NDAs under Dutch law: when a confidentiality agreement binds

An NDA under Dutch law (geheimhoudingsovereenkomst) is an ordinary contract in which one or both parties agree not to disclose defined information and to use it only for an agreed purpose. It binds without any form requirement, but the party relying on it must prove what was agreed, so in practice only a written NDA gives you real protection.

Whether a court will enforce it depends on four things: a defined purpose, a workable definition of the confidential information, exceptions that respect the law, and remedies that a court will actually grant. The main exception to keep in mind is that no NDA can stop a lawful report to the police, a regulator or a whistleblower channel.

This guide explains how NDAs work in the Netherlands. We cover when they bind, how to define confidential information without overreaching, how long protection can last and which disclosures must always remain possible. We also explain how an NDA supports a claim under the Trade Secrets Protection Act, how it relates to the GDPR, and what a penalty clause can and cannot do, including the separate rules for employment contracts. We close with enforcement, cross-border points and frequently asked questions.

What is an NDA under Dutch law?

An NDA is a contract like any other. It is formed through offer and acceptance, and it needs no writing, no notarial deed and no consideration in the English-law sense.

What matters is that the obligations are sufficiently determinable. The agreement should make clear which information is covered, for which purpose, for how long, and what happens if the obligation is breached.

NDAs come in two forms. A one-way agreement binds only the party receiving the information. That suits a situation where one side has a prototype, a client list or a set of figures and the other has nothing comparable to share. A mutual agreement binds both parties. It is usual in merger talks, joint development and most commercial negotiations, and it tends to produce a more balanced text because each side has to live with it.

In practice the NDA is the first of the commercial agreements you sign: before the term sheet and well before the main contract. It usually has to survive the failure of the negotiation it was written for. That point is often missed. An NDA is not an accessory to the deal. It is the document that governs what happens when the deal does not go ahead and the other party still holds everything you showed them.

A well-drafted NDA also does a second job. Under the Dutch Trade Secrets Protection Act, information only qualifies as a trade secret if reasonable steps have been taken to keep it secret. The NDA, together with access controls and a record of who received what, is the most visible of those steps. It therefore serves as evidence in a later dispute, even where nobody sues on the contract itself.

When will a Dutch court enforce an NDA?

A Dutch court enforces confidentiality obligations that are clear and proportionate. Vagueness is what defeats them.

Take an NDA that defines confidential information as everything ever exchanged, has no purpose limitation, runs indefinitely against all information regardless of its value and attaches an arbitrary penalty. Such an NDA is not automatically void. But each of those features gives the court a reason to read the clause narrowly, to reduce the penalty, or to find that the information in question fell outside it.

Five features make the difference:

• A stated purpose. The purpose limits use, and it distinguishes an ordinary commercial exchange from a general gag.
• A usable definition. The people who handle the information day to day must be able to apply it.
• Limited access. Only those who need the information should receive it, and employees, advisers and subcontractors must accept the same obligations before anything is passed on.
• The standard exclusions. These cover information that is already public, that the recipient already lawfully held, that it developed independently or that it lawfully obtained from a third party. The agreement should also say who must prove that an exclusion applies; normally that is the recipient.
• Proportionate remedies. A penalty that bears no relation to the interest protected invites the court to reduce it.

Enforceability also has an outer limit that no drafting can move. A clause cannot be enforced to the extent that it would prevent a party from reporting a criminal offence, complying with a court order or a statutory duty, giving truthful evidence when compelled, or making a protected report under the Whistleblowers Protection Act (Wet bescherming klokkenluiders). Building those exceptions in does not weaken the agreement. Leaving them out does, because it invites the argument that the whole clause is contrary to public policy.

How do you define confidential information without overreaching?

Define it by categories that are tied to the purpose of the disclosure, not as “everything”. The definition decides most disputes, and making it as wide as possible works against you.

A definition that covers everything gives the recipient no way to comply and gives the court every reason to read it down. A definition that works lists categories such as technical know-how and source code, designs and prototypes, pricing and margins, customer and supplier data, business plans and, in a transaction, the existence and content of the negotiations themselves. In an agreement about private matters the categories differ, but the technique is the same.

