NDA, mutual or one-way: build a starting draft free, or have me draft it around the disclosure

Three different clocks hide in every NDA: how long the parties exchange information, how long the confidentiality duty survives afterward, and how long the law protects a trade secret. The third clock has no fixed end: under Civil Code 3426.1(d) a trade secret lasts as long as the information stays valuable because it is secret and you keep making reasonable efforts to protect it. A contract that ends the recipient’s duty on a date does two kinds of damage at once: it releases the one person you most needed bound, and it hands every future adversary an exhibit that your protection efforts had an expiration date. The cure is a carve-out sentence: ordinary confidential information may sunset; trade secrets stay protected for as long as they qualify. Run your own dates through the calculator above.

Trade-secret definition verified against Civil Code section 3426.1 at leginfo.legislature.ca.gov on 2 August 2026.

The broadest definition is not the strongest. “All information disclosed by either party” reads muscular, then meets reality: the recipient cannot tell what is actually sensitive, compliance becomes impossible, and when enforcement comes, the overbreadth is the first argument against you. The definitions that hold up describe categories concretely (the pricing model, the schema, the customer list, the process), keep the standard exclusions honest (already known, independently developed, publicly available, lawfully received), and, where marking is practical, use marking as a floor rather than a ceiling. Precision is not a concession to the other side; it is what makes an injunction motion writable.

A residuals clause lets the receiving party freely use whatever its people retain in unaided memory from your disclosures. For a technology or business-model disclosure that is a quiet license: experienced engineers and corp-dev teams remember exactly the parts worth remembering. Large evaluators demand residuals for a defensible reason, they see hundreds of pitches and cannot carry taint risk, which is why the clause appears in their paper and never in yours. If you must live with one: narrow it to general skills and know-how, expressly exclude trade secrets and anything identifiable to your product, and shrink the disclosure itself. If the counterparty will not narrow it, the honest protection is to disclose less, not to sign more.

Business and Professions Code section 16600 voids every contract that restrains anyone from engaging in a lawful profession, trade, or business, and its 2024 amendment codifies the broad Edwards reading and extends the section beyond the contract’s own parties. Section 16600.5 adds consequences in the employment context: entering into or attempting to enforce a void restraint is a civil violation, with a private right of action and mandatory fees for a prevailing employee or applicant. NDAs walk into this by function rather than label: an employee non-solicit wider than the deal, a non-circumvention clause that walls off a whole market, or a confidentiality definition so sweeping the person cannot use their general skills anywhere. The drafting principle that survives: protect the information, not the market. Clauses that guard identified secrets hold; clauses that guard you from competition do not, and in the employment context they now bite back.

Verified against Business and Professions Code sections 16600 (as amended by AB 1076, Stats. 2023, ch. 828) and 16600.5 (SB 699, Stats. 2023, ch. 157) at leginfo.legislature.ca.gov on 2 August 2026. Application to any specific clause is a fact question.

When a leak happens, three clauses decide everything. First, the irreparable-harm stipulation: an acknowledgment that breach causes harm money cannot fix, entitling you to seek an injunction without posting the argument from scratch. Second, fee-shifting: without it, enforcing a $0 contract against a funded counterparty is a war of attrition you finance yourself. Third, return-and-destruction with a certification, drafted for how systems actually work: backups and archives get protected-in-place treatment rather than impossible deletion promises. What I do not load into an NDA: liquidated damages set by guesswork, which invite a penalty attack, and venue choices nobody could actually litigate in. An NDA is enforced maybe once in its life; these are the clauses doing the enforcing.