Confidentiality Agreements in New Zealand: What Businesses Should Include

A standard confidentiality agreement can protect your pricing, product plans, customer data and commercial know-how, but only if it is drafted for the way your business actually shares information. Many New Zealand businesses make the same mistakes: they use a one-line NDA downloaded from overseas, they define confidential information too vaguely, or they sign the other side's standard terms without checking what happens if information is misused. Those gaps often show up later, when a contractor starts working with a competitor, a supplier reuses your idea, or a deal falls over and sensitive material is still sitting in someone else's inbox.

The good news is that a practical confidentiality agreement does not need to be complicated. It needs to be clear about what is protected, who can use it, how long obligations last, and what happens when the relationship ends. This guide explains what a standard confidentiality agreement usually covers in New Zealand, when businesses commonly use NDAs, the legal issues to check before you sign, and the mistakes that cause the most trouble in real commercial negotiations.

Overview

A standard confidentiality agreement is a contract that limits how someone can use and disclose confidential information you share with them. In New Zealand, it is commonly used before discussions with employees, contractors, consultants, investors, suppliers, manufacturers, software developers and potential buyers.

The agreement works best when it is tailored to the specific deal, the type of information being disclosed, and the practical risks if the relationship ends badly.

• Define confidential information clearly, including whether oral discussions, drafts, data and samples are covered.
• Set out exactly what the receiving party may use the information for, and what they must not do with it.
• Include sensible exclusions, such as information already public or independently developed without using your material.
• Deal with disclosure to staff, advisers and subcontractors, including who remains responsible if they misuse the information.
• State how long confidentiality obligations last, and whether any parts should survive indefinitely.
• Explain what happens to documents, files, prototypes and data when the arrangement ends.
• Check whether privacy, intellectual property, non-solicitation or restraint provisions are also needed, rather than assuming the NDA covers everything.

When New Zealand Businesses Use NDAs

New Zealand businesses usually use NDAs when they need to share valuable information before trust is fully established. The main purpose is to let commercial discussions move forward without leaving your business exposed.

Early discussions with suppliers, developers and manufacturers

Founders often disclose product concepts, customer pain points, pricing models or software specifications before a formal services agreement is ready. That is a classic point for a standard confidentiality agreement.

For example, you might share a prototype with a local manufacturer, discuss a custom app build with a developer, or hand over internal process documents to a systems consultant. If those conversations happen before you sign the main contract, the NDA fills the gap.

This matters because the other side may not be acting badly, but they may still reuse general ideas, store your documents carelessly, or circulate material internally more widely than you expected.

Hiring employees and contractors

Confidentiality clauses often appear in employment and contractor agreements, but a standalone NDA can still be useful before you issue the full contract. This can happen when you are interviewing senior hires, discussing a sensitive role, or sharing access to commercial plans before the relationship formally starts.

For contractors, the risk is often higher because they may work across multiple clients in the same sector. If you are about to disclose customer lists, code repositories, margins or strategic plans, the confidentiality terms should be clear before you grant access.

Investment and acquisition discussions

Businesses commonly use NDAs before due diligence begins. Investors, strategic partners and potential buyers may ask for financials, cap table information, supplier contracts, forecasts, product roadmaps and customer metrics.

Some investors will not sign a broad NDA at an early stage, especially where they review many similar businesses. That does not mean confidentiality is irrelevant. It means you should think carefully about when to disclose the most sensitive information, how it is staged, and whether the agreement is realistic enough for the other side to accept.

Joint ventures and collaborations

When two businesses explore a collaboration, each side may reveal methods, sales data, technical material or future plans. A mutual NDA is often the better format here, because both parties are disclosing confidential information and both want equivalent protection.

This is where founders often get caught. They sign a one-way NDA that only protects the other side, then start sharing their own information on the assumption that the arrangement is mutual. Before you sign, check whether the protection actually runs both ways.

Customer and service-provider relationships involving data

Some service arrangements involve access to customer records, internal reporting, contact databases or commercially sensitive performance data. An NDA can help, but it may not be enough on its own.

If personal information is involved, the Privacy Act 2020 may also matter. A confidentiality clause does not replace privacy obligations. You may need terms dealing with data handling, storage, access controls, breach notification and permitted processing, especially where a provider is effectively handling information on your behalf.

Legal Issues To Check Before You Sign

The most useful NDA is specific about the information, the purpose and the practical consequences of misuse. Before you sign a contract, focus on whether the document matches the real transaction rather than whether it simply looks standard.

