What is an NDA?

NDAs in plain English

NDA stands for “non-disclosure agreement.” It’s also known as a confidentiality agreement or secrecy agreement – in German, a Vertraulichkeitsvereinbarung or Geheimhaltungsvereinbarung. Whatever the name, it always refers to a contract that defines what may be done with confidential information – and what may not.

Think of it this way: if you give an architect the plans and keys to your house so she can plan a renovation, you expect her to use both only for that purpose and not to pass them on. An NDA puts this expectation in writing – with clear rules and consequences for breaches.

Companies sign NDAs, for example, before contract negotiations, for joint development projects, or before giving a service provider insight into internal systems. NDAs are especially common in IT security assessments, because highly sensitive information changes hands.

What an NDA covers

There are one-way (unilateral) NDAs, where only one party discloses information, and mutual NDAs that protect both sides. Typical components include:

1. Parties and purpose: Who is sharing information with whom – and what may it be used for? This purpose limitation is the core of every NDA.
2. Confidential information: Which documents, data, and conversations are covered? The clearer the definition, the better the protection.
3. Obligations: Keep the information secret, protect it appropriately, and make it accessible only to people who need it for the agreed purpose.
4. Exceptions: for example, information that is already public or must be disclosed due to legal obligations.
5. Term: The confidentiality obligation often continues after the collaboration ends.
6. Return and deletion: What happens to documents and data after the project ends.
7. Consequences of breaches: often a contractual penalty – a payment agreed in advance in case of a breach – plus rules on governing law and jurisdiction.

Important: an NDA is no substitute for a data processing agreement (DPA; German: AVV). If a service provider processes personal data on your behalf, you also need a DPA under Art. 28 GDPR.

A practical example

A medical device manufacturer is planning a penetration test – a commissioned, simulated attack – on its corporate network and a new app. For scoping, the process of agreeing on what will be tested, it wants to show the testing provider network diagrams and a list of its systems. Before that, both sides sign an NDA.

The NDA stipulates that the documents may be used solely for preparing the quote and carrying out the test. Credentials are transmitted only in encrypted form, and the report goes exclusively to the named contacts. After the project ends, the documents are deleted. The manufacturer can later also present the NDA as part of its confidentiality measures.

Why does this matter for businesses?

Before and during a security test, a service provider gains insight into your most sensitive information: network diagrams, access credentials, vulnerabilities. A pentest report essentially describes how someone could break into your company as long as the gaps remain open. This knowledge must stay protected.

Then there’s the legal side: the German Trade Secrets Act (GeschGehG) protects information as a trade secret only if its owner – among other requirements – has taken appropriate confidentiality measures. Confidentiality agreements typically count among them. If you share confidential information without such precautions, you may find it difficult to rely on this protection in a dispute.

What to look out for

• Sign early: Put the NDA in place before any confidential documents are shared – for security tests, that means before scoping.
• Describe the purpose precisely: The more precisely the permitted use is defined, the clearer the boundaries.
• One-way or mutual: Clarify whether only your information should be protected or that of both sides.
• Set the term: Determine how long confidentiality applies after the project ends.
• Specify return and deletion: Define what happens to reports, data, and credentials once the project is complete.
• Consider data protection: Check whether a DPA is also needed.

This article provides a general overview and does not constitute legal advice. Extensive or unusual agreements should be reviewed by a lawyer.

How Rootsektor can help

Confidentiality is the foundation of every security test. That’s why, on request, we sign a non-disclosure agreement before scoping, so you can show us network diagrams and system details without hesitation. For every project, you have a dedicated contact person at Rootsektor. Reach out via our Contact page or describe your project directly via our Pentest Quote page.