NDAs under Dutch law: when a confidentiality agreement binds

An NDA under Dutch law (geheimhoudingsovereenkomst) is an ordinary contract in which one or both parties agree not to disclose defined information and to use it only for an agreed purpose. It binds without any form requirement, but the party relying on it must prove what was agreed, so in practice only a written NDA gives you real protection.

Whether a court will enforce it depends on four things: a defined purpose, a workable definition of the confidential information, exceptions that respect the law, and remedies that a court will actually grant. The main exception to keep in mind is that no NDA can stop a lawful report to the police, a regulator or a whistleblower channel.

What is an NDA under Dutch law?

An NDA is a contract like any other. It is formed through offer and acceptance, and it needs no writing, no notarial deed and no consideration in the English-law sense.

What matters is that the obligations are sufficiently determinable. The agreement should make clear which information is covered, for which purpose, for how long, and what happens if the obligation is breached.

NDAs come in two forms. A one-way agreement binds only the party receiving the information. That suits a situation where one side has a prototype, a client list or a set of figures and the other has nothing comparable to share. A mutual agreement binds both parties. It is usual in merger talks, joint development and most commercial negotiations, and it tends to produce a more balanced text because each side has to live with it.

When will a Dutch court enforce an NDA?

A Dutch court enforces confidentiality obligations that are clear and proportionate. Vagueness is what defeats them.

Five features make the difference:

• A stated purpose. The purpose limits use, and it distinguishes an ordinary commercial exchange from a general gag.
• A usable definition. The people who handle the information day to day must be able to apply it.
• Limited access. Only those who need the information should receive it, and employees, advisers and subcontractors must accept the same obligations before anything is passed on.
• The standard exclusions. These cover information that is already public, that the recipient already lawfully held, that it developed independently or that it lawfully obtained from a third party. The agreement should also say who must prove that an exclusion applies; normally that is the recipient.
• Proportionate remedies. A penalty that bears no relation to the interest protected invites the court to reduce it.

Enforceability also has an outer limit that no drafting can move. A clause cannot be enforced to the extent that it would prevent a party from reporting a criminal offence, complying with a court order or a statutory duty, giving truthful evidence when compelled, or making a protected report under the Whistleblowers Protection Act (Wet bescherming klokkenluiders). Building those exceptions in does not weaken the agreement. Leaving them out does, because it invites the argument that the whole clause is contrary to public policy.

How do you define confidential information without overreaching?

Define it by categories that are tied to the purpose of the disclosure, not as “everything”. The definition decides most disputes, and making it as wide as possible works against you.

A definition that covers everything gives the recipient no way to comply and gives the court every reason to read it down. A definition that works lists categories such as technical know-how and source code, designs and prototypes, pricing and margins, customer and supplier data, business plans and, in a transaction, the existence and content of the negotiations themselves. In an agreement about private matters the categories differ, but the technique is the same.

Should marking be the only way into protection?

No. In real life information is shared in meetings, demonstrations and calls, so a rule that only stamped documents are confidential excludes most of what actually matters.

The workable standard is that information is confidential if it is marked as such, or if the recipient knew or should reasonably have known that it was confidential given its nature and the circumstances of the disclosure. If oral disclosures must be confirmed in writing, set a period that people can realistically meet, and do not make a missed confirmation fatal.

What else belongs in the definition clause?

Include the standard exclusions and say who bears the burden of proof. Also exclude the recipient’s general skills and experience. A clause that tries to stop someone from using what they have learned as a professional is unenforceable in substance, and it often makes a court read the rest of the agreement with suspicion.

Confidentiality protects information, not competence. If you want to restrict competition, you have to say so separately and accept the stricter rules that apply to non-competition clauses.

Finally, state that the disclosure does not transfer or license any intellectual property, and that the recipient will not apply for rights in the disclosed material. If a licence is in fact intended, it belongs in a licence agreement, not in a confidentiality clause.

How long can an NDA last, and what may the information be used for?

Use should be limited to the stated purpose, and the duration should match the kind of information. For genuine trade secrets the obligation can run for as long as the information stays secret.

Purpose and duration are the two levers that keep an NDA proportionate. On purpose, the rule is simple: use is permitted for the stated purpose and nothing else, and a new purpose requires written consent. Without that limitation, an NDA restricts disclosure but still lets the recipient use your information itself. That is usually exactly what you wanted to prevent.

On duration, distinguish between the term of the agreement and the term of the obligation. The agreement may end when the negotiation ends; the confidentiality obligation should survive it. For information that loses value quickly, a fixed period of a few years after the end of the cooperation is proportionate and easier to enforce.

