business strategy should sign an NDA before or on their first day — ideally as part of their employment agreement. Co-founders are trickier. Many founders assume trust eliminates the need for a formal agreement. What most founders miss: if a co-founder exits and later joins a competitor, a signed NDA is the only instrument that legally prevents them from taking your trade secrets with them. Pair the NDA with a solid founders’ agreement and legal structure from day one.

Freelancers and Contractors

A Bengaluru-based startup that hires a Mumbai freelancer to build their MVP is sharing source code, architecture decisions, and possibly user data. NDAs signed with freelancers or contractors in India are legally enforceable if the terms are clear and signed digitally or physically. One important addition: for contractors who are creating work for you, add an IP assignment clause alongside the NDA — clarifying that all work product belongs to your startup. Without it, the contractor could legally retain IP rights to code they wrote for you.

Vendors and Third-Party Service Providers

If a vendor — say, a payment gateway integration partner or a data analytics firm — will access your backend systems or customer data, an NDA is necessary. This is also relevant when you’re onboarding accounting firms, HR consultants, or legal advisors who will see sensitive financial information. The NDA in these cases should define exactly what data is being shared, for what purpose, and what happens to it after the engagement ends.

Investors — With an Important Caveat

Here’s an honest reality most legal blogs won’t tell you: most early-stage investors — angels and VCs in India — will refuse to sign an NDA at the pitch stage. They receive hundreds of pitches and signing individual NDAs for each creates legal liability. Pushing for an NDA before a first meeting can signal inexperience and may cost you the conversation. The practical approach: share only what you’re comfortable making public at the pitch stage, keep your “secret sauce” out of the first deck, and introduce an NDA once due diligence begins and a term sheet is on the table.

Legal Compliances for Startups in India ...

What a Strong NDA Must Include: Clause by Clause

A vague NDA is nearly useless. Indian courts have struck down confidentiality agreements where terms were ambiguous, the duration was unreasonable, or the definition of confidential information was too broad to be meaningful. Here is every clause your NDA needs to be enforceable.

1. Identification of Parties
State the full legal names and addresses of both the Disclosing Party (your startup) and the Receiving Party. If your startup is a Private Limited Company, use the exact registered name as it appears in your Certificate of Incorporation. Mismatches between the NDA and your company registration documents create grounds for challenging enforceability.

2. Definition of Confidential Information
This is the most critical clause — and the one most often drafted poorly. A good definition should include: business plans and financial projections, software source code and technical architecture, customer and vendor lists, proprietary processes and formulas, and marketing strategies. Specify how information can be marked as confidential — in writing, verbally (confirmed in writing within 30 days), or by its nature. If it isn’t defined, it isn’t protected.

3. Exclusions from Confidentiality
Every enforceable Indian NDA must list what is not covered: information already in the public domain through no fault of the receiving party; information the receiving party already knew before signing; information independently developed by the receiving party; information received from a third party without restriction; and information that must be disclosed under a court order or law. These exclusions are what make the NDA reasonable.

4. Obligations of the Receiving Party
Specify what the receiving party must do: keep the information confidential, use it only for the agreed purpose, limit internal access to those who need to know, and apply the same standard of care they would use to protect their own confidential information. For tech startups, also prohibit reverse engineering or using the information to develop a competing product.

5. Duration
The standard duration for most startup NDAs is 2 to 5 years. For trade secrets specifically, you can specify that confidentiality obligations survive “for as long as the information remains a trade secret.” Keep this distinction explicit in the agreement.

6. Consequences of Breach and Dispute Resolution
Include the right to seek an injunction, monetary damages, and recovery of legal costs. Include an arbitration clause — governed by the Arbitration and Conciliation Act, 1996 — which is faster and more private than going to court.

7. Governing Law and Jurisdiction
Specify that the agreement is governed by the laws of India, and name the specific city where disputes will be adjudicated. Also ensure that digital signatures are treated as valid execution under the IT Act, 2000.

What an NDA Cannot Do — The Limits Founders Must Understand

This is the section most NDA guides skip. An NDA is a powerful tool — but treating it as a complete shield is a dangerous mistake.

