A non-disclosure agreement (NDA, in Dutch geheimhoudingsovereenkomst) is binding in the Netherlands as an ordinary contract, without any formal requirements, and it works alongside the statutory protection of trade secrets. The main exception concerns employees: a penalty clause in an employment contract must meet strict statutory conditions, or it cannot be enforced at all.
An NDA is a contract in which one or both parties undertake not to disclose or use specified confidential information. It is enforceable under the general rules of the Dutch Civil Code (Burgerlijk Wetboek, BW) and stands next to the Trade Secrets Protection Act (Wet bescherming bedrijfsgeheimen, Wbb). Its practical value lies in what it defines, how long it lasts and what happens when it is breached. Below we explain what an NDA adds to the law, which clauses matter, how penalty clauses work, the limits for employees and personal data, and how to act when information leaks.
What does an NDA add to the statutory protection of trade secrets?
An NDA helps show that you took reasonable steps to keep information secret, which the statutory protection requires. It can also protect information the law does not cover, prohibit conduct the law allows, and fix the financial consequence of a breach in advance.
Since 23 October 2018, the Netherlands has had a statute dedicated to confidential business information: the Trade Secrets Protection Act, which implements EU Directive 2016/943. It protects information that meets three cumulative conditions. – The information is secret: it is not generally known or readily accessible to people who normally deal with that kind of information. – It has commercial value because it is secret. – The person lawfully in control of it has taken reasonable steps, in the circumstances, to keep it secret.
That third condition is where the NDA earns its place. An organisation that hands out designs, price calculations or source code without a confidentiality agreement will struggle to convince a court that it took reasonable steps to keep them secret. It may then lose the statutory protection altogether. A signed NDA, together with access restrictions and marking of documents, is the usual evidence that the condition is met.
The agreement also does things the statute does not. – It can cover information that is confidential but has no independent commercial value, such as the mere fact that negotiations are taking place. – It can prohibit conduct the law permits, notably reverse engineering of a product that was lawfully acquired. The Directive and the Act treat that as a lawful way of obtaining information unless the parties agreed otherwise. – It can attach an agreed financial consequence to a breach. That removes the hardest part of any confidentiality claim: proving the loss.
Which type of NDA do you need?
A unilateral NDA binds one party, a mutual NDA binds both, and a multi-party NDA is used in consortia. The choice follows the direction in which the information flows.
A unilateral NDA fits situations in which information flows in one direction: an inventor approaching a manufacturer, a company briefing a consultant, an employer engaging staff who will see customer data. A mutual or bilateral NDA binds both sides. It is the standard instrument in merger and acquisition talks, joint development projects and any negotiation in which both parties open their books.
Multi-party agreements are used in consortia and research collaborations, where several organisations both disclose and receive information. They are harder to draft, because the permitted purpose differs per participant and a leak may be traceable to more than one recipient. Agree in advance who may share what with which group company, and record it in an annex that can be updated without renegotiating the whole agreement.
Whichever form you use, the NDA governs disclosure. It does not replace the contract that governs the collaboration itself, and it does not settle who owns the results. A confidentiality agreement signed before a joint development project should therefore state expressly that nothing in it transfers intellectual property or grants a licence. Ownership is then dealt with in the development contract.
Which clauses decide whether the agreement is worth anything?
The definition of confidential information, the permitted purpose, the circle of permitted recipients and the duration decide whether an NDA can be enforced. Vague wording in any of these fails at the moment you need it.
Start with the definition of confidential information. A definition that covers everything covers nothing in practice, because a court asked to enforce it cannot tell what was actually protected. The workable approach names categories and, where possible, requires disclosures to be marked, or confirmed in writing within a short period after an oral disclosure.
The standard exceptions belong here too: information that is already public, that the recipient already lawfully held, that it develops independently, or that it receives from a third party without breach of a duty of confidentiality.
Next comes the permitted purpose. The recipient should be allowed to use the information for one defined purpose and nothing else, because in most cases the real damage is not publication but use.
Then define the circle of permitted recipients: named employees, group companies and professional advisers, each on condition that they are bound by equivalent obligations, with the recipient remaining liable for them.
Duration deserves more thought than it usually gets. An obligation that ends after a fixed term is easy to administer, but it leaves genuine trade secrets unprotected on the day it lapses. An obligation that lasts as long as the information remains secret matches commercial reality, but requires watertight exceptions. Many agreements combine the two: a fixed term for ordinary confidential information and an unlimited term for information that qualifies as a trade secret.
