NDA

What is an NDA?

NDA (non-disclosure agreement, also called a confidentiality or secrecy agreement) is a contract in which the recipient of confidential information undertakes to keep it secret and to use it only for a defined purpose. In transactions, this purpose is the review and negotiation of an investment or a company purchase. In German, the NDA is also called a Verschwiegenheitsvereinbarung; in English-speaking countries it is also known as a confidentiality agreement.

In a company sale, the NDA stands at the beginning of the process. After a teaser, a short description of the company without naming it, interested parties sign the agreement before they receive the detailed sales document and later access to the data room. Depending on how it is structured, the counterparty of the interested party is the seller, the company or both. In funding rounds, confidentiality is usually regulated in the term sheet and later in the participation agreement; in a company sale, additionally in the letter of intent (LOI), to the extent the NDA does not already cover it.

Use in a funding round and a company sale

Before the first conversation with venture capital investors, an NDA is unusual. Companies therefore design the pitch deck and initial documents so that they contain no trade secrets. Details on technology, customers and prices follow only in due diligence, for which a binding confidentiality arrangement then exists.

In a company sale, by contrast, the NDA is a prerequisite for any information that goes beyond the teaser. The documents are released in stages: revenue structure and key figures after signing; customer names, individual contracts and personnel data only in a later phase and often only to the shortlist. Personal data is anonymised beforehand, because the NDA alone does not create a data protection basis for passing it on.

Typical provisions in an NDA

• Definition and exceptions: All information about the target company and the transaction is confidential, including the fact that talks are taking place. Excluded is information that is publicly known, was already in the recipient's possession, was lawfully communicated to it by third parties or was developed by it independently.
• Purpose limitation: The information may be used only to review and negotiate the transaction, not for the recipient's own business.
• Disclosure to advisers: permitted to management and supervisory bodies, employees, advisers and financiers, to the extent they need the information and are themselves bound to confidentiality. The recipient is generally liable for breaches by these persons.
• Non-contact and non-solicitation: Employees, customers and suppliers of the target company may not be approached without consent. The ban on poaching employees (non-solicitation) is usually limited to 1 to 2 years.
• Return and deletion: If talks are broken off, documents must be returned or deleted, except backup copies and documents subject to a statutory retention obligation.
• No warranty, no obligation to conclude: The disclosing party is not liable for the accuracy and completeness of the information, and neither side is obliged to conclude a deal. Liability arises only from the warranties of a later contract.

A clause under which knowledge that remains in the memory of the recipient's employees may be used freely (residuals clause) is to be viewed critically. It hollows out the purpose limitation and is generally rejected by sellers.

Competitors as interested parties: clean team rules

If the interested party is a competitor, competition law sets limits on the exchange of information. The exchange of competitively sensitive data such as prices, margins, customer-specific terms or strategic plans can violate the prohibition of cartels under Section 1 of the German Act against Restraints of Competition (Gesetz gegen Wettbewerbsbeschränkungen, GWB), even if the transaction later fails. Until completion, buyer and target company remain independent competitors.

A supplementary clean team agreement is therefore customary. Sensitive information goes only to a narrowly limited group, usually external advisers and individual employees of the buyer without responsibility for sales and pricing. The transaction team receives the results only in summarised or anonymised form. Which information belongs in which tier is determined with the law firm before the data room opens.

Legal framework and enforceability

Alongside the contract, the German Trade Secrets Act (Geschäftsgeheimnisgesetz) protects confidential business information. Statutory protection, however, presupposes that the company itself has taken reasonable measures to keep the information secret. In practice, a confidentiality agreement is among the most important of these measures. Anyone who passes on information to third parties without one therefore also jeopardises the statutory protection.

In the event of a breach, an injunction, including by way of a preliminary injunction (an expedited court procedure), and damages come into consideration. Proving the loss and its cause is often difficult, however. Many NDAs therefore provide for a contractual penalty, that is, a fixed amount per breach that is owed without proof of loss (Sections 339 et seq. of the German Civil Code, Bürgerliches Gesetzbuch, BGB). Damage exceeding that amount can additionally be claimed, with the contractual penalty credited against it (Section 340 (2), Section 341 (2) BGB).

A disproportionately high contractual penalty can be reduced by the court on application (Section 343 BGB), but not if a merchant has promised it in the course of operating its commercial business (Section 348 of the German Commercial Code, Handelsgesetzbuch, HGB). Every GmbH (German limited liability company) is also a merchant. Where the seller presents the same NDA to all interested parties, however, it is usually a matter of standard terms and conditions. An unreasonably high contractual penalty is then invalid as a whole (Section 307 BGB). It is therefore widespread to have the amount set by the entitled party at its reasonable discretion, that is, appropriately in the individual case, and to have it reviewed by a court in the event of a dispute (the so-called Hamburg custom, Hamburger Brauch).