What counts as confidential information?

The definition of confidential information is the core of the agreement. If it is too narrow, important material falls outside the contract. If it is too broad, the NDA may be difficult to manage and harder to negotiate.

A good definition usually covers information disclosed in writing, electronically, visually and verbally, but it should also explain whether certain categories are included. Depending on the deal, that may include:

• business plans and strategy documents
• financial information, budgets and pricing
• customer and supplier lists
• software, source code, technical specifications and product designs
• marketing plans and launch timelines
• samples, prototypes and test results
• notes, summaries and analyses created from the original material

If oral disclosures matter, the agreement should say how they are identified as confidential. Otherwise, arguments can arise later about what was actually protected in a meeting or phone call.

What is the information allowed to be used for?

An NDA should not just say "keep this secret". It should also say what the receiving party is allowed to do with the information.

This is often expressed as a permitted purpose, such as evaluating a proposed supply arrangement, performing services under a contract, or assessing a possible investment. That matters because misuse is not limited to public disclosure. A party may breach the agreement by using your information for its own commercial advantage, even if it never publishes it.

Before you accept the provider's standard terms, ask whether the purpose is tight enough. If they can use the information for broad "business purposes", the protection may be much weaker than you expect.

Who can receive the information internally?

Most recipients need to share confidential information with staff, directors, related companies, professional advisers or subcontractors. The key question is not whether they can share it at all, but on what conditions.

The agreement should usually require disclosure only to people who genuinely need to know and who are bound by confidentiality obligations. It should also make clear that the receiving party remains responsible if those people misuse the information.

Without that clause, you may end up arguing about whether a consultant, affiliate or offshore team member was technically part of the recipient's organisation.

What exceptions apply?

Reasonable exceptions are standard and usually necessary. They recognise that not every piece of information can be treated as confidential forever.

Typical exclusions include information that:

• is already public, other than because of a breach
• was lawfully known by the recipient before disclosure
• is received lawfully from a third party without confidentiality restrictions
• is independently developed without using the confidential information
• must be disclosed by law, court order or regulatory requirement

The detail matters. For example, if disclosure is legally required, the agreement can still require the recipient to notify you first where legally permitted, so you have a chance to respond or limit the scope of disclosure.

How long do the obligations last?

Many founders assume confidentiality lasts forever. Sometimes it should, but often the term needs a more careful approach.

Some information loses value over time, while trade secrets, algorithms, source code or customer insights may stay sensitive for years. A standard confidentiality agreement may set a fixed period, such as two to five years, or provide that trade-secret style information remains protected for as long as it stays confidential in nature.

If the period is too short, the agreement may stop protecting information while it is still commercially valuable. If it is unrealistically long for ordinary business information, the other party may push back.

Return, deletion and ongoing storage

When talks end or services finish, the agreement should say what happens next. This is one of the most overlooked parts of an NDA.

You may want the recipient to return or destroy hard copies, permanently delete electronic files, and confirm in writing that this has been done. At the same time, many businesses need carve-outs for routine backups, legal archives or compliance records.

The practical point is to avoid a situation where confidential material remains spread across laptops, shared drives and email systems long after the project has ended.

Does the NDA deal with intellectual property?

A confidentiality agreement protects secrecy, not ownership. If you are disclosing material while someone is developing software, designs, marketing content or inventions for you, an NDA alone may not give you the intellectual property rights you expect.

Before you rely on a verbal promise that "anything created will belong to us", check whether you also need clear IP assignment or licence clauses in the main contract. This issue often arises with developers, designers, agencies and technical consultants.

What remedies are realistic?

If confidential information is misused, damages may be hard to calculate. The agreement often states that the disclosing party can seek urgent relief, such as an injunction, to stop further disclosure.

That wording can be useful, but it is not magic. The real value comes from having clear obligations, a sensible scope, and evidence of what was shared and when. If the document is vague, enforcement becomes harder.

It also helps to think beyond the contract itself. Version control, restricted access, confidentiality labels and good record-keeping make legal rights easier to protect if a dispute arises.

Common NDA Mistakes

The most common NDA mistakes are practical, not technical. Businesses often sign too quickly, assume confidentiality covers more than it does, and only read the agreement properly after something has gone wrong.

Using a generic overseas template

A template may be a starting point, but many are drafted for US or UK legal systems and negotiation styles. The language may not fit New Zealand business practice, and key clauses may be missing or overblown.