For genuine trade secrets there is no reason to set an end date. The statutory protection lasts as long as the information remains secret. A contractual cut-off date may even be read as an admission that the parties no longer regarded the information as a trade secret after that date.

Which two provisions complete the picture?

First, the obligation should end for information that becomes public through no fault of the recipient. Protecting what everyone can read serves no purpose and makes the clause look oppressive.

Second, there should be a clean exit. When the purpose is completed, or on request, the recipient returns or securely deletes the material and confirms in writing that it has done so. Allow a sensible exception for copies held in backups and for material that must be kept under a statutory retention duty. That written confirmation is worth having in itself. It is also exactly the kind of document that later shows the reasonable steps the Trade Secrets Protection Act requires.

Which disclosures must an NDA always allow?

An NDA should expressly allow six kinds of disclosure. The parties are better off writing these exits into the agreement than arguing about them later.

1. Disclosure to professional advisers who are themselves bound by confidentiality: lawyers, accountants, auditors and, in a private context, doctors and therapists.
2. Disclosure required by law or by a court, regulator or tax authority. Combine this with a duty to notify the disclosing party in advance where that is lawful, and to limit the disclosure to what is required.
3. Truthful evidence given under compulsion.
4. Reporting suspected criminal conduct or an imminent danger to the police or a competent authority.
5. A protected report under the Whistleblowers Protection Act. That Act has applied since February 2023 and prohibits any detriment as a result of a report. A contractual clause that stands in the way of such a report cannot be enforced against the reporting person.
6. Internal disclosure on a need-to-know basis to people who have accepted equivalent obligations.

How does an NDA support the Trade Secrets Protection Act?

The NDA is often the main evidence that you took reasonable steps to keep information secret. Without that evidence, the information may not qualify as a trade secret at all.

The Dutch Trade Secrets Protection Act (Wet bescherming bedrijfsgeheimen) implements the EU Trade Secrets Directive. It protects information that meets three cumulative conditions:

• it is secret, meaning it is not generally known or readily accessible to people who normally deal with that kind of information;
• it has commercial value because it is secret; and
• it has been subject to reasonable steps, in the circumstances, to keep it secret.

The third condition is the one that fails in practice, and it fails because nothing was documented.

What remedies does the Act give you?

The holder of a trade secret can act against unlawful acquisition, use or disclosure. Remedies include an injunction, the recall or destruction of infringing goods, and damages. Dutch procedural law also allows the court to restrict access to the confidential material during the proceedings, so that enforcement does not destroy the secret.

Criminal law can play a role too. Where an employee or former employee deliberately discloses business particulars that he was obliged to keep secret, that can be a criminal offence under article 273 of the Dutch Criminal Code.

What exactly does the NDA contribute?

The NDA identifies the categories treated as secret, limits use to a purpose and restricts access. Keep the paper trail as well: a recipient log, a dated deposit or sealed specification describing the scope of the secret without revealing it, and the deletion confirmations at the end of a project turn an assertion into evidence. Our pages on Dutch law on the protection of trade secrets and on how to protect your trade secrets set out the wider set of measures.

How does an NDA relate to the GDPR?

An NDA does not displace data protection law. If the confidential information includes personal data, the GDPR applies on its own terms, and a confidentiality clause is not a legal basis for processing.

The two instruments therefore have to be aligned. Start with the roles. If one party processes personal data on the other’s instructions, a processing agreement is compulsory and the NDA cannot take its place. If both parties determine the purposes and means, they are joint controllers and must record who performs which obligation.

Then apply the data protection principles inside the confidentiality arrangement itself:

• share only the personal data the purpose requires;
• prohibit reuse for unrelated purposes;
• restrict access to named roles;
• require appropriate technical and organisational measures;
• set a concrete retention period rather than an open-ended one; and
• require return or secure deletion, with written confirmation, at the end.

Two further points matter with sensitive material. The agreement should deal with cooperation on requests from data subjects, and no clause may restrict a person’s exercise of their rights or their ability to complain to the supervisory authority. And if a data breach occurs, the controller must assess it and, where required, notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without undue delay and, where feasible, within 72 hours. The NDA should therefore oblige the other party to inform you immediately, not only after its own internal investigation. If personal data is involved on any scale, take specialist privacy advice before signing.

What can a penalty clause do, and how does it differ from a dwangsom?

A contractual penalty (boetebeding) is agreed between the parties and is payable on breach without proof of loss. A dwangsom is a coercive payment that only a court can impose to force compliance with an order.

How does the contractual penalty work?

Under article 6:92 of the Dutch Civil Code, the penalty replaces statutory damages unless the contract provides otherwise. An agreement that is silent on this point leaves you with the penalty and nothing more. So state expressly that the penalty is without prejudice to your right to claim full damages and injunctive relief.