Should marking be the only way into protection?

No. In real life information is shared in meetings, demonstrations and calls, so a rule that only stamped documents are confidential excludes most of what actually matters.

The workable standard is that information is confidential if it is marked as such, or if the recipient knew or should reasonably have known that it was confidential given its nature and the circumstances of the disclosure. If oral disclosures must be confirmed in writing, set a period that people can realistically meet, and do not make a missed confirmation fatal.

What else belongs in the definition clause?

Include the standard exclusions and say who bears the burden of proof. Also exclude the recipient’s general skills and experience. A clause that tries to stop someone from using what they have learned as a professional is unenforceable in substance, and it often makes a court read the rest of the agreement with suspicion.

Confidentiality protects information, not competence. If you want to restrict competition, you have to say so separately and accept the stricter rules that apply to non-competition clauses.

Finally, state that the disclosure does not transfer or license any intellectual property, and that the recipient will not apply for rights in the disclosed material. If a licence is in fact intended, it belongs in a licence agreement, not in a confidentiality clause.

How long can an NDA last, and what may the information be used for?

Use should be limited to the stated purpose, and the duration should match the kind of information. For genuine trade secrets the obligation can run for as long as the information stays secret.

Purpose and duration are the two levers that keep an NDA proportionate. On purpose, the rule is simple: use is permitted for the stated purpose and nothing else, and a new purpose requires written consent. Without that limitation, an NDA restricts disclosure but still lets the recipient use your information itself. That is usually exactly what you wanted to prevent.

On duration, distinguish between the term of the agreement and the term of the obligation. The agreement may end when the negotiation ends; the confidentiality obligation should survive it. For information that loses value quickly, a fixed period of a few years after the end of the cooperation is proportionate and easier to enforce.

For genuine trade secrets there is no reason to set an end date. The statutory protection lasts as long as the information remains secret. A contractual cut-off date may even be read as an admission that the parties no longer regarded the information as a trade secret after that date.

Which two provisions complete the picture?

First, the obligation should end for information that becomes public through no fault of the recipient. Protecting what everyone can read serves no purpose and makes the clause look oppressive.

Second, there should be a clean exit. When the purpose is completed, or on request, the recipient returns or securely deletes the material and confirms in writing that it has done so. Allow a sensible exception for copies held in backups and for material that must be kept under a statutory retention duty. That written confirmation is worth having in itself. It is also exactly the kind of document that later shows the reasonable steps the Trade Secrets Protection Act requires.

Which disclosures must an NDA always allow?

An NDA should expressly allow six kinds of disclosure. The parties are better off writing these exits into the agreement than arguing about them later.

1. Disclosure to professional advisers who are themselves bound by confidentiality: lawyers, accountants, auditors and, in a private context, doctors and therapists.
2. Disclosure required by law or by a court, regulator or tax authority. Combine this with a duty to notify the disclosing party in advance where that is lawful, and to limit the disclosure to what is required.
3. Truthful evidence given under compulsion.
4. Reporting suspected criminal conduct or an imminent danger to the police or a competent authority.
5. A protected report under the Whistleblowers Protection Act. That Act has applied since February 2023 and prohibits any detriment as a result of a report. A contractual clause that stands in the way of such a report cannot be enforced against the reporting person.
6. Internal disclosure on a need-to-know basis to people who have accepted equivalent obligations.

These are not concessions. An agreement that tries to close these routes risks being read as an attempt to obstruct supervision or prosecution. A court faced with such a clause will be less willing to enforce the parts of the agreement that are legitimate.

How does an NDA support the Trade Secrets Protection Act?

The NDA is often the main evidence that you took reasonable steps to keep information secret. Without that evidence, the information may not qualify as a trade secret at all.

