Non-Disclosure Agreements in Ontario: What Businesses Need to Know
Businesses routinely share sensitive information with employees, contractors, suppliers, investors, purchasers, advisers, and potential commercial partners.
This information may include pricing, customer lists, financial results, product formulas, business plans, software, internal processes, marketing strategies, and proposed transaction terms. Once confidential information is disclosed, it may be difficult or impossible to recover its commercial value.
A non-disclosure agreement, commonly called an NDA or confidentiality agreement, establishes how another party may receive, use, store, and disclose protected information.
However, an NDA is not automatically effective simply because it contains the word “confidential.” The agreement should reflect the information being shared, the purpose of the disclosure, the parties’ relationship, and the risks created by unauthorized use.
What Is a Non-Disclosure Agreement?
A non-disclosure agreement is a contract requiring one or more parties to protect specified confidential information.
An NDA may prohibit the receiving party from:
Disclosing information to unauthorized individuals
Using the information for an unauthorized purpose
Copying or reproducing protected materials
Using the information to compete with the disclosing party
Sharing information with employees or contractors who do not need it
Retaining information after the relationship ends
Attempting to reverse engineer certain products or technology
An NDA can be a separate agreement or confidentiality terms can be included in a broader contract, such as an employment agreement, independent contractor agreement, service agreement, shareholders’ agreement, licensing agreement, or purchase agreement.
The Canadian Intellectual Property Office recommends confidentiality or non-disclosure agreements as one method of protecting trade secrets and inventions that do not yet have formal intellectual-property protection.
When Should an Ontario Business Use an NDA?
An NDA should be considered whenever a business must disclose valuable information before the recipient has an appropriate contractual duty to protect it.
Common situations include:
Discussing a potential business purchase or sale
Sharing financial information with an investor
Hiring an employee with access to sensitive information
Engaging an independent contractor or consultant
Developing software, products, or creative materials
Negotiating a distribution or supplier relationship
Exploring a joint venture
Licensing intellectual property
Sharing information with a manufacturer or co-packer
Giving an adviser access to internal records
Presenting an invention or business concept
Allowing a service provider to access customer information
The agreement should usually be signed before confidential information is disclosed.
Asking someone to sign an NDA after receiving the information can create uncertainty about what obligations apply to earlier disclosures and whether sufficient consideration supports the new agreement.
Unilateral and Mutual NDAs
An NDA may be unilateral or mutual.
Unilateral NDA
A unilateral NDA is appropriate when only one party expects to disclose confidential information. For example, a company may require a contractor to protect its customer information, pricing, systems, and internal processes.
Mutual NDA
A mutual NDA is appropriate when both parties expect to exchange confidential information.
This may occur when two companies are considering:
A business acquisition
A joint venture
A strategic partnership
A product-development arrangement
A licensing relationship
A significant supplier or distribution agreement
A mutual NDA should not simply impose identical obligations without considering the information and risks on each side. One party may be disclosing technical information, while the other is disclosing customer data or financial records. The agreement should account for both categories.
What Information Should the NDA Protect?
The agreement should clearly define confidential information.
Depending on the relationship, confidential information may include:
Business plans and strategies
Financial statements and projections
Pricing and profit margins
Customer and prospective-customer information
Supplier information
Product specifications
Recipes and formulas
Research and development
Software and source code
Designs, drawings, and prototypes
Processes and operating methods
Marketing plans
Employee and contractor information
Proposed agreements and transaction terms
Login credentials and security information
Unpublished intellectual property
The definition should be broad enough to protect the relevant information but precise enough that the receiving party can understand what must be protected.
An agreement that describes every piece of information as confidential, including information that is public or independently known, may create uncertainty and enforcement difficulties.
How Will Confidential Information Be Identified?
Some NDAs protect only information marked “confidential.” Others protect information that a reasonable person would understand to be confidential based on its nature or the circumstances of disclosure.
Requiring a label on every document can help with clarity, but it may leave important information unprotected if someone forgets to apply the label.