Under article 6:94 of the Civil Code, the court may reduce a penalty if applying it would be manifestly unfair. Disproportionate amounts invite exactly that. Anchor the amount to a plausible view of the harm, and consider a fixed amount per breach for one-off disclosures, an amount per day for a continuing breach, and a cap on the total.

How does the dwangsom work?

The dwangsom is imposed by the court under article 611a of the Dutch Code of Civil Procedure to compel compliance with an order. It cannot be created by contract; you request it together with an injunction. In practice the two work side by side: the penalty compensates and deters, and the coercive payment forces the breach to stop.

What changes when the NDA is with an employee or contractor?

With employees, statutory rules on penalty clauses apply and override the usual commercial drafting. With contractors, the main issues are intellectual property and passing the obligations down the chain.

Which rules apply to penalties in an employment contract?

Under article 7:650 of the Civil Code, a penalty clause in an employment contract must be in writing and must specify the breach and the amount. It must state precisely where the money goes, and the penalty may not benefit the employer directly or indirectly. The penalties imposed in one week may together not exceed half a day’s wages.

The parties may depart from the destination, the amount and the weekly maximum only in writing, and only where the employee earns more than the statutory minimum wage. Even then, the court may reduce a penalty it considers excessive.

Under article 7:651 of the Civil Code, the employer cannot both impose the penalty and claim damages for the same act; any clause that says otherwise is void. The commercial reflex to make penalties cumulative with damages is therefore wrong in an employment contract.

Can you combine confidentiality with a non-compete?

Keep them separate. A non-competition or non-solicitation clause has its own requirements, including the written form and, in a fixed-term contract, a written statement of the compelling business interests that justify it. Hiding a restraint of trade inside a confidentiality clause does not make it enforceable. It makes the confidentiality clause suspect.

What should you arrange with contractors and agencies?

There is no statutory transfer of intellectual property to the client, so the services agreement must deal with assignment expressly. The confidentiality obligation must also be passed on to sub-consultants before any disclosure is made.

Manage the practical side as well. Give minimal access at the start. At the end, recover devices and credentials, withdraw access and obtain a written confirmation of deletion. An NDA that does not match how the organisation actually handles the information proves very little.

Do the same rules apply to confidentiality agreements in private relationships?

Yes. A private confidentiality agreement is a contract like any other, but the limits of public policy come into play much sooner.

Such agreements are used outside business to protect identities, messages, images or the existence of a relationship. Dutch law does not treat them as a separate category. The same requirements of clarity, purpose and proportionality apply.

A private agreement can lawfully protect private information. It cannot be used to conceal a criminal offence, to prevent a report to the police or another authority, to prevent someone from seeking help from a lawyer, a doctor or a therapist, or to prevent truthful evidence being given when compelled. Those exceptions must be written into the text. Nor may the obligation be tied to sexual conduct as its consideration; an agreement built that way is contrary to public morality and will not be enforced.

What should you arrange in a cross-border NDA?

Four choices decide whether a cross-border NDA is usable: governing law, forum, language and the way it is signed. Also check export control rules before sending technology abroad.

Governing law

Within the EU, the Rome I Regulation respects the parties’ choice of law. That choice is subject to the overriding mandatory rules of the forum, and it cannot set aside the mandatory law of the only country the situation is connected with. Dutch law is the natural choice where most of the performance, and most of the information, is located in the Netherlands.

Forum

A choice of court within the EU is upheld under the Brussels I bis Regulation, and judgments are recognised in other member states without a separate enforcement procedure (exequatur). Arbitration is the alternative, and it has two advantages here. The proceedings are confidential, which matters when the dispute is about a secret. And awards are enforceable in a very large number of countries under the New York Convention. The drawbacks are cost and the absence of an appeal.

Whichever route you choose, include an express exception allowing either party to seek urgent injunctive relief from a national court. Interim protection is what stops a leak while the main dispute is pending.

Language and signature

State which language version prevails. Be careful with English legal terms in an agreement governed by Dutch law: expressions such as “best efforts” or “consequential loss” will be interpreted as a Dutch court reads them, not as an English court would.

Allow signature in counterparts and by electronic means. The legal weight of a digital signature depends on the type used; a qualified electronic signature has the same effect as a handwritten one. Where the information concerns controlled technology, check the export control and sanctions rules before it is sent abroad. An NDA does not authorise a transfer that export law prohibits.

What should you do when an NDA is breached?

Act fast and in a fixed order: secure evidence, contain the leak, send a formal demand and, if needed, go to the preliminary relief judge. The value of confidential information disappears as it spreads.

