Return or Destruction of Information FAQ

This depends entirely on the specific language in your NDA. Many NDAs require destruction of "all copies" which technically includes backups. However, most modern NDAs include carve-outs for backup systems because:

• Technical impracticality: Enterprise backup systems often cannot selectively delete individual files without corrupting the entire backup
• Regulatory requirements: Many industries require maintaining backups for compliance purposes
• Disaster recovery: Backup integrity is critical for business continuity

Look for language like "except for copies retained in automated backup systems made in the ordinary course of business." If your NDA lacks this carve-out, negotiate to add it before signing. If you have already signed, discuss practical compliance options with the disclosing party.

Email archives present one of the most challenging compliance scenarios. Here is how to handle it:

Before signing the NDA: Add an explicit email archive carve-out. Standard language: "This obligation shall not require modification of automated email archiving systems maintained for legal or regulatory compliance, provided that such archived materials shall remain subject to confidentiality obligations."

If the NDA is already signed without a carve-out:

• Document your company's email retention policy as a pre-existing business practice
• Ensure archived emails are not actively searchable or accessible in normal course
• Include this limitation in your destruction certification
• Consider whether the disclosing party would reasonably expect you to dismantle your compliance infrastructure

Most disclosing parties will accept this practical limitation. If they insist on complete destruction, consider whether the business relationship is worth the compliance burden.

The honest answer: you cannot achieve 100% certainty. However, you can create strong incentives and documentation:

• Require officer certification: Having a C-level executive sign a destruction certificate creates personal accountability
• Specify destruction standards: Reference NIST SP 800-88 or similar standards for media sanitization
• Include audit rights: Reserve the right to audit compliance, though this is rarely exercised
• Tie to survival provisions: Ensure confidentiality obligations survive termination for backup data

Practical reality: focus on the information that matters most. If your truly sensitive information is properly controlled (limited distribution, marked confidential, tracked), you can verify its destruction. Incidental copies in backup systems are lower risk if primary copies are destroyed and the receiving party has no incentive to access them.

A proper destruction certification should include:

• Identification: Reference the NDA by date, parties, and any identifying number
• Scope statement: "All Confidential Information received under the Agreement"
• Actions taken: Describe whether materials were returned, destroyed, or both
• Destruction method: Physical shredding, secure electronic deletion, etc.
• Date of destruction: When the destruction was completed
• Exceptions: Any carve-outs for backups, legal holds, or regulatory requirements
• Signature: By an authorized officer with title and date

Require officer-level certification when possible. Here is why:

• Accountability: Officers have personal liability concerns that create stronger compliance incentives
• Authority: Officers can actually direct company-wide destruction efforts
• Credibility: Officer certifications carry more weight if you later need to enforce
• Due diligence: Officers are more likely to actually verify destruction before signing

Acceptable signatories typically include: CEO, CFO, General Counsel, Chief Compliance Officer, or VP-level executives. For smaller companies, any officer or director is usually acceptable.

For highly sensitive information, consider requiring certification from General Counsel specifically, as they understand the legal implications of false certification.

A false certification creates significant legal exposure:

• Breach of contract: The certification is a contractual representation; false statements breach the NDA
• Fraud claims: Knowingly false certification may support fraud claims with enhanced damages
• Punitive damages: Courts may award punitive damages for intentional misconduct
• Personal liability: The signing officer may face personal liability, not just corporate liability
• Criminal exposure: In extreme cases (trade secrets, classified information), criminal charges are possible

This is why certifications should be taken seriously. Never sign a certification without actually verifying destruction. If you cannot certify complete destruction due to backup limitations, include appropriate exceptions in the certification language.

Mixed information is one of the trickiest return/destruction scenarios. The key is distinguishing between:

• Original confidential information: Must be returned or destroyed
• Copies and extracts: Same treatment as originals
• Derivatives: Work product created using confidential information - treatment varies by NDA
• Residual knowledge: What you remember - usually exempt (see residuals clause)

Practical approaches:

• Redact confidential portions from mixed documents rather than destroying the entire document
• Create clean versions of work product that do not incorporate confidential information
• Document your separation process in case of later disputes
• If separation is impractical, discuss with disclosing party before the deadline

Yes, typically. Most NDAs make you responsible for your representatives' compliance. Here is how to handle it:

• Track distribution: Maintain a list of all external advisors who received confidential information
• Notify promptly: Send destruction notices to all advisors when the NDA terminates
• Obtain confirmations: Request written confirmation of destruction from each advisor
• Professional retention rules: Recognize that lawyers and accountants have their own retention obligations

Special considerations for legal counsel: Attorneys may need to retain certain materials for malpractice defense or conflict checking. Discuss this with both the disclosing party and your counsel to find acceptable limitations.