Finally, deal with the end of the relationship: return or destruction of materials, retention of one copy for compliance purposes, and the survival of the confidentiality obligation after termination.
How do penalty clauses in an NDA work?
A contractual penalty (boetebeding) is the most effective enforcement tool in a Dutch NDA, because the claimant does not have to prove and quantify its loss. Between businesses it is enforceable subject to the court’s power to reduce it; with employees, strict statutory conditions apply.
Under Article 6:92 BW, an agreed penalty replaces statutory damages unless the contract provides otherwise. An agreement that intends the penalty to be payable in addition to full compensation must say so expressly.
Under Article 6:94 BW, the court may reduce a penalty if fairness clearly requires it. On the other hand, where a penalty replaces damages, the court may award additional compensation if fairness clearly requires that. Courts use the power to reduce with restraint between commercial parties, but a penalty that bears no relation to any conceivable loss invites it.
What changes if the other party is an employee?
The picture changes completely once the other party is an employee. Article 7:650 BW sets strict conditions for a penalty clause in an employment contract. – The contract must state which rules carry a penalty and the amount of the penalty, and the clause must be agreed in writing. – The contract must state what the penalty money is used for, and that may not be the personal benefit of the employer or anyone acting on its behalf. – Each penalty must be a fixed amount in the currency in which the wage is paid. – The penalties imposed in one week may not exceed half a day’s wage.
A clause that conflicts with these provisions is void. There is one route around part of them. For employees whose wage exceeds the statutory minimum wage, the parties may deviate in writing from the rules on destination, fixed amount and the weekly ceiling. The court can then still reduce an excessive penalty. They may not deviate from the requirement that the contract names the rules and the amount, nor from the requirement of writing.
This is precisely where employer confidentiality clauses fail. A clause with an unspecified penalty, or one that lets the employer keep the money without a written deviation for an employee above the minimum wage, cannot be enforced at all. Our employment lawyers see the consequences regularly, usually after the breach rather than before it.
A penalty clause is not the only remedy. Even without one, breaching an NDA is a failure to perform under Article 6:74 BW and gives rise to damages. Unlawful acquisition, use or disclosure of a trade secret also gives the holder the remedies of the Trade Secrets Protection Act.
What can a confidentiality clause in an employment contract reach?
A confidentiality clause can restrict disclosure during and after employment, but it cannot stop someone from working for a competitor or from reporting wrongdoing. For that you need a valid non-compete clause, and reporting rights cannot be contracted away.
Every employee must behave as a good employee under Article 7:611 BW, and that duty already implies a degree of confidentiality during the employment. It offers little protection after the employment has ended. That is why a separate confidentiality clause, drafted to survive termination, belongs in every contract that involves sensitive information.
A confidentiality clause is not a non-compete clause and should not be used as one. A non-compete clause (concurrentiebeding) is governed by Article 7:653 BW. It must be agreed in writing with an adult employee. In a fixed-term contract it is only valid if the employer explains in writing the compelling business interests that make it necessary.
A confidentiality clause has none of those requirements, because it restricts disclosure rather than employment. Courts notice when a clause labelled confidentiality in fact prevents someone from working in their field, and they treat it accordingly.
The government has proposed modernising the rules on non-compete clauses, with a maximum duration of one year and compensation for the employee when the clause is invoked. In June 2026 the bill was sent to the Council of State for advice, with submission to Parliament planned for the end of 2026. Until it is adopted and enters into force, the current rules apply.
There are limits no clause can cross. Under the Whistleblower Protection Act (Wet bescherming klokkenluiders), a clause that restricts the right to report a suspected wrongdoing is void. A confidentiality obligation also cannot prevent someone from reporting a criminal offence, from giving evidence when required to do so, or from providing information to a supervisory authority that is entitled to it. Nor does it override a statutory duty of the employer to hand over information. An NDA that tries to buy silence about unlawful conduct is not merely unenforceable; it is a liability in itself.
Is an NDA enough when personal data is involved?
No. When the recipient processes personal data on your instructions, the GDPR requires a separate data processing agreement. An NDA does not meet those requirements and cannot be made to.
