NDA & Confidentiality Guidelines

I regularly work with commercially sensitive software, electronics, product designs, technical documentation, source code, prototypes, and business information.

I am therefore happy to sign a reasonable Non-Disclosure Agreement (NDA) where confidentiality is required.

An NDA should protect genuinely confidential information while still allowing me to operate as an independent engineering business. It should not transfer intellectual property, restrict unrelated future work, or introduce disproportionate commercial liabilities.

The following guidelines explain the terms I will generally accept and the types of provisions I will not agree to.

These guidelines describe my normal commercial position rather than an exhaustive set of contractual terms. Individual agreements will be considered on their merits.

Confidentiality is not a problem

Protecting client information is a normal part of engineering work.

The aim of these guidelines is not to avoid confidentiality obligations. It is to keep those obligations proportionate and clearly separated from questions such as intellectual property ownership, exclusivity, liability, and project delivery.

Intellectual property must remain separate

An NDA is a confidentiality agreement, not an intellectual property assignment.

I will not sign NDA provisions that transfer ownership of intellectual property simply because it is discussed, created, suggested, or encountered during preliminary discussions.

Ownership of work produced for a project should instead be defined in the relevant quotation, Statement of Work, development agreement, or other commercial contract.

In particular, I retain ownership of my pre-existing and independently developed technology, tools, methods, libraries, designs, processes, documentation, and engineering know-how.

Client-specific intellectual property and project deliverables can of course be addressed separately as part of the commercial agreement.

General engineering knowledge cannot be restricted

Engineering projects inevitably contribute to an engineer's experience.

I will not agree to terms that prevent the use of general skills, experience, techniques, or knowledge gained through normal engineering work.

Confidential client information will remain confidential, but an NDA cannot prevent me from continuing to use general engineering principles or experience on other projects.

For example, working on a project involving RS485, embedded firmware, a particular microcontroller family, database architecture, industrial communications, or PCB protection circuitry cannot prevent me from subsequently working with those technologies elsewhere.

Independent development must remain possible

An NDA must recognise that similar ideas, systems, software, circuits, or solutions can be developed independently.

I will not accept an agreement that automatically treats independently developed work as belonging to, or having been derived from, another organisation simply because there are technical similarities.

Required and protected disclosures

An NDA must not prevent disclosures that I am legally entitled or required to make.

This includes disclosures required by law, court order, or a competent regulatory or governmental authority, as well as disclosures that cannot lawfully be restricted by an NDA.

Where legally permitted and reasonably practicable, I will notify the other party before making a legally required disclosure and limit it to the information reasonably necessary. No advance notice is required for protected whistleblowing disclosures or reports of suspected crime to law enforcement or another competent authority.

No non-compete restrictions

I work across software development, embedded systems, electronics, automation, prototyping, and related engineering fields.

The NDA may restrict the use or disclosure of a client's confidential information. It may not restrict me from operating normally as an engineering business.

Any genuine requirement for exclusivity would need to be negotiated separately as a commercial arrangement.

Proportionate liability limits and exceptions

I normally seek a proportionate financial cap for ordinary business confidentiality claims. My Mutual NDA retains a standalone £25,000 cap for each business party per claim or related confidentiality incident. Unrelated incidents have separate limits.

The cap and business loss exclusions have express exceptions. These include fraud, death or personal injury caused by negligence, the knowing deliberate misuse or disclosure described in clause 11.1, and liabilities that cannot lawfully be limited. Where you are a consumer, the £25,000 cap limits only your liability; it does not cap my liability to you or your consumer remedies.

For business customers, indirect or consequential losses are excluded subject to those exceptions. Direct losses can still be recoverable, including lost profit, revenue or business opportunity. A claim remains subject to the applicable cap, causation, foreseeability, proof of loss and reasonable steps to reduce the loss.

Court-awarded legal costs are outside the financial cap, and either party may ask a court for an injunction to prevent or stop a breach. Higher applicable service protection and consumer rights are preserved. The same loss cannot be recovered twice.

For business services, the default limit is £250,000 in aggregate for all ordinary claims in a defined Engagement. Related briefs, phases, restarts and invoices do not reset it; genuinely separate projects are not pooled. Hourly and fixed-price agreements share that total only through express booking identification and adoption.

If the accepted Work Brief or SOW identifies the NDA and expressly adopts its clause 15 coordination for that Engagement, ordinary loss covered by both agreements uses the one applicable service aggregate. The NDA does not add another £25,000 after it is used, or reduce the higher service protection. NDA-only preliminary losses retain the standalone rule. Clause 11.1 uncapped exceptions, consumer rights, refunds and court costs remain preserved; older or higher agreed protection is not silently changed.

I will not accept automatic financial penalties or fixed payments simply because an alleged breach has occurred. Particularly sensitive information, unusual risks, higher limits or additional precautions should be discussed and agreed in writing before disclosure. Any cap remains subject to applicable legal fairness and reasonableness requirements.