The Dutch Trade Secrets Protection Act (Wet bescherming bedrijfsgeheimen) implements the EU Trade Secrets Directive. It protects information that meets three cumulative conditions:

• it is secret, meaning it is not generally known or readily accessible to people who normally deal with that kind of information;
• it has commercial value because it is secret; and
• it has been subject to reasonable steps, in the circumstances, to keep it secret.

The third condition is the one that fails in practice, and it fails because nothing was documented.

What remedies does the Act give you?

The holder of a trade secret can act against unlawful acquisition, use or disclosure. Remedies include an injunction, the recall or destruction of infringing goods, and damages. Dutch procedural law also allows the court to restrict access to the confidential material during the proceedings, so that enforcement does not destroy the secret.

Criminal law can play a role too. Where an employee or former employee deliberately discloses business particulars that he was obliged to keep secret, that can be a criminal offence under article 273 of the Dutch Criminal Code.

What exactly does the NDA contribute?

The NDA supports all of this in a specific way. It identifies the categories treated as secret. It limits use to a purpose. It restricts access to identified people who have accepted the same duties. It imposes handling and security requirements. And it produces a paper trail of who received what, and when it was returned or deleted.

Keep that trail. A recipient log, a dated deposit or sealed specification describing the scope of the secret without revealing it, and the deletion confirmations at the end of a project turn an assertion into evidence. Our pages on Dutch law on the protection of trade secrets and on how to protect your trade secrets set out the wider set of measures.

How does an NDA relate to the GDPR?

An NDA does not displace data protection law. If the confidential information includes personal data, the GDPR applies on its own terms, and a confidentiality clause is not a legal basis for processing.

The two instruments therefore have to be aligned. Start with the roles. If one party processes personal data on the other’s instructions, a processing agreement is compulsory and the NDA cannot take its place. If both parties determine the purposes and means, they are joint controllers and must record who performs which obligation.

Then apply the data protection principles inside the confidentiality arrangement itself:

• share only the personal data the purpose requires;
• prohibit reuse for unrelated purposes;
• restrict access to named roles;
• require appropriate technical and organisational measures;
• set a concrete retention period rather than an open-ended one; and
• require return or secure deletion, with written confirmation, at the end.

Two further points matter with sensitive material. The agreement should deal with cooperation on requests from data subjects, and no clause may restrict a person’s exercise of their rights or their ability to complain to the supervisory authority. And if a data breach occurs, the controller must assess it and, where required, notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without undue delay and, where feasible, within 72 hours. The NDA should therefore oblige the other party to inform you immediately, not only after its own internal investigation. If personal data is involved on any scale, take specialist privacy advice before signing.

What can a penalty clause do, and how does it differ from a dwangsom?

A contractual penalty (boetebeding) is agreed between the parties and is payable on breach without proof of loss. A dwangsom is a coercive payment that only a court can impose to force compliance with an order.

A confidentiality obligation without a credible consequence is hard to enforce, because the loss caused by a leak is notoriously difficult to quantify. Dutch law offers these two instruments, and they are often confused.

How does the contractual penalty work?

Under article 6:92 of the Dutch Civil Code, the penalty replaces statutory damages unless the contract provides otherwise. An agreement that is silent on this point leaves you with the penalty and nothing more. So state expressly that the penalty is without prejudice to your right to claim full damages and injunctive relief.

Under article 6:94 of the Civil Code, the court may reduce a penalty if applying it would be manifestly unfair. Disproportionate amounts invite exactly that. Anchor the amount to a plausible view of the harm, and consider a fixed amount per breach for one-off disclosures, an amount per day for a continuing breach, and a cap on the total.

How does the dwangsom work?

The dwangsom is imposed by the court under article 611a of the Dutch Code of Civil Procedure to compel compliance with an order. It cannot be created by contract; you request it together with an injunction. In practice the two work side by side: the penalty compensates and deters, and the coercive payment forces the breach to stop.

A model wording, adapted to the case, is that for each breach the recipient owes a penalty of a stated amount, increased by a stated amount for each day the breach continues, and that the penalty is without prejudice to the right to claim full damages, performance and injunctive relief.

What changes when the NDA is with an employee or contractor?