Confidential information very often contains personal data, and then the General Data Protection Regulation (GDPR) applies alongside the contract. Where the recipient processes personal data on the instructions of the discloser, Article 28 GDPR requires a separate data processing agreement (verwerkersovereenkomst) with a prescribed minimum content. That includes the subject matter and duration, the nature and purpose of the processing, the types of data and categories of data subjects, security measures, rules on sub-processors, assistance with data subject rights and what happens to the data at the end.
The two documents serve different purposes. The NDA protects the commercial interest of the discloser. The processing agreement protects the individuals whose data is involved and allocates responsibility towards the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Where personal data is transferred to a country outside the European Economic Area, the transfer also needs its own legal basis under Chapter V of the GDPR.
Treating one document as covering both is a common and expensive shortcut. Our privacy lawyers deal with the aftermath more often than with the drafting.
How do you enforce an NDA when information leaks?
Secure the evidence first, then ask the interim relief judge for an order to stop the use and disclosure, backed by a penalty payment. Damages and the contractual penalty follow in proceedings on the merits.
Speed matters more than anything else, because the value of a secret disappears the moment it becomes public, and no court order can restore it. The first step is evidence. Secure log files, email traffic, device images and download records before they are overwritten, and record what was disclosed to whom and when.
Dutch procedure offers specific instruments for this. An evidentiary attachment (bewijsbeslag) secures evidence before it disappears. The right to inspect documents, formerly in Article 843a of the Dutch Code of Civil Procedure and since 1 January 2025 part of the general rules of evidence in that code, allows a party with sufficient interest to obtain copies of specified information relating to a legal relationship to which it is a party.
The usual route to a fast order is preliminary relief proceedings before the interim relief judge (kort geding voor de voorzieningenrechter). Typical claims are: – an order to stop the use or disclosure; – an order to return or destroy materials; – an order to name the recipients; – payment of the contractual penalty, on pain of a periodic penalty payment (dwangsom) if the orders are not followed.
The Trade Secrets Protection Act adds measures against goods that infringe a trade secret, including recall from the market and destruction. It also gives the court the power to protect the confidentiality of the secret during the proceedings themselves. That is essential, because litigating about a secret otherwise risks disclosing it.
Damages are claimed in proceedings on the merits. Where the parties agreed a penalty, the claim is simply for the penalty, which is why the clause is worth so much. Where they did not, the claimant must prove its loss, and lost profit from information that a competitor now also has is notoriously hard to quantify.
Serious breaches can also be a criminal offence. The Dutch Criminal Code makes it punishable, among other things, to intentionally disclose a secret one is obliged to keep by virtue of one’s office, profession or a statutory rule, and to intentionally disclose particulars of a business one works or worked for, where one was obliged to keep them secret.
What should you watch for in a cross-border NDA?
Choose the governing law and the competent court deliberately, and be careful with American templates. Concepts that work in the United States often have no effect under Dutch law.
Confidentiality agreements are frequently signed between parties in different countries, and the templates in circulation are usually American. That matters. Concepts such as damages intended to punish the wrongdoer, the US liquidated damages doctrine and injunctive relief as of right do not translate into Dutch law. A clause drafted around them can lose its effect entirely when Dutch law applies.
Under the Rome I Regulation, commercial parties are free to choose the governing law, and the choice should be made deliberately rather than inherited from a template. Add a matching forum clause. Choosing the Dutch courts allows you to go to the interim relief judge quickly, and a judgment given in an EU Member State can be enforced throughout the European Union without further formality. Where the counterparty holds all its assets outside Europe, arbitration is often the more enforceable option.
The practical test for any confidentiality clause is the same: if the information leaked tomorrow, which court could you ask for an order by the end of the week, and could that order be enforced where the recipient actually is?
Which mistakes come up most often?
The most common mistakes are signing too late, a boundless definition, a missing permitted purpose, an invalid employee penalty clause, relying on the contract alone, and a signature by someone without authority. – Signing too late. An NDA agreed after the pitch meeting protects nothing that was said at the meeting, and a recipient who already has the information can rely on the exception for information it lawfully knew before. – The boundless definition, which fails at the moment of enforcement. – The missing permitted purpose, which leaves the recipient free to use the information as long as it keeps it confidential. That is often exactly the harm the discloser feared. – A penalty clause in an employment contract that ignores Article 7:650 BW and is therefore void. – Relying on the agreement alone. The statutory protection of trade secrets requires reasonable technical and organisational measures, so access rights, document classification, exit interviews and recovering devices are part of the legal position, not merely good housekeeping. – A signature by someone without authority to bind the counterparty. Check that in the trade register before the information goes out.