It cannot protect information already public. Once information is in the public domain, an NDA cannot put it back. Courts will not enforce confidentiality over publicly accessible information.
It cannot stop a genuine whistleblower. If an employee discloses information to expose fraud or illegal activity within your startup, Indian law protects that disclosure. An NDA clause attempting to silence a whistleblower will be unenforceable.
It cannot replace a patent, trademark, or copyright. An NDA protects confidential information between specific parties. It does not give you ownership over an invention, brand, or creative work. Trademark and patent registrations are separate instruments — and the strongest protection combines both.
It cannot prevent someone from using general skills and knowledge. Your ex-CTO can go work at a competing startup. What they cannot do is take your specific codebase or client list with them.
It cannot protect what you failed to keep secret internally. Courts have declined to enforce NDAs where the startup had poor internal data controls — no access restrictions, unencrypted storage, or unrestricted internal sharing of the “confidential” information.

Common NDA Mistakes Indian Startups Make

Signing after the conversation: An NDA only covers information shared after it is signed. Always execute the NDA before any sensitive disclosure.
Using a generic international template: A US or UK NDA template may not align with the Indian Contract Act, the Specific Relief Act, 1963, or the IT Act, 2000. Jurisdiction clauses, consideration structures, and enforcement mechanisms differ significantly.
Confusing NDA with non-compete: An NDA restricts disclosure. A non-compete restricts who someone can work for. Post-employment non-compete clauses are extremely difficult to enforce under Indian law. Don’t bundle them into your NDA expecting the non-compete to hold.
No return or destruction clause: When an employee leaves or a contractor’s engagement ends, your NDA should specify that all confidential materials — including digital copies — must be returned or destroyed.

Frequently Asked Questions

Q: Is an NDA legally enforceable in India?
Yes, NDAs are legally enforceable in India under the Indian Contract Act, 1872, the Specific Relief Act, 1963, and — in cases involving digital data — the IT Act, 2000. Courts uphold NDAs when the terms are specific, the duration is reasonable, and the agreement does not unreasonably restrain trade under Section 27. Vague definitions of confidential information and overly broad restrictions are the most common reasons Indian courts decline to enforce an NDA.

Q: Should I ask investors to sign an NDA before my pitch?
In most cases, no — not at the very first meeting. Early-stage investors in India typically decline to sign NDAs at the pitch stage because they review hundreds of decks across similar sectors. The practical approach is to share only high-level information in the initial pitch, reserve proprietary details for due diligence, and introduce a mutual NDA once a term sheet or letter of intent is on the table.

Q: Can I use a digital signature on an NDA in India?
Yes. Digital signatures are legally valid for NDAs in India under the IT Act, 2000. A digitally signed NDA carries the same legal weight as a physically signed one, provided the signature is applied through a recognized e-signature platform. The NDA should explicitly state that electronic execution is valid and binding, and platforms using a Digital Signature Certificate (DSC) provide an audit trail useful in any future dispute.

Q: How long should an NDA last for a startup in India?
For most startup relationships — contractors, vendors, early employees — a duration of 2 to 5 years is standard and likely to be upheld by Indian courts. For trade secrets, you can specify that confidentiality obligations last “for as long as the information remains a trade secret.” Indefinite NDAs covering general business information are viewed with suspicion by courts and should be avoided.

Q: Does an NDA protect my startup idea from being stolen?
An NDA protects specific confidential information shared with a named party — it does not protect an idea in the abstract. Under Indian law, ideas alone cannot be patented or fully protected; only their concrete implementation can be. If a third party independently develops the same idea without access to your confidential information, an NDA gives you no claim against them. For stronger protection, pair an NDA with appropriate IP registration such as a patent or trademark.

Q: What happens if someone breaches an NDA in India?
You have two primary legal remedies. First, you can seek an injunction under the Specific Relief Act, 1963 — a court order directing the other party to stop the disclosure or use of your confidential information. Indian courts are generally quicker to grant injunctions than to award damages, making this the more immediate remedy. Second, you can sue for monetary damages. Including a pre-agreed penalty clause in your NDA and an arbitration clause speeds up the entire process significantly.

Ready to protect your startup’s confidential information?
Lawizer’s legal experts draft India-specific NDAs, employment confidentiality agreements, and full startup legal packages — fully online, starting at just ₹999. No CA visit, no lengthy back-and-forth.
Get Your Startup NDA Drafted by Lawizer → lawizer.com/startup-businesslegal