Mutual NDA vs one-way NDA: which do you need in the UK?

Before you show a manufacturer your product drawings, walk a potential partner through your numbers, or let a developer see your code, you will probably want a non-disclosure agreement. The first choice is mutual NDA vs one-way: does only one side need protecting, or both? This post explains the difference, what a UK NDA should actually say, what no NDA can stop, and why an NDA written today should deal with AI tools.

Mutual NDA vs one-way: the difference

A one-way NDA protects information flowing in one direction. You are the discloser, the other side is the recipient, and only the recipient takes on confidentiality duties. Use it when you are sharing and they are not: for example, briefing a freelancer, a supplier quoting for a job, or a potential buyer of a product line.

A mutual NDA protects both sides. Each party may be a discloser and a recipient, and the same duties apply to each. Use it when both sides will share confidential information, such as talks about a joint venture, a supply deal where both sides share pricing and technical detail, or a collaboration on a new product.

In practice, a mutual NDA is often easier to get signed. It looks even-handed, and the other side's lawyer has less to push back on. If there is any chance the other side will share something of theirs, mutual is usually the safer choice.

Do you need an NDA at all?

English law protects confidential information even without a contract. A claim for breach of confidence normally needs three things: the information has the necessary quality of confidence, it was shared in circumstances importing an obligation of confidence, and there was unauthorised use of it to the discloser's detriment (Coco v A N Clark (Engineers) Ltd [1969] RPC 41, as quoted by the Court of Appeal in Wade v British Sky Broadcasting Ltd [2016] EWCA Civ 1214 at [2]).

Trade secrets have extra statutory protection. Information is a "trade secret" only if it is secret, has commercial value because it is secret, and has been subject to reasonable steps to keep it secret (Trade Secrets (Enforcement, etc.) Regulations 2018, reg 2).

An NDA does not replace that law, but it records that the information was shared in confidence, sets a specific purpose so you can show a particular use was not allowed, and is evidence of the "reasonable steps" the trade secrets definition asks for.

What a good UK NDA should cover

Whichever version you use, look for these:

• A specific purpose. The recipient may use your information only for this. "Discussions between the parties" is too vague. "Evaluating whether X will manufacture our product" is better. Most misuse is use, not leaking.
• A workable definition of confidential information, covering information given orally or on a site visit, and notes or analysis derived from it, but limited to what is marked confidential or that a reasonable person would understand to be confidential.
• The standard exceptions: information that is already public, already known to the recipient, received lawfully from someone else, or independently developed.
• Who else can see it: staff and advisers who need to know, bound by equivalent duties, with the recipient responsible for them.
• Return and destruction at the end, with a sensible carve-out for back-ups.
• A sensible period. Two to five years is common for commercial information. Trade secrets can be protected for as long as they stay secret.
• An IP clause in the NDA saying that sharing information grants no licence or ownership, and that neither side is committed to doing a deal. This matters if you later discuss licensing; see IP in commercial contracts: retain, licence-on-payment, or assign?.

The AI-tools angle

This is the gap in many older NDA templates. If the recipient's team pastes your financials, code or product plans into a public generative AI tool to summarise or analyse them, that information has gone to a third-party provider. Depending on the tool's terms, the provider may keep it, or use it to train or improve its systems.

An NDA that only says "do not disclose to third parties" leaves room for argument about whether that counts. It is better to say it expressly. Putting confidential information into a tool whose provider may retain or learn from it could also make it harder to show the "reasonable steps" that trade secret protection depends on (reg 2).

Practical points:

• Say in the NDA that the recipient must not put your information into a publicly available AI tool, or any tool whose provider may use, retain or learn from it, without your written consent.
• Keep a consent route, because the recipient may reasonably want to use an enterprise tool with no training on inputs. Ask which tool, and on what terms.
• Apply the same rule internally. If your own team uploads a partner's information to an AI tool, you may be the one in breach.

What an NDA cannot stop

Some disclosures cannot be prevented by any agreement, and an NDA that tries to may undermine its own enforceability.

• Whistleblowing. Any provision in an agreement between a worker and their employer is void in so far as it purports to preclude a protected disclosure (Employment Rights Act 1996, s 43J).
• Victims of crime. A provision is void in so far as it would stop a victim (or someone who reasonably believes they are a victim) disclosing information to the police, a lawyer, a regulated professional, victim support services and certain others (Victims and Prisoners Act 2024, s 17).
• More is coming. A wider replacement for section 17 (Victims and Courts Act 2026, s 6) and new rules on NDAs and harassment or discrimination disclosures (Employment Rights Act 2025, s 24) were not fully in force at the date of writing. Check before you rely on older wording.

An NDA is also not a settlement agreement. If you are settling a dispute with an employee or worker, take advice.

Inventions and investors

If what you want to share is an invention you might patent, speak to a registered patent attorney before you tell anyone, NDA or not. A patent is granted only for an invention that is new, and anything made available to the public before the priority date forms part of the "state of the art" against it (Patents Act 1977, s 2(1) and (2)).

Separately, many investors will not sign NDAs at pitch stage. Decide in advance what you can say without one, and keep the real secrets for later.

What the Made & Owned pack includes

The Made & Owned IP pack includes both a One-Way NDA and a Mutual NDA. The clauses are the same in each; only the Key Details and definitions differ. Both include:

• a Key Details table with a specific Purpose, a Confidentiality Period, and a yes/no choice on whether the fact of your discussions is itself confidential;
• a clause barring use of your information in publicly available AI tools, or any tool whose provider may use, retain or learn from it, without your prior written consent;
• a "disclosures the law protects" clause covering whistleblowing, victims' disclosures and legal advice, which you should not delete;
• trade secrets protected for as long as they remain trade secrets; and
• a no-licence, no-commitment clause, and English law and courts.

The guide explains each clause. The NDAs are for business-to-business use.

Other parts of the pack deal with ownership once a deal goes ahead: see who owns intellectual property made by a freelancer or contractor and the intellectual property assignment deed. If you are a freelancer being handed a client's NDA, their paper or yours? is worth a read. More questions are answered on the Made & Owned FAQ page.

When you need a solicitor

Take advice if the information is the core value of your business (a formula, a source code base, a patentable invention), if the other side insists on heavily amending the terms, if you think an NDA has already been breached, or if the NDA is part of settling a dispute with a worker.

This is general information, not legal advice on your situation.

Both NDAs, with the AI clause built in, come in the Made & Owned IP pack.

Sources

• Wade v British Sky Broadcasting Ltd [2016] EWCA Civ 1214, at [2] (quoting Coco v A N Clark (Engineers) Ltd [1969] RPC 41)
• Trade Secrets (Enforcement, etc.) Regulations 2018, SI 2018/597, reg 2
• Employment Rights Act 1996, s 43J
• Victims and Prisoners Act 2024, s 17
• Victims and Courts Act 2026, s 6 (not yet in force)
• Employment Rights Act 2025, s 24 (not yet fully in force)
• Patents Act 1977, s 2