Common problems include references to foreign law, unrealistic penalty wording, and definitions so broad that no sensible counterparty will sign. A standard confidentiality agreement should still reflect your actual deal, your risk and your market.

Leaving the confidential information undefined

If the NDA simply says "all information relating to the business" is confidential, that may sound strong, but it can create uncertainty. The recipient may later say they could not tell what was genuinely confidential, especially where some material was already public or commercially obvious.

Specific drafting makes disputes less likely. You do not need to list every document, but you should identify the categories that matter.

Assuming the NDA stops competition

An NDA is not a general non-compete. It stops misuse and disclosure of confidential information, but it does not automatically stop the other party from operating in the same market, working with competitors or building a similar product using their own know-how.

If your concern is staff poaching, customer solicitation or direct competitive activity, those issues need separate clauses and careful drafting. In New Zealand, restraint provisions need to be reasonable to be enforceable, so they should not be added casually.

Forgetting privacy obligations

Businesses sometimes treat all data issues as confidentiality issues. That is a mistake where personal information is involved.

If an NDA sits alongside a service arrangement involving customer or employee data, you may also need privacy terms that deal with collection, use, storage, access, security and breach handling. The legal and operational risks are different from a simple non-disclosure promise.

Signing mutual terms when the disclosure is really one-way

A mutual NDA can be efficient, but only if both sides are genuinely sharing sensitive information. If your business is making most of the disclosure and the other side contributes very little, a mutual form can create unnecessary complexity and extra obligations for you.

Before you sign, ask whether the structure reflects what is actually happening. A one-way agreement is often better where only one party is disclosing valuable information.

Relying on the NDA without a main contract

An NDA is often signed first, but it is rarely the only contract you need. Once the project moves ahead, you may also need service terms, contractor terms, IP clauses, payment provisions, acceptance criteria and liability clauses.

This is where founders often get caught. They share valuable information under an NDA, start work informally, and assume the rest can be sorted out later. The result is often a messy argument about scope, ownership, payment or deliverables.

Not matching the document to real business processes

A confidentiality agreement works poorly if your team does not know it exists or cannot follow it in practice. For example, there is little value in requiring strict deletion on termination if staff routinely save documents in personal folders and messaging apps.

Think about how information is actually shared in your business. A useful internal process may include:

• marking key documents as confidential
• limiting access to deal rooms, drives or folders
• keeping a record of what was disclosed and to whom
• using consistent contracts across staff, contractors and advisers
• collecting devices and access rights promptly when a relationship ends

FAQs

Is an NDA the same as a standard confidentiality agreement?

Yes. NDA stands for non-disclosure agreement, which is another common name for a confidentiality agreement. The effect depends on the actual wording, not the label.

Are verbal discussions protected if nothing is written down?

Sometimes, but only if the agreement covers oral disclosures clearly enough. If sensitive discussions happen in meetings or calls, the contract should say how oral information is identified and treated as confidential.

Can a confidentiality agreement last forever?

It can for some types of information, especially trade-secret style material, but not every clause should automatically last forever. A realistic time period depends on the nature of the information and the commercial context.

Does a confidentiality agreement protect intellectual property ownership?

Not by itself. It helps stop misuse and disclosure, but ownership of new work, inventions, code or designs should usually be dealt with in separate IP clauses or the main services contract.

What should I do before signing the other party's NDA?

Check the definition of confidential information, the permitted purpose, any broad internal sharing rights, the term, the return or deletion clause, and whether the agreement is one-way or mutual. If the project also involves personal information or new IP, make sure those issues are covered somewhere else before you sign.

Key Takeaways

• A standard confidentiality agreement should clearly identify what information is protected and how it may be used.
• The best NDA for your business depends on the real transaction, including who is disclosing information, why it is being shared, and how sensitive it is.
• Key clauses usually cover the definition of confidential information, permitted purpose, exceptions, who can access the information, duration, and return or deletion of materials.
• An NDA does not automatically deal with privacy, intellectual property ownership, non-solicitation or restraint issues, so separate clauses or contracts may still be needed.
• Many disputes come from vague templates, overly broad wording, or signing standard terms before checking whether they fit the deal.
• Good internal practices, such as access controls, clear records and proper offboarding, make confidentiality obligations much easier to enforce.

If you want help with confidentiality clauses, intellectual property terms, privacy obligations, or contract review, you can reach us on 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.