With employees, statutory rules on penalty clauses apply and override the usual commercial drafting. With contractors, the main issues are intellectual property and passing the obligations down the chain.

This is where standard clauses copied from commercial contracts go wrong. An employee already owes a duty of confidentiality as part of the obligation to behave as a good employee. A written clause is still worth having, because it defines the scope and survives the end of the employment.

Which rules apply to penalties in an employment contract?

Under article 7:650 of the Civil Code, a penalty clause in an employment contract must be in writing and must specify the breach and the amount. It must state precisely where the money goes, and the penalty may not benefit the employer directly or indirectly. The penalties imposed in one week may together not exceed half a day’s wages.

The parties may depart from the destination, the amount and the weekly maximum only in writing, and only where the employee earns more than the statutory minimum wage. Even then, the court may reduce a penalty it considers excessive.

Under article 7:651 of the Civil Code, the employer cannot both impose the penalty and claim damages for the same act; any clause that says otherwise is void. The commercial reflex to make penalties cumulative with damages is therefore wrong in an employment contract.

Can you combine confidentiality with a non-compete?

Keep them separate. A non-competition or non-solicitation clause has its own requirements, including the written form and, in a fixed-term contract, a written statement of the compelling business interests that justify it. Hiding a restraint of trade inside a confidentiality clause does not make it enforceable. It makes the confidentiality clause suspect.

What should you arrange with contractors and agencies?

There is no statutory transfer of intellectual property to the client, so the services agreement must deal with assignment expressly. The confidentiality obligation must also be passed on to sub-consultants before any disclosure is made.

Manage the practical side as well. Give minimal access at the start. At the end, recover devices and credentials, withdraw access and obtain a written confirmation of deletion. An NDA that does not match how the organisation actually handles the information proves very little.

Do the same rules apply to confidentiality agreements in private relationships?

Yes. A private confidentiality agreement is a contract like any other, but the limits of public policy come into play much sooner.

Such agreements are used outside business to protect identities, messages, images or the existence of a relationship. Dutch law does not treat them as a separate category. The same requirements of clarity, purpose and proportionality apply.

A private agreement can lawfully protect private information. It cannot be used to conceal a criminal offence, to prevent a report to the police or another authority, to prevent someone from seeking help from a lawyer, a doctor or a therapist, or to prevent truthful evidence being given when compelled. Those exceptions must be written into the text. Nor may the obligation be tied to sexual conduct as its consideration; an agreement built that way is contrary to public morality and will not be enforced.

Two practical points follow. Keep the scope narrow and the categories concrete, because a broad gag over an entire relationship is both unenforceable and evidence of the imbalance a court will look for. And where intimate images or other personal data are involved, apply the same data hygiene as in a commercial setting: limit what is shared, restrict access, and require deletion on request or when the purpose ends. The unlawful publication of sexual images is a criminal offence in its own right. The civil remedies available to the victim, including an urgent injunction, exist regardless of what any agreement says.

What should you arrange in a cross-border NDA?

Four choices decide whether a cross-border NDA is usable: governing law, forum, language and the way it is signed. Also check export control rules before sending technology abroad.

Governing law

Within the EU, the Rome I Regulation respects the parties’ choice of law. That choice is subject to the overriding mandatory rules of the forum, and it cannot set aside the mandatory law of the only country the situation is connected with. Dutch law is the natural choice where most of the performance, and most of the information, is located in the Netherlands.

Forum

A choice of court within the EU is upheld under the Brussels I bis Regulation, and judgments are recognised in other member states without a separate enforcement procedure (exequatur). Arbitration is the alternative, and it has two advantages here. The proceedings are confidential, which matters when the dispute is about a secret. And awards are enforceable in a very large number of countries under the New York Convention. The drawbacks are cost and the absence of an appeal.

Whichever route you choose, include an express exception allowing either party to seek urgent injunctive relief from a national court. Interim protection is what stops a leak while the main dispute is pending.