Step 1: secure the evidence

Take dated screenshots with the URL visible, keep the original emails and messages with their headers, export the access logs, and record who saw what and when. Do not edit anything.

Step 2: contain the leak

Withdraw credentials, close shared folders, restrict access to the smallest possible group, and instruct any supplier or subcontractor involved to stop onward disclosure immediately.

Step 3: send a formal demand

Send a formal demand letter (sommatiebrief) that cites the clauses breached. Require, by a stated deadline, that the disclosure stops, that the material is taken down, that the recipients are identified, and that the material is returned or deleted with written confirmation. Many breaches end at this stage, particularly where the recipient did not appreciate the position.

Step 4: apply for interim relief

If the demand does not work, apply for interim relief in summary proceedings (kort geding). The preliminary relief judge can grant an injunction, order return or verified destruction, and impose a coercive payment for each breach, usually within weeks. Claim the contractual penalty and reserve damages and costs at the same time. Where arbitration has been agreed, bring the main dispute there and use the court only for the emergency measures the arbitration clause allows.

Step 5: follow up

Two more steps are easy to forget. If personal data has leaked, carry out the breach assessment and make any notification the GDPR requires. Coordinate any public statement so that the response does not reveal more than the breach did. Afterwards, look at how it happened: often the failure lies in access management rather than in the drafting.

Where a negotiated ending makes more sense than a judgment, a settlement agreement with reinforced undertakings and a deletion certificate is often the better outcome. That is particularly true where litigation would draw attention to the very information you are trying to protect.

Should you use a template or a tailored NDA?

A template is fine for a short, mutual, low-risk exchange between Dutch parties. Tailored drafting pays off once trade secrets, personal data, subcontractors, foreign parties or significant penalties are involved.

Tailoring is worth its cost when you will rely on the Trade Secrets Protection Act, when significant personal data is shared, when contractors or group companies handle the information, when the relationship crosses a border, or when the penalty is large enough to be argued about.

Whether it is worth taking advice at all is a question we address more generally in our note on when legal advice is necessary in the Netherlands.

What should you check as the party disclosing information?

You want a clause a court will enforce and that proves the reasonable steps under the Trade Secrets Protection Act. Check these points in the draft:

• The purpose is stated, and use for any other purpose requires your written consent.
• The definition covers concrete categories, including oral disclosures the recipient should have known were confidential.
• The obligation for genuine trade secrets has no fixed end date.
• The penalty is proportionate and expressly without prejudice to damages and injunctive relief (article 6:92 of the Civil Code).
• Onward disclosure to staff, advisers and subcontractors requires equivalent written obligations.
• Choice of law and forum include an exception for urgent relief before the Dutch preliminary relief judge.

What should you check as the party receiving information?

You must be able to comply in daily practice. Our note on contract negotiation strategies explains how to raise these points without losing the deal. Check:

• The standard exclusions apply: public information, information you already held, independent development and lawful receipt from a third party.
• Your general skills and experience are excluded, and no restraint of trade is hidden in the clause.
• No intellectual property is assigned or licensed by the NDA.
• Disclosures to advisers, authorities, courts and whistleblower channels remain permitted.
• The return and deletion clause allows backup copies and statutory retention.
• The penalty has a cap and a rational basis; in an employment contract, articles 7:650 and 7:651 of the Civil Code apply.

What can we do for you with an NDA?

Our corporate lawyers draft and review confidentiality agreements for Dutch and international clients:

• We draft a one-way or mutual NDA tailored to the purpose, the information and the parties involved.
• We review a draft NDA you received and propose concrete amendments.
• We align the NDA with the Trade Secrets Protection Act and, where personal data is shared, with a GDPR processing agreement.
• We check penalty clauses in employment contracts against articles 7:650 and 7:651 of the Civil Code.
• After a leak, we send the formal demand and apply for an injunction with a coercive payment in summary proceedings (kort geding).

Summary

• An NDA is an ordinary contract under Dutch law. No form is required, but you must prove what was agreed, so put it in writing.
• Enforceability depends on a stated purpose, a usable definition by category, the standard exclusions, limited access and proportionate remedies.
• No NDA can block reports to the police or authorities, compliance with legal duties, compelled evidence or protected whistleblower reports; write those exceptions in.
• A penalty replaces damages unless the contract says otherwise (article 6:92 of the Civil Code) and can be reduced by the court (article 6:94); in employment contracts articles 7:650 and 7:651 apply.
• The NDA and its paper trail are key evidence of the reasonable steps the Trade Secrets Protection Act requires; after a breach, act quickly through a demand letter and summary proceedings.

Frequently asked questions