This can be particularly problematic for:
Verbal discussions
Presentations
Demonstrations
Meetings
Facility tours
Shared screens
Informal emails
The agreement may provide that oral information is protected if it is identified as confidential when disclosed and confirmed in writing within a specified period.
The identification process should be practical enough for the business to follow consistently.
Limit the Permitted Use
Preventing disclosure is only part of an effective NDA.
The agreement should also limit how the recipient may use the information.
For example, information disclosed during acquisition discussions may be used only to evaluate the proposed transaction. It should not be used to solicit the seller’s customers, recruit employees, approach suppliers, or develop a competing product.
The permitted purpose should be clearly stated.
A vague provision requiring the recipient to keep information confidential may not adequately prevent the recipient from using that information for its own benefit.
Decide Who May Receive the Information
The receiving party may need to share information with its:
Employees
Directors and officers
Lawyers
Accountants
Lenders
Investors
Consultants
Affiliates
Subcontractors
The NDA should identify which representatives may receive the information and under what conditions.
It may require that recipients:
Need the information for the permitted purpose
Be informed that the information is confidential
Be subject to confidentiality obligations
Use appropriate security measures
Return or destroy the information when requested
The agreement should also state whether the receiving party is responsible for
breaches committed by its representatives.
Include Appropriate Exclusions
Certain information is commonly excluded from confidentiality obligations.
The exclusions may apply to information that:
Was already lawfully known to the recipient
Becomes publicly available without a breach
Is received lawfully from an unrelated third party
Is independently developed without using the protected information
Is approved for disclosure in writing
The receiving party may be required to provide evidence that an exclusion applies.
Without properly drafted exclusions, the NDA may attempt to restrict information that the recipient obtained legitimately or developed independently.
Address Legally Required Disclosures
A recipient may be legally required to disclose confidential information in response to:
A court order
A subpoena
A regulatory investigation
A statutory reporting obligation
A government demand
The NDA should establish what happens in those circumstances.
Where legally permitted, the recipient may be required to:
Notify the disclosing party promptly
Disclose only the information legally required
Cooperate with efforts to limit the disclosure
Seek confidential treatment or a protective order
Preserve confidentiality over the remaining information
An NDA should not require a party to disobey the law or conceal information that must legally be reported.
Set the Duration of the Obligations
The agreement should state how long the confidentiality obligations will continue.
The appropriate duration depends on the nature of the information.
Some information loses value quickly. A proposed transaction, marketing campaign, or pricing strategy may become outdated within a few years.
Other information may remain valuable for much longer. Product formulas, source code, manufacturing processes, and trade secrets may require protection for as long as they remain confidential.
CIPO explains that a trade secret may include valuable business information that derives value from remaining secret and that trade secrets are not registered with CIPO.
A single standard term may not be suitable for every category of information. The agreement can establish one general confidentiality period while providing longer protection for trade secrets.
Require the Return or Destruction of Information
The NDA should address what happens when discussions end or the business relationship terminates.
The recipient may be required to:
Return physical documents
Delete electronic copies
Destroy notes and summaries
Remove information from shared systems
Confirm destruction in writing
Stop using the information
Return samples, prototypes, or devices
Complete deletion may not always be practical where information exists in automatic backups, archived emails, or records retained for legal or regulatory purposes.
The agreement should account for legitimate retention requirements while continuing to protect retained information.
Protect Personal Information Properly
Confidential business information and personal information are not always the same.
If the recipient will access information about identifiable customers, patients, employees, or other individuals, the parties should consider applicable privacy obligations in addition to the NDA.
PIPEDA applies to many private-sector organizations that collect, use, or disclose personal information during commercial activities. It requires organizations to limit collection, use, disclosure, and retention in accordance with applicable privacy principles.
A confidentiality clause may not adequately address:
Permitted processing purposes
Security safeguards
Data-location requirements
Subcontractor access
Breach notification
Record retention
Deletion procedures
Regulatory cooperation
International data transfers
Where personal information is involved, the parties may require privacy and data-security provisions in addition to general confidentiality terms.