Practical tip: Before sharing with advisors, consider whether they really need the full confidential information or whether summaries or redacted versions would suffice.

Each approach has advantages:

Request Return When:

• You provided physical originals (prototypes, samples)
• You need to verify what was disclosed
• The materials have intrinsic value
• You want an audit trail of what was shared

Request Destruction When:

• Information was shared electronically (easier to destroy than ship)
• You do not want materials in transit where they could be lost or intercepted
• The receiving party made many copies that would be burdensome to return
• Return shipping costs are prohibitive

Best practice: Include both options in the NDA ("at Disclosing Party's election, return or destroy") so you can choose the appropriate method based on circumstances.

Short destruction timelines are common but often impractical. Here is how to handle this:

Before signing: Negotiate a reasonable timeline. 30 days is more practical than 10 days for most organizations. Push back: "We need time to locate all copies, coordinate with our IT team, obtain advisor confirmations, and prepare proper certification."

If already signed with a short deadline:

• Start immediately when the NDA terminates - do not wait
• Document your good-faith efforts
• Communicate proactively with the disclosing party if you need more time
• Most parties will grant reasonable extensions if asked before the deadline passes

Courts generally expect reasonable, good-faith compliance rather than literal impossibility. But you must demonstrate you made genuine efforts and communicated proactively.

Absolutely not. Legal hold obligations override contractual destruction requirements. Here is what you need to know:

• Litigation hold trumps NDA: If you reasonably anticipate litigation, you must preserve relevant evidence regardless of what the NDA says
• Spoliation consequences: Destroying evidence during a legal hold can result in severe sanctions, adverse inferences, and even case dismissal
• Good NDAs include this carve-out: Look for language like "except as required to comply with legal process or litigation hold obligations"

If the disclosing party demands destruction during a dispute:

• Consult with your litigation counsel immediately
• Document the demand and your response
• Do not destroy anything subject to litigation hold
• Consider notifying the court if the demand seems like evidence tampering

No. Standard deletion (moving to trash, emptying recycle bin) does not destroy data - it just marks the space as available for reuse. True destruction requires more:

For individual files:

• Use secure deletion software that overwrites the file multiple times
• Common tools: Eraser (Windows), Secure Empty Trash (Mac), shred (Linux)
• For SSDs, use the manufacturer's secure erase tool

For entire drives:

• Full disk encryption followed by key destruction is effective
• Physical destruction (shredding, degaussing) for highly sensitive data
• Reference NIST SP 800-88 for media sanitization guidelines

For cloud storage:

• Delete files and empty trash
• Request confirmation from the cloud provider if required
• Understand that some providers retain data for backup purposes

Document your destruction methods in case you need to prove compliance later.

Cloud-stored confidential information requires special attention:

• Identify all locations: CRM records, notes, attachments, activity logs, integrations
• Check data retention: Many CRM systems retain deleted records for recovery purposes
• Request permanent deletion: Some platforms require admin action to permanently purge data
• Document the process: Screenshot or export deletion confirmations
• Consider integrations: Data may have synced to other systems (email, calendar, analytics)

Common CRM considerations:

• Salesforce: Deleted records go to recycle bin for 15 days, then permanently deleted
• HubSpot: GDPR deletion request permanently removes data
• Check your specific platform's data retention policies

Practical tip: Before receiving confidential information, consider creating a separate folder or tag to make later identification and deletion easier.

For highly sensitive information, yes. Here is a tiered approach:

Standard commercial NDAs: General language is usually sufficient ("destroy by means that prevent reconstruction or recovery")

Sensitive technical data: Reference industry standards like NIST SP 800-88 Rev. 1 (Guidelines for Media Sanitization)

Government or defense-related: Specify DoD 5220.22-M or higher standards as appropriate

Healthcare data: Reference HIPAA-compliant destruction methods

Practical considerations:

• Higher standards increase compliance burden and cost
• Ensure the receiving party can actually meet the specified standard
• Consider whether the standard matches the actual sensitivity of the information