Language and signature

State which language version prevails. Be careful with English legal terms in an agreement governed by Dutch law: expressions such as “best efforts” or “consequential loss” will be interpreted as a Dutch court reads them, not as an English court would.

Allow signature in counterparts and by electronic means. The legal weight of a digital signature depends on the type used; a qualified electronic signature has the same effect as a handwritten one. Where the information concerns controlled technology, check the export control and sanctions rules before it is sent abroad. An NDA does not authorise a transfer that export law prohibits.

What should you look out for before you sign?

Check the draft for features that make an NDA unenforceable or unworkable. Most can be fixed with modest amendments that the other side usually accepts.

Red flags in a draft NDA

• A catch-all definition that covers everything ever exchanged, including information that is already public, without the standard exclusions.
• No purpose limitation, which permits unrestricted reuse.
• No exceptions for advisers, court orders, authorities and protected reports.
• A penalty with no rational basis, or one that is silent on whether damages can still be claimed.
• No return or deletion obligation, which is a problem under the GDPR and for proving reasonable steps under the Trade Secrets Protection Act.
• A hidden assignment of intellectual property, or a clause that tries to restrict the recipient’s general skills.
• A restraint of trade slipped in under the heading of confidentiality.
• Permission to share with unnamed affiliates and advisers without equivalent obligations.
• A foreign governing law and forum with no exception for urgent relief in the Netherlands.

What to negotiate

Fix the purpose and add that no licence of intellectual property is implied. Narrow the definition to categories and add the exclusions, with the burden of proof on the recipient. Make the obligations mutual where information genuinely flows both ways. Limit access to named roles and require equivalent obligations before any onward disclosure. Add the public policy exceptions. Set a retention and deletion regime with written confirmation.

Size the penalty to the interest protected and state that damages and injunctive relief remain available, remembering that in an employment contract the statutory rules override that approach. And settle the dispute mechanics: governing law, forum or arbitration, the prevailing language and the emergency exception. Our note on contract negotiation strategies explains how to run that discussion without losing the deal, and our guide to signing a contract without hidden legal issues covers the wider checks before signature.

What should you do when an NDA is breached?

Act fast and in a fixed order: secure evidence, contain the leak, send a formal demand and, if needed, go to the preliminary relief judge. The value of confidential information disappears as it spreads.

Step 1: secure the evidence

Take dated screenshots with the URL visible, keep the original emails and messages with their headers, export the access logs, and record who saw what and when. Do not edit anything.

Step 2: contain the leak

Withdraw credentials, close shared folders, restrict access to the smallest possible group, and instruct any supplier or subcontractor involved to stop onward disclosure immediately.

Step 3: send a formal demand

Send a formal demand letter (sommatiebrief) that cites the clauses breached. Require, by a stated deadline, that the disclosure stops, that the material is taken down, that the recipients are identified, and that the material is returned or deleted with written confirmation. Many breaches end at this stage, particularly where the recipient did not appreciate the position.

Step 4: apply for interim relief

If the demand does not work, apply for interim relief in summary proceedings (kort geding). The preliminary relief judge can grant an injunction, order return or verified destruction, and impose a coercive payment for each breach, usually within weeks. Claim the contractual penalty and reserve damages and costs at the same time. Where arbitration has been agreed, bring the main dispute there and use the court only for the emergency measures the arbitration clause allows.

Step 5: follow up

Two more steps are easy to forget. If personal data has leaked, carry out the breach assessment and make any notification the GDPR requires. Coordinate any public statement so that the response does not reveal more than the breach did. Afterwards, look at how it happened: often the failure lies in access management rather than in the drafting.

Where a negotiated ending makes more sense than a judgment, a settlement agreement with reinforced undertakings and a deletion certificate is often the better outcome. That is particularly true where litigation would draw attention to the very information you are trying to protect.

Should you use a template or a tailored NDA?

A template is fine for a short, mutual, low-risk exchange between Dutch parties. Tailored drafting pays off once trade secrets, personal data, subcontractors, foreign parties or significant penalties are involved.