How do you make the agreement work in day-to-day practice?
Know what your secrets are, give access only where it is needed, and have a procedure for departing employees. A signed NDA that nobody applies is evidence of nothing.
Because the statutory protection of trade secrets depends on reasonable measures, the way an organisation actually handles information is part of its legal position. That starts with knowing what the secrets are. Very few businesses can list them. A short inventory of the information whose disclosure would genuinely harm the company, where it is stored and who can reach it, is the basis for every other measure and for any later claim.
Access should follow need. Restrict rights in the file system and the customer relationship management software, use a data room with permissions per document and download logging during a transaction, and mark documents as confidential when they leave the organisation. This produces two benefits at once: fewer leaks, and a documented trail if one occurs. Where a supplier or contractor is involved, pass confidentiality obligations down the chain in writing rather than assuming them.
Departures deserve their own procedure. Withdraw access on the last working day rather than two weeks later, recover laptops, phones and physical files, and remind the departing employee in writing of the obligations that continue after the employment ends.
Where a large volume of data was downloaded shortly before a resignation, act at once. The logs are the evidence, and they are usually overwritten on a fixed cycle. Reviewing the confidentiality position at that moment costs little; reconstructing it after the information has surfaced at a competitor costs a great deal more. The wider commercial framework is set out in our corporate law guides.
Example
A hypothetical example: a Dutch software company shares its pricing model and part of its source code with a potential distribution partner under a mutual NDA. The NDA defines the categories of confidential information, limits use to assessing the partnership, and sets a penalty per breach. The talks fail, and months later the former partner launches a product with a strikingly similar pricing structure.
Because the company marked the documents, used a data room with download logs and signed the NDA before the first meeting, it can show what was shared, when and with whom. It asks the interim relief judge for an order to stop the use and to return the materials, and claims the agreed penalty, without having to prove its exact loss first.
In summary
- An NDA is an ordinary contract under Dutch law, binding without formal requirements; a written agreement is essential to prove what was agreed.
- The Trade Secrets Protection Act only protects information for which you took reasonable steps to keep it secret; an NDA is part of that evidence.
- Define the confidential information, the permitted purpose, the permitted recipients and the duration precisely.
- A penalty clause saves you from proving loss. In an employment contract it must meet Article 7:650 BW, or it is void.
- An NDA cannot stop someone from working for a competitor or from reporting wrongdoing, and it does not replace a data processing agreement.
Frequently asked questions about non-disclosure agreements
Is an NDA legally binding in the Netherlands?
Yes. It is an ordinary contract and requires no particular form, although a written agreement is essential in practice to prove what was agreed. There is no registration requirement and no notarial deed.
How long should a confidentiality obligation last?
For as long as the information has value because it is secret. A fixed term of a few years is common for commercial information exchanged in a transaction. Genuine trade secrets are better protected by an obligation that runs for as long as the information remains secret.
Can the same NDA be used for employees and suppliers?
No. A confidentiality clause in an employment contract is subject to employment law, in particular the rules on penalty clauses in Article 7:650 BW, and it interacts with any non-compete and non-solicitation clauses in the same contract. A supplier NDA is a purely commercial document and should be drafted as one.
What can I do if confidential information has already been disclosed?
Secure the evidence immediately, then consider preliminary relief proceedings for an order to stop the use and disclosure, backed by a periodic penalty payment. Whether the disclosure can still be contained determines everything else, so make that assessment within days.
Does an NDA stop a former employee from working for a competitor?
No. Confidentiality restricts the use and disclosure of information, not the choice of employer. Restricting employment requires a valid non-compete or non-solicitation clause that meets the requirements of Article 7:653 BW.
Advice on non-disclosure agreements
Law & More drafts and reviews confidentiality agreements for businesses in the Netherlands, from a one-page NDA before a first meeting to the confidentiality arrangements around a transaction or a research collaboration, and acts in preliminary relief proceedings when information has been misused. The agreement is worth reviewing before it is needed rather than after. Our contract lawyers can assess the protection of your confidential information. Unsure where you stand? Tell us about your situation. We will let you know your options within one working day.
How Law & More can help you with this is explained on our corporate lawyer page.