No broad indemnities

An NDA should establish confidentiality obligations and the normal remedies available if those obligations are breached.

I will not normally accept clauses requiring broad or unlimited indemnification for any loss claimed to have arisen directly or indirectly from a confidentiality breach.

Where a project genuinely creates unusual commercial risk, that risk should be discussed openly and addressed within the main contract.

Confidential information should be reasonably identifiable

An NDA does not necessarily need every document to be marked "CONFIDENTIAL".

However, the definition of confidential information must be reasonable.

I will push back on provisions attempting to classify every piece of information exchanged between the parties as confidential indefinitely regardless of its nature.

Confidentiality periods should be proportionate

Different information has different useful lifetimes.

Ordinary project, commercial, and technical information should normally have a defined confidentiality period.

Genuine trade secrets may reasonably remain protected for as long as they continue to be genuinely confidential.

I will generally not accept an indefinite confidentiality obligation covering every piece of information exchanged during a project.

Reasonable security requirements

I take reasonable measures to protect client information.

I am happy to agree to proportionate technical and organisational security requirements appropriate to the work being undertaken.

However, an NDA should not introduce unrelated enterprise-level compliance obligations.

If a project operates within a specific regulatory or security environment, those requirements should be identified during project scoping and incorporated into the commercial agreement.

An NDA does not replace a legally required data-processing agreement. I agree the relevant roles, authorised providers and required processing terms before processing personal data on your behalf. Restrictions on general contractual audits do not remove legally required information, audit or inspection duties, or regulator and court powers.

Reasonable disclosure to people supporting the project

I must be able to operate normally as a business.

An NDA should therefore allow confidential information to be disclosed where reasonably necessary to employees, subcontractors, professional advisers, insurers, or service providers who need the information to support the work and who are themselves subject to appropriate confidentiality obligations.

These restrictions also apply to cloud services and AI tools. Necessary access does not authorise general model training, advertising or unrelated provider product development using confidential information. Those uses require separate express written permission. Required data-processing authorisation and safeguards still apply.

I notify you without undue delay of material unauthorised access, use or disclosure of your confidential information held by me or a provider I permitted to access it, subject to legal restrictions and privilege.

An NDA that prevents all disclosure under all circumstances may make normal project delivery impossible.

Practical data deletion

I can return or securely delete client information when it is no longer reasonably needed. My Mutual NDA requires action without undue delay, normally within 30 days of a reasonable written request or when the information is no longer needed for the agreed purpose, subject to its retention exceptions and any shorter period required by law. A reasonably necessary alternative timetable must be agreed in writing.

An email archive, accounting record or business record still needs one of those reasons. The label alone does not justify retention.

Retained copies are restricted to people who need access for that reason, used only for that purpose and deleted when the reason ends. Backup copies may expire through the normal retention cycle. Any retained copies remain subject to the applicable confidentiality obligations.

No ownership of suggestions or casual discussions

Technical discussions frequently involve suggestions, observations, alternatives, and possible improvements.

I will not accept NDA wording under which every suggestion, idea, improvement, recommendation, or piece of feedback automatically becomes the intellectual property of the other party.

Where I am specifically engaged to develop intellectual property for a client, ownership will be dealt with explicitly within the project agreement.

No hidden acceptance of other policies

I will not normally sign an NDA that automatically incorporates unspecified company policies, contractual terms, security standards, purchasing rules, or future amendments simply by reference.

If another document creates contractual obligations for me, I need to be able to review that document before agreeing to it.

Governing law and jurisdiction

As a Northern Ireland based business, I normally expect agreements to be governed by the laws of Northern Ireland and subject to the jurisdiction of the courts of Northern Ireland.

I will consider alternative arrangements where there is a reasonable commercial justification, but I may push back on requirements that would require a relatively small engineering engagement to be litigated or arbitrated in a distant or disproportionately expensive jurisdiction.

Mutual NDAs

Where both parties expect to disclose confidential information, I generally prefer a mutual NDA.

This keeps the arrangement straightforward: each party protects the other's confidential information under broadly equivalent obligations.

A one-way NDA may still be appropriate where only one party will genuinely be disclosing confidential information.

Existing projects and technology

I actively develop my own software, electronics, prototype boards, development tools, documentation, research projects, and reusable engineering assets.

Signing an NDA cannot retrospectively give another organisation rights over work that I was already developing or independently develop in the future.

Where there is any possibility of overlap between a client's project and my existing technology, the distinction between background intellectual property and project-specific deliverables should be documented before development begins.

Keep the NDA about confidentiality

The basic principle is simple:

An NDA should protect confidential information. It should not quietly become an IP assignment, non-compete agreement, exclusivity agreement, security contract, or a source of disproportionate financial obligations.

I am happy to work under sensible confidentiality arrangements and am equally happy to review a client's standard NDA before discussing sensitive project information.

Where an NDA contains provisions outside these guidelines, that does not necessarily prevent Protoworks and you from working together. It simply means those provisions will need to be discussed and, where appropriate, amended before the agreement is signed.