Address Intellectual-Property Ownership Separately
An NDA protects confidentiality, but it does not necessarily determine who owns intellectual property created during the relationship.
If a consultant, developer, designer, manufacturer, or other contractor will create work for the business, the agreement should separately address:
Ownership of deliverables
Assignment of intellectual-property rights
Pre-existing intellectual property
Licensing rights
Modifications and improvements
Moral rights
Use of third-party materials
Businesses should not assume that paying for work automatically transfers every intellectual-property right.
The NDA may protect the information exchanged while a service or development agreement establishes ownership of the resulting work.
An NDA Is Not Automatically a Non-Compete Agreement
A confidentiality agreement protects specified information. A non-compete provision restricts a party’s ability to compete.
These are different obligations.
An NDA should not be drafted so broadly that it effectively prevents a person from using their general skill, knowledge, and experience in the marketplace.
If the business requires non-solicitation, non-competition, or non-circumvention provisions, those restrictions should be clearly drafted and assessed separately.
The appropriate restrictions depend on the relationship, the legitimate business interest being protected, and the surrounding circumstances.
What Happens If Someone Breaches an NDA?
A breach may occur when the recipient:
Discloses information without authorization
Uses information for an improper purpose
Shares information with an unauthorized representative
Fails to apply required security safeguards
Refuses to return or destroy materials
Uses confidential information to solicit customers or compete
The agreement may provide for:
Injunctive relief
Monetary damages
Indemnification
Recovery of specified costs
Dispute-resolution procedures
Termination of the commercial relationship
Return or destruction of information
An injunction may be particularly important where disclosure could cause harm that money alone cannot adequately remedy.
However, contractual remedies do not eliminate the practical difficulty of responding to a breach. Once sensitive information is publicly disclosed or delivered to a competitor, its secrecy may be permanently lost.
Businesses should combine contractual protection with practical safeguards such as access controls, password protection, encryption, document tracking, and need-to-know disclosure.
Can an NDA Be Signed Electronically?
Ontario’s Electronic Commerce Act generally provides that a legal requirement for a document to be signed may be satisfied by an electronic signature, subject to specified exceptions.
An NDA may therefore commonly be signed through an electronic-signature platform.
The business should retain a complete signed copy and reliable records showing:
The parties to the agreement
The final terms accepted
The date of signature
Any amendments
The information disclosed
Any notices delivered under the agreement
Common NDA Drafting Mistakes
Using the NDA after disclosure
Confidentiality terms should generally be established before sensitive information is shared.
Defining confidential information too vaguely
The parties should be able to identify what is protected and what is excluded.
Ignoring how the information may be used
An agreement that only prohibits disclosure may not prevent misuse.
Using the same agreement for every relationship
An acquisition, employment relationship, contractor engagement, and product-development project create different risks.
Failing to protect verbal disclosures
Important information is often exchanged during meetings, calls, presentations, and demonstrations.
Applying an unrealistic duration
The confidentiality period should reflect how long the information is expected to retain commercial value.
Treating an NDA as an intellectual-property assignment
Confidentiality and ownership should be addressed separately.
Relying entirely on the contract
An NDA works best when supported by practical information-security measures and controlled disclosure.
Delta Law’s contract law services include drafting and reviewing non-disclosure agreements, confidentiality provisions, service agreements, contractor agreements, and other commercial contracts.
For additional information about commercial agreements and legal planning for Ontario businesses, visit Delta Law’s legal resources.
This article provides general information only and does not constitute legal advice. The appropriate confidentiality agreement depends on the nature of the information, the parties’ relationship, applicable privacy requirements, and the specific circumstances.
Protect Confidential Information Before Sharing It
A properly drafted non-disclosure agreement can establish clear expectations before sensitive information changes hands.
The agreement should identify what information is protected, how it may be used, who may receive it, how long the obligations continue, and what happens when the relationship or negotiations end.
Delta Law assists Ontario businesses with non-disclosure agreements, confidentiality clauses, commercial contracts, intellectual-property provisions, and agreements supporting business purchases and strategic relationships.