Non-solicitation clauses have a limit of their own. Agreements between companies not to hire each other's employees cannot be enforced in court under Section 75f HGB. According to case law, this in principle also applies to bans on actively poaching employees. A non-solicitation clause remains enforceable above all if it is an ancillary agreement to talks involving a special relationship of trust, as in a company review, and is narrowly limited in time. Two years is widely regarded as the upper limit.

Practical example: NDA in the auction process for a software company

A software company with EUR 15 million of revenue is sold in an auction process. Eleven interested parties sign an NDA with a term of three years, a non-contact and non-solicitation clause for 18 months and a contractual penalty of EUR 50,000 per breach of confidentiality. Two of the interested parties are competitors.

• A clean team agreement additionally applies to the two competitors. Customer-specific prices and margins are seen only by their external advisers; the transaction teams receive an analysis by customer group.
• Four bidders reach the second round with a management presentation and the full data room. The other seven confirm in writing, after dropping out, that the documents have been deleted.
• A financial investor that has dropped out passes parts of the sales document to a company in which it holds a stake and which is active in the same market. The target company demands an injunction and the contractual penalty.

The contractual penalty of EUR 50,000 is enforceable without proof of loss. Any damage beyond that, the company would have to prove in concrete terms. Without a contractual penalty, it would have had to prove what disadvantage arose specifically from the disclosure, which rarely succeeds with sales documents.

Distinction: NDA, confidentiality clause and non-compete

• Confidentiality clause in a term sheet or LOI: a binding part of an otherwise usually non-binding outline document. The NDA is a standalone contract that precedes any negotiation.
• Clean team agreement: supplements the NDA when a competitor is reviewing and regulates who may see which sensitive information.
• Non-compete: prohibits an activity in competition. The NDA prohibits only the use and disclosure of the information received.

Common mistakes

• Demanding an NDA before the first investor conversation. Investors usually refuse. More effective are initial documents without trade secrets.
• Too much too early. Even with an NDA, customer names, individual prices and source code do not belong in the first phase but in a later tier of the data room.
• No liability for advisers. If the recipient is not responsible for its advisers and financiers, a gap arises as soon as information is passed on.
• Competitors without a clean team. Anyone who gives sensitive data unfiltered to a competitor risks a cartel violation, even if the transaction is never completed.
• No contractual penalty or an excessive one. Without a fixed amount, often only a damages claim remains, the amount of which is hard to prove. An excessive penalty in a standard NDA, on the other hand, can be invalid as a whole.
• Deletion not followed up. If an interested party drops out without confirming deletion in writing, it remains unclear where the documents are.

Frequently asked questions

Why do venture capital investors not sign an NDA before the first conversation?

Because they review many companies in the same market and could otherwise expose themselves to claims as soon as they invest in a competitor. In due diligence, by contrast, they regularly accept confidentiality obligations.

How long does an NDA last?

In transaction processes, often 2 to 5 years from signing, even if the talks end earlier. For individual trade secrets, it is sometimes agreed that the obligation lasts as long as the information is secret. If the deal closes, the provisions of the purchase agreement usually replace the NDA.

Does an NDA have to be notarised?

No. It is not subject to any form requirement and in practice is concluded in writing or electronically. Notarial form concerns only the purchase agreement for GmbH shares.

Can an NDA be taken from a template?

Only with adjustments. General templates are widespread. For a company sale, however, they often lack a non-contact and non-solicitation clause and rules on disclosure to advisers and financiers, on return and deletion and on clean teams for competitors. In an auction process, the seller's law firm therefore usually drafts an NDA that all interested parties sign.

Is a one-way or a mutual NDA customary?

In a company sale, usually a one-way one, because it is mainly the seller that provides information. Mutual agreements make sense where the interested party also discloses confidential matters, for example about its financing or its integration plans.

The Roemer Capital view

At Roemer Capital, first contact in a sales process is made by the anonymous teaser, at most five slides without trade secrets. Only after the NDA has been signed do the sales document and access to the data room follow, in stages according to process phase. The agreement is drafted or reviewed by the client's law firm; Roemer Capital keeps the list of signed NDAs and controls who receives which documents and when.

For strategic interested parties from the same market, Roemer Capital determines early with the law firm which information is accessible only to a clean team. For first investor conversations in funding rounds, Roemer Capital deliberately dispenses with an NDA and designs the documents so that they contain no details in need of protection.