A Jacksonville software company gets a NDA from a potential acquirer. The form is labeled "Mutual Non-Disclosure Agreement." The CEO signs it because it sounds even-handed. Three months later, the deal dies. The acquirer keeps the founder's pricing model, customer pipeline, and architecture notes. The NDA technically protects both sides — but only one side disclosed anything substantive, and the residuals clause buried on page four lets the acquirer use anything "retained in unaided memory." The mutual label was the trap.
Most NDA disputes I have seen in three decades of practice are not about whether an NDA existed. They are about whether the right kind of NDA existed, and whether the drafting choices inside it matched the actual transaction. Mutual versus one-way is the first of those choices. Get it wrong and the document is doing the opposite of what you think.
What "Mutual" and "One-Way" Actually Mean
A one-way NDA (also called a unilateral NDA) has a single disclosing party and a single receiving party. The receiver takes on the confidentiality obligation. The disclosing party assumes essentially no obligations under the agreement. This is the right structure when one side has information the other side needs to evaluate a deal, perform a service, or access a system, and the flow of information runs in one direction.
A mutual NDA (bilateral NDA) treats both parties as both disclosers and receivers. Each side has confidentiality obligations toward the other. This is the right structure when both sides will actually disclose sensitive information — joint development, partnership negotiations, M&A discussions, integration discussions, or any transaction where evaluating fit requires both parties to open the kimono.
The mistake is reflexively defaulting to "mutual." Mutual is not safer. Mutual is not more polite. Mutual is appropriate only when the information flow is actually bilateral. Using a mutual NDA in a one-way exchange creates obligations the disclosing party never needed to take on, and it can muddy enforcement because the agreement assumes information flowed in both directions when it did not.
When a One-Way NDA Is the Right Fit
A one-way NDA is the cleaner instrument in any situation where the disclosing party has assets to protect and the receiving party is primarily a vendor, contractor, employee, candidate, or evaluator. Common one-way scenarios:
- A business gives a contractor access to customer lists, pricing, or operational data.
- A founder shares a pitch deck or financial model with a prospective investor for evaluation only.
- A company shows a candidate proprietary technology during an interview process.
- A franchisor shares an operations manual with a prospective franchisee for diligence.
- A licensor allows a prospective licensee to inspect a product or formulation.
In all of these, the receiving party either has nothing confidential of its own to share or is not sharing it in this transaction. A mutual NDA in these contexts saddles the disclosing party with restrictions on information they were never given — and worse, it can make the receiving party reluctant to push back on overbroad disclosure-side terms because they apply "to both sides."
When a Mutual NDA Is the Right Fit
A mutual NDA is the correct instrument when both sides will, in fact, exchange sensitive information. The typical examples:
- M&A discussions where buyer and seller will both share financials, customer data, and operational details.
- Joint ventures and partnerships where each side contributes IP, processes, or relationships.
- Strategic alliances or co-development where roadmaps and architectures need to align.
- Vendor relationships where the vendor will also be exposed to the customer's proprietary data while the customer is exposed to the vendor's methodology.
- Investor relationships where the founder shares financials and the investor shares portfolio data or syndicate information.
The rule of thumb I use: if you cannot describe, in two sentences, what each side will actually disclose, the relationship is not mutual yet. Default to one-way until the bilateral flow is real.
The Definitions That Decide the Case
Whether mutual or one-way, the definitions section does most of the load-bearing work. Three definitions matter more than any other clause.
Confidential Information. Broad enough to capture what you actually want protected, narrow enough that a court will enforce it. "All information disclosed" is too broad and will be cut down in litigation. A workable definition lists categories (technical, financial, customer-related, methodology, source code) and adds a catch-all for information a reasonable person would treat as confidential. Marking requirements — "must be marked confidential to qualify" — sound disciplined but routinely defeat enforcement when oral or unmarked disclosures get into the record.
Permitted Use. The receiver may use the information only for the defined "Purpose." If the Purpose is vague ("evaluating a potential business relationship"), the receiver has substantial latitude. A tight Purpose ("evaluating a proposed acquisition of Company X by Company Y, and for no other use") anchors enforcement. The narrower the Purpose, the easier it is to prove misuse.
Carve-outs. Every NDA carves out information that was already known, publicly available, independently developed, or rightfully received from a third party. These carve-outs are standard. The litigation fight is almost always about whether information falls inside a carve-out, so the carve-out language matters. "Independently developed without reference to Confidential Information" — with a written-records requirement — is the version that holds up. The version without a records requirement invites self-serving testimony.
The Drafting Mistakes That Quietly Kill Enforcement
Four issues come up repeatedly when NDAs fail to do what the client expected.
1. Residuals clauses. A residuals clause permits the receiving party to use information "retained in unaided memory" of employees who were exposed to the disclosure. In a software, consulting, or product context, this clause is functionally a license to use everything. If you are the disclosing party, do not accept a residuals clause without understanding exactly what you just gave away.
2. Indefinite terms on ordinary information. Perpetual confidentiality obligations covering ordinary business information are harder to enforce than time-limited obligations. The defensible structure: two to five years for general business information, indefinite for trade secrets that remain secret. Florida's Uniform Trade Secrets Act (Chapter 688) backs the indefinite trade-secret obligation; the statute does not need a contractual cap to be enforceable.
3. No injunctive-relief acknowledgment. Damages from confidentiality breaches are notoriously hard to quantify. An NDA should explicitly acknowledge that breach causes irreparable harm and that the disclosing party is entitled to seek injunctive relief without posting bond. Without that language, a Florida court can require bond and demand a damages showing the disclosing party may not be ready to make under time pressure.
4. Wrong choice of law and forum. An NDA signed by a Jacksonville business with a California venue and California governing law is a problem if you ever need to enforce it. Negotiate Florida governing law and a Florida forum unless there is a specific reason to do otherwise. If the other side insists on its own state, understand what you are accepting — particularly for non-compete or non-solicit provisions that some states enforce very differently from Florida's Section 542.335. The related article on NDAs versus non-competes in Florida covers that interaction in detail.
One More Question Before You Sign
Before signing any NDA — mutual or one-way — ask the question the other side is hoping you skip: what happens at the end of the deal, whether the deal closes or not? Return-or-destroy provisions are standard. A useful version requires the receiver to certify in writing that all confidential information has been returned or destroyed, including copies on backup systems. A weak version says "upon request" and lets the receiver hold material indefinitely if no request is made.
The end-of-deal protection is the moment when NDAs actually do their work. Drafting it as an afterthought is how good agreements become useless.