A template is a starting point, not protection in itself. It is adequate where the exchange is mutual and low-risk, the evaluation is short, no genuine trade secrets or significant personal data are involved, both parties are Dutch, and the penalty is modest or absent. In that situation bespoke drafting adds little, and the delay costs more than the risk.

Tailoring is worth its cost in five situations:

• You will rely on the Trade Secrets Protection Act, because the agreement then has to be built as evidence of reasonable steps.
• Significant personal data is shared, because the roles, the processing agreement and the retention regime have to be right.
• Contractors, sub-processors or group companies will handle the information, because the obligations passed down the chain decide whether it holds.
• The relationship crosses a border, because the law, the forum, the language and the route to urgent relief have to work together.
• The amounts at stake justify a penalty large enough to be worth arguing about, because sizing it and keeping damages available takes careful drafting.

Whether it is worth taking advice at all is a question we address more generally in our note on when legal advice is necessary in the Netherlands.

In summary

• An NDA is an ordinary contract under Dutch law. No form is required, but you must prove what was agreed, so put it in writing.
• Enforceability depends on a stated purpose, a usable definition by category, the standard exclusions, limited access and proportionate remedies.
• No NDA can block reports to the police or authorities, compliance with legal duties, compelled evidence or protected whistleblower reports; write those exceptions in.
• A penalty replaces damages unless the contract says otherwise (article 6:92 Civil Code) and can be reduced by the court; in employment contracts articles 7:650 and 7:651 Civil Code apply.
• The NDA and its paper trail are key evidence of the reasonable steps the Trade Secrets Protection Act requires; after a breach, act quickly through a demand letter and summary proceedings.

Frequently asked questions

Does an NDA have to be in writing?

No. Dutch law imposes no form requirement, so a confidentiality obligation can be agreed orally or follow from the circumstances. But the party relying on it has to prove what was agreed, and that is close to impossible without a document. Put it in writing.

Can an NDA last indefinitely?

Yes, and for genuine trade secrets that is the right approach, because statutory protection lasts as long as the information stays secret. For information that loses value quickly, a fixed period after the end of the cooperation is more proportionate and easier to enforce.

Does everything have to be marked confidential?

Marking helps, but it should not be the only route into protection, because much information is shared orally or in demonstrations. Combine marking with a standard that also covers information the recipient knew or should reasonably have known was confidential.

Can an NDA prevent someone from reporting a crime?

No. Confidentiality cannot be enforced to prevent a report to the police or a supervisory authority, compliance with a court order or statutory duty, truthful evidence given under compulsion, or a protected report under the Whistleblowers Protection Act. Write those exceptions into the text.

Can I claim the contractual penalty and damages as well?

In a commercial contract, only if the agreement says so. Under article 6:92 of the Civil Code the penalty replaces statutory damages unless the parties provide otherwise, and the court may reduce a penalty whose application would be manifestly unfair. In an employment contract you cannot: article 7:651 of the Civil Code prohibits imposing the penalty and claiming damages for the same act.

How quickly can I stop a leak?

Summary proceedings before the preliminary relief judge normally produce a decision within weeks, and in genuinely urgent cases considerably faster. The judge can order the disclosure to stop, order return or verified deletion, and attach a coercive payment to the order.

Can an employer put a non-competition clause inside an NDA?

It should not. A restriction on competing activity has its own statutory requirements and is assessed separately. Hiding one inside a confidentiality clause does not make it enforceable and casts doubt on the rest of the agreement.

How do you get the NDA right before you need it?

Make the document match how the information is actually handled. That means a stated purpose, a definition people can apply, access limited to those who need it, exceptions that respect the law, a retention and deletion regime, and remedies a court will grant.

Drafted that way, the NDA also serves as evidence of the reasonable steps the Trade Secrets Protection Act requires. That evidence is often worth more than the contractual claim itself. We draft and review confidentiality agreements for Dutch and international clients, align them with trade secret and data protection obligations, and act in summary proceedings when a leak has to be stopped quickly.

Unsure where you stand? Tell us about your situation. We will let you know your options within one working day.