NDA Duration: How Long Should Confidentiality Last?

Standard NDA Duration: What's