Judgments and settlements: Money paid to resolve lawsuits
Regulatory fines: Penalties from government agencies for data breaches
Business losses: Lost profits, customer churn, reputational damage
Indemnification goes beyond ordinary breach of contract damages. It shifts the full financial burden of specified events to one party, which can be much larger than direct damages alone.
⚖
Mutual vs. One-Way Indemnification
The structure of indemnification significantly affects risk allocation:
Mutual Indemnification
Both parties indemnify each other for their own breaches. If you breach and cause losses to me, you pay. If I breach and cause losses to you, I pay. This is fair when both parties share confidential information.
One-Way Indemnification
Only one party (typically the recipient) indemnifies the other. This heavily favors the discloser and creates asymmetric risk. Only appropriate when information flows one direction.
Key insight: In a mutual NDA where both parties share confidential information, demand mutual indemnification. One-way indemnification is a red flag that the other side is trying to shift all risk to you.
🎯
Why This Clause Matters
Unlimited liability potential: Without caps, a major data breach could expose you to millions in third-party claims, regulatory fines, and class actions
Defense cost obligations: You may have to pay legal fees as they're incurred, creating cash flow crises even before liability is determined
Settlement control: Who controls settlement decisions affects your reputation and future exposure
Insurance gaps: Standard liability insurance may not cover contractual indemnification obligations
Survival beyond termination: Indemnification often survives NDA termination indefinitely
📄
Clause Versions
Indemnification
Each party (as "Indemnifying Party") agrees to indemnify, defend, and hold harmless the other party and its directors, officers, employees, and agents (collectively, "Indemnified Parties") from and against any third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to any material breach by the Indemnifying Party of its confidentiality obligations under this Agreement.
Indemnification Procedures:
(a) Notice. The Indemnified Party shall provide prompt written notice of any claim for which indemnification is sought. Failure to provide timely notice shall not relieve the Indemnifying Party of its obligations except to the extent actually prejudiced by such delay.
(b) Defense. The Indemnifying Party shall have the right to assume control of the defense of any claim with counsel reasonably acceptable to the Indemnified Party. The Indemnified Party may participate in the defense at its own expense.
(c) Cooperation. The Indemnified Party shall provide reasonable cooperation in the defense of any claim.
(d) Settlement. The Indemnifying Party shall not settle any claim in a manner that imposes obligations on, or requires admissions by, the Indemnified Party without prior written consent.
Limitation. This indemnification obligation shall be subject to any limitation of liability provisions set forth elsewhere in this Agreement.
Note: This balanced version is mutual (both parties indemnify), limited to third-party claims from material breaches, includes fair procedures, and incorporates limitation of liability caps.
Limited Indemnification
Each party agrees to indemnify and hold harmless the other party from and against direct damages arising from third-party claims that directly result from a proven, material breach of the indemnifying party's confidentiality obligations under this Agreement.
This indemnification obligation is subject to the following limitations:
(a) Scope. Indemnification applies only to third-party claims, not to direct claims between the parties, which shall be governed by ordinary breach of contract principles.
(b) Causation. The breach must be the direct and proximate cause of the third-party claim. Indemnification does not apply to claims that would have arisen regardless of the breach.
(c) Damages. Indemnification is limited to direct, documented damages actually paid to third parties. Consequential, indirect, incidental, special, punitive, and exemplary damages are excluded.
(d) Cap. Total indemnification obligations shall not exceed the greater of: (i) amounts paid under any related commercial agreement between the parties during the twelve (12) months preceding the claim, or (ii) One Hundred Thousand Dollars ($100,000).
(e) Fault. No indemnification shall be required for claims arising in whole or in part from the Indemnified Party's own negligence, willful misconduct, or breach of this Agreement.
(f) Mitigation. The Indemnified Party must use commercially reasonable efforts to mitigate damages.
(g) Timing. The Indemnifying Party is not obligated to fund defense costs until final, non-appealable resolution of the underlying claim.
(h) Exclusive Remedy. This indemnification shall be the Indemnified Party's sole and exclusive remedy for third-party claims arising from confidentiality breaches.
Why this favors you: Capped liability, excludes consequential damages, requires proven breach, carves out their fault, no upfront defense costs, requires mitigation, and positions this as exclusive remedy.
Comprehensive Indemnification
The Receiving Party shall indemnify, defend, and hold harmless the Disclosing Party, its affiliates, and their respective directors, officers, employees, agents, successors, and assigns (collectively, "Protected Parties") from and against any and all claims, demands, actions, suits, proceedings, losses, damages, liabilities, judgments, settlements, fines, penalties, costs, and expenses of any nature whatsoever (including attorneys' fees and costs of investigation and litigation), whether direct, indirect, consequential, incidental, special, or punitive, arising out of or relating to:
(a) Any breach or alleged breach of the Receiving Party's obligations under this Agreement;
(b) Any unauthorized access to, use of, or disclosure of Confidential Information;
(c) Any actions or omissions of the Receiving Party's employees, contractors, or agents;
(d) Any claims by third parties arising from the Receiving Party's handling of Confidential Information; or
(e) Any regulatory investigations, enforcement actions, or proceedings related to the Receiving Party's protection of Confidential Information.
The Receiving Party's indemnification obligations shall:
(i) Apply regardless of any negligence or fault of the Protected Parties;
(ii) Include the obligation to pay defense costs as they are incurred, within ten (10) business days of invoice;
(iii) Not be subject to any limitation of liability provisions in this Agreement or any related agreement;
(iv) Survive the expiration or termination of this Agreement without time limitation; and
(v) Include the obligation to post a performance bond or other security upon the Protected Party's reasonable request.
The Protected Parties shall have sole discretion over the defense and settlement of any claim. The Receiving Party shall have no right to participate in defense strategy or settlement decisions.
Warning - Extremely one-sided: Only the receiving party indemnifies, covers both actual and alleged breaches, all damage types, applies even for their own negligence, no liability caps, immediate defense cost payment, no settlement control, and requires posting a bond. Creates unlimited, unpredictable liability.
💡
Key Considerations
1
Mutual NDAs = Mutual Indemnification: If both parties share confidential information, both should bear indemnification risk for their own breaches.
2
Third-Party Claims Only: Limit indemnification to claims from outsiders. Direct disputes should use standard breach remedies.
3
Require "Material" Breach: Minor technical violations should not trigger indemnification. Require a significant breach that causes real harm.
4
Apply Liability Caps: Ensure the limitation of liability clause applies to indemnification. Uncapped indemnification creates unlimited exposure.
5
Control Defense Costs: Avoid pay-as-you-go defense cost obligations. These can bankrupt you before liability is even determined.
6
Exclude Their Fault: You should not indemnify for losses caused by the other party's own negligence or misconduct.