You are about to share your margins with a potential buyer, present a prototype to a manufacturer or give a service provider access to your customer list. This information has value precisely because it is not public. Before sharing it, decide who may use it, for what purpose and for how long.
A confidentiality agreement, commonly called an NDA or non-disclosure agreement, records these commitments. Its quality is not measured by its page count or an eye-catching penalty. It depends on how clearly it identifies the protected information, permitted use and obligations you can actually prove and enforce.
Here is a practical method for preparing an NDA under Swiss law, understanding clauses proposed by a partner and avoiding mistakes that undermine protection. The wording below consists of examples with commentary: they need to be brought together into a document consistent with your transaction.
At a glance
- Sign before sharing sensitive information and define the purpose of the discussions precisely.
- Confidentiality and restrictions on use are separate obligations that should both be addressed.
- An NDA does not replace data protection, intellectual property rights or access controls.
What an NDA protects, and what it does not create
An NDA is a contract. A party agrees not to disclose certain information and, where the agreement provides for it, to use that information only for a defined purpose. The general rules of the Swiss Code of Obligations apply, including those on contract formation, interpretation and the consequences of a breach.
Confidentiality can cover commercial, financial, technical and organisational information: non-public customer lists, purchase prices, product margins, forecasts, source code, drawings, manufacturing methods, test results and negotiation documents.
An NDA does not, by itself, create intellectual property rights in an idea. It is no substitute for a patent, a trade mark or an assignment of software rights. Nor can it make publicly available information secret. Its purpose is to create a clear contractual obligation for the people receiving the information.
A contract also cannot override statutory disclosure duties to authorities or authorise unlawful processing of personal data. Address these limits expressly instead of imposing an absolute prohibition that cannot be applied.
Confidentiality, non-use and non-compete obligations
These are three different obligations. Confidentiality restricts disclosure. Non-use prevents exploitation outside the project. A non-compete restricts specified competing activities.
Example: you give a distributor your research on a new product range. If it shares the research with nobody but uses the data to launch its own range, a disclosure restriction alone may be insufficient. Requiring it to use the information only to evaluate your collaboration addresses that risk directly. A general ban on selling any competing product goes much further and requires a separate assessment.
When should you request a confidentiality agreement?
The right time is before the first disclosure of sensitive information, not after sending the complete file. You can discuss the problem your business solves, your team and public information without exposing operational secrets.
| Situation | Information involved | Suggested approach |
|---|---|---|
| Business acquisition | Detailed accounts, customers, employees and contracts | NDA followed by phased data-room access |
| Product development | Drawings, tests, components and processes | NDA before technical disclosure, plus a separate development agreement |
| IT service provider | Architecture, access credentials, code and data | Coordinated confidentiality, security and data-processing terms |
| Commercial partnership | Purchasing terms, distribution channels and forecasts | Limited purpose and identified permitted recipients |
| Investor discussions | Financial information and strategic material | Non-confidential initial presentation, followed by protection for sensitive information |
| Collaboration between founders | Project details, files, know-how and negotiations | NDA where needed, followed by a suitable shareholders’ agreement |
An investor may decline to sign an NDA at the first meeting, particularly if it receives many similar proposals. That does not oblige you to disclose your manufacturing secret. Adjust the level of detail and reserve sensitive information for a later stage.
Employees already owe a statutory duty of confidentiality under the conditions of Article 321a CO. A specific confidentiality clause can supplement the employment contract, but employment law and its protections still apply when a separate document is signed.
One-way or mutual: match the agreement to the exchange
Under a one-way NDA, one party discloses information and the other undertakes to protect it. This is the usual arrangement when a business provides documents to a potential buyer.
Under a mutual NDA, either party may disclose or receive information. This often suits joint development or negotiations in which both parties reveal their operations and data.
Mutual protection should reflect the actual exchange. Identical obligations on paper can still be unbalanced if one party provides only a sales brochure while the other supplies its entire source code. Check whether the agreement protects information belonging to one company or an entire group, and who is responsible for subsidiaries’ conduct.
With several partners, do not assume that an NDA signed by the project leader automatically covers every subcontractor. Specify who may receive information and what obligations apply to them.
The ten clauses that make an agreement effective
1. Identify the parties and authorised signatories
State full legal names, addresses and, for a Swiss company, its UID number where this helps identification. A brand, first name or project name does not adequately identify the contracting party.
Check signing authority. Where a company requires two joint signatures, do not assume one signature is sufficient representation. For an international group, identify the entity receiving the documents and any other entities allowed access.
2. Define the purpose of disclosure
The purpose sets the boundary for permitted use. “In connection with the relationship between the parties” is too vague for many transactions.
Illustrative wording: “The information is disclosed exclusively to assess the technical and financial feasibility of manufacturing product X for company A.” This excludes use for another customer or the manufacturer’s own project. If discussions move on to production, a further agreement should govern that new phase.
3. Describe the confidential information
Use specific categories and identify the formats: documents, files, oral discussions, demonstrations and system access. Include copies, extracts and analyses that reproduce the information received.
You may provide for a “confidential” marking, but do not make it compulsory if your team cannot apply it consistently. A practical approach is to protect both marked material and information whose confidential nature is apparent from the circumstances, then confirm sensitive oral disclosures in writing.
Example: “Protected information includes the non-public technical specifications of product X, test results, supplier prices and sales forecasts provided for the Purpose, together with analyses from which those elements can be reconstructed.” The word “includes” keeps the list open; it does not remove the need to define the overall scope.
4. Set out verifiable exclusions
A balanced NDA usually excludes information that is already public without a breach, lawfully known to the recipient before disclosure, independently developed without using the disclosed information, or lawfully obtained from a third party entitled to disclose it.
Explain how these circumstances may be demonstrated, for example through dated records. A later assertion that “we already had that idea” is less persuasive than an earlier technical file. Where information forms a combination, public availability of individual elements does not necessarily make the combination public.
5. Restrict both disclosure and use
Include both obligations. Require reasonable safeguards suited to the sensitivity of the information. A clause requiring only “the same care as for the recipient’s own information” offers weak protection if the recipient does not protect its own information adequately.
Example: “The recipient uses the information exclusively for the Purpose, makes only necessary copies and discloses it only to authorised persons. It applies security measures appropriate to the information’s sensitivity and promptly informs the disclosing party of any unauthorised access or use of which it becomes aware.”
Where relevant, address restrictions on testing, reverse engineering or artificial intelligence tools separately. A contractual restriction should address an identified risk and comply with applicable law; it does not follow automatically from the label NDA.
6. Cover employees, advisers and subcontractors
Internal sharing should follow a need-to-know approach. Not every employee in a group needs access to your entire data room.
Define permitted recipient categories: the dedicated team, lawyers, accountants, banks or specialists. Specify their confidentiality duties and the contracting party’s responsibility for their involvement. Some advisers already owe professional secrecy duties; a technical subcontractor may need a specific undertaking.
An unrestricted right to share with “all current or future partners” removes much of the NDA’s practical value. Require prior consent for recipients outside the agreed scope.
7. Separate the disclosure period from the protection period
Specify the period during which information may be disclosed and how long the obligations survive afterwards. For example, an evaluation may last six months while confidentiality continues for several years.
Swiss law does not prescribe a standard two-, three- or five-year term for every NDA. A launch price quickly becomes outdated; an industrial formula may retain value far longer. For a lasting secret, protection linked to its continuing secrecy may be more appropriate than an automatically expiring short term.
Define the starting point: signature, last disclosure or the end of discussions. “For five years” without a clear starting point invites disagreement. An unlimited term is not a universal solution either: it must fit the information and the general limits of the law.
8. Organise return, deletion and archiving
When discussions end, specify whether documents must be returned or destroyed, the deadline and whether confirmation is required. Include working copies and access to shared spaces.
Allow necessary exceptions for statutory retention, an archival copy kept as evidence and backups that cannot be purged immediately. These exceptions must not permit commercial reuse. Retained information remains confidential, and backups should follow their normal deletion cycle.
Promising to delete every copy from every backup immediately, without knowing whether the system can do so, sets up a breach as soon as the project ends.
9. Address legally required disclosures
The agreement must allow disclosure legally required by a competent authority. Where legally permitted, it can require advance notice to the disclosing party, disclosure limited to the required information and efforts to obtain protective measures.
Do not require prior notification where a rule or an authority’s decision prohibits it. Nor should an NDA be presented as preventing any lawful approach to an authority.
10. Choose governing law and dispute arrangements
For a Swiss relationship, expressly choosing Swiss law and a specified competent court makes the framework clearer. For an international relationship, consider where assets are located, where information is used and whether a judgment can be enforced abroad.
Arbitration may suit some projects, but it has costs and procedural consequences. Do not copy an arbitration clause simply because a large group uses one. An NDA connected with employment or another protected relationship must also respect the applicable jurisdiction rules.
Contractual penalties and damages: understand the remedy
After a leak, quantifying the loss is often difficult. A contractual penalty under Articles 160 onwards CO sets an amount payable for a defined breach. Article 161 CO allows a penalty even where the creditor has suffered no loss. However, the conditions triggering the penalty must still be established.
A court must reduce a penalty it considers excessive (Article 163 paragraph 3 CO). Writing CHF 500,000 into every NDA therefore does not guarantee recovery of that amount. The figure should be justifiable in light of the project, information and breach involved.
Define what constitutes a breach: each file, each recipient, each incident or each day a continuing breach persists? Unclear wording can artificially multiply amounts. Address the relationship between the penalty, cessation of prohibited use, performance of the obligation and any additional damages. Articles 160 and 161 CO do not simply mean “a penalty plus all damages in every case”.
Without a penalty clause, a breach can still give rise to contractual liability. The claimant must establish, among other things, the breach, loss and causal connection; under Article 97 CO, the debtor can avoid liability by proving that no fault is attributable to it. A penalty is therefore no reason to stop keeping evidence of disclosures and incidents.
NDA, personal data and intellectual property: three connected subjects
An NDA does not replace data protection
Customer files often contain personal data. Confidentiality governs contractual rights to disclose or use it; the Federal Act on Data Protection (FADP) also governs the conditions for processing it.
If a provider processes data on your instructions, organise that processing under Article 9 FADP: purposes, instructions, security, further processors and responsibilities. Hosting or access from abroad also requires examination of cross-border disclosure rules.
For an initial commercial assessment, use aggregated or anonymised figures where identities are unnecessary. Even the best NDA does not justify providing every identifiable record at the first meeting.
The agreement does not transfer rights in deliverables
State that no licence or assignment is granted beyond use necessary for the agreed purpose. Where a provider develops software, a design or a prototype, the development agreement should address deliverables, pre-existing material and exploitation rights.
An obligation to keep code secret does not automatically give you ownership of that code. Equally, providing drawings to obtain a manufacturing quotation does not authorise their use for other customers.
Preserve a future patent application
Novelty matters for patentability. Premature public disclosure can compromise protection. The Swiss Federal Institute of Intellectual Property recommends maintaining secrecy and setting clear collaboration terms. Plan the filing and technical exchanges before a public presentation; signing an NDA afterwards does not retrospectively restore lost novelty.
Example: sharing a business sale file in stages
An SME wants to sell its business. At first contact, it provides an anonymous overview: sector, approximate turnover, team and reason for selling. A prospective buyer expresses credible interest.
The next stage starts with an NDA identifying the potential buyer, restricting use to evaluating the transaction and defining permitted advisers. The first detailed documents contain aggregated data. Customer names, sensitive contracts and individual records become available only when needed.
The data room uses individual accounts. Documents have dates and version numbers. The business records what it has disclosed. The NDA explains what happens to copies when the process ends. Any restriction on directly contacting customers or staff is discussed as a separate obligation with its own scope and duration.
This approach answers three questions if a problem arises: who received what, for which purpose and subject to which undertaking? That is much stronger than signing a document and then emailing a complete file to a generic address.
What should you do if the agreement is breached?
Start by preserving evidence: the signed version, disclosed files, dates, recipients, access rights and evidence of use or disclosure. Avoid deleting useful logs while hastily closing accounts.
Then contain the incident: revoke remaining access, request that disclosure stop and identify copies and recipients. Send a specific request rather than a general accusation. A personal data breach may also trigger separate duties under the FADP, in addition to the contractual dispute.
Where disclosure continues or threatens an important interest, assess legal proceedings and urgent measures promptly. A confidentiality clause cannot technically prevent files from being copied. Speed, evidence and access controls matter as much as the wording.
Checklist before signing
- The correct companies sign, with the necessary authority.
- The purpose of disclosure is specific and limited.
- Information, formats and exclusions are defined.
- Use outside the project is also prohibited.
- Permitted recipients and subcontractors are covered.
- Sharing, storage and AI tools are compatible with the commitments.
- The periods and their starting dates are clear.
- Return, deletion and archiving obligations are achievable.
- Any penalty and other remedies work together coherently.
- Governing law, intellectual property rights and data protection are addressed separately where needed.
Protect information without blocking useful discussions
An effective NDA supports collaboration by making the rules clear. It should accompany information shared at the right stage, with the right person and through a controlled channel.
Start by identifying which disclosures would actually reduce your business’s value. Then draft obligations around that specific risk. The result will be shorter, clearer and more useful than a collection of general clauses.
Frequently asked questions
Does an NDA need notarisation?
An ordinary commercial confidentiality agreement generally does not require a notarial deed. A signed written version, properly retained, makes proof easier. Check the signatories’ authority and any specific form requirements for other clauses.
How long should a confidentiality agreement last?
There is no universal duration. Separate the disclosure period from the survival of confidentiality, then choose a period reflecting the information’s sensitivity and useful life.
Does an NDA stop someone copying my idea?
It imposes the agreed obligations on the parties concerned. It does not create a general monopoly over an idea or automatically bind every third party. Restrictions on use and intellectual property rights need explicit treatment.
Can information already disclosed be protected?
The parties can identify earlier disclosures they intend to cover and agree future obligations. That does not guarantee a remedy for disclosure that has already occurred or recreate lost protection. Identify earlier exchanges precisely instead of backdating the agreement.
Is a penalty automatically payable after a leak?
The contractual conditions for applying it must be established. A penalty may be payable without quantified loss, but a court must reduce an excessive penalty. The agreement should also address its relationship with other remedies.
Can AI tools be used with documents covered by an NDA?
Only where that use complies with the contract, security requirements and data protection. Check the actual recipients, hosting, retention and reuse of data. A business subscription alone does not answer all these questions.
Sources and references
- Swiss Code of Obligations, SR 220: contract formation and form; Articles 97, 100–101, 160–163 and 321a.
- Swiss Federal Institute of Intellectual Property: collaboration and protecting information (French).
- FDPIC: outsourcing and processing by third parties (French).
- FDPIC: data processing in the cloud.
- Federal Supreme Court, judgment 4A_257/2020 of 18 November 2020 (French): reduction of an excessive contractual penalty.
Romain Prieur is a Swiss-qualified chartered accountant and founder of Entreprendre.ch. With more than ten years of experience in audit and supporting Swiss businesses, he advises entrepreneurs on company formation, accounting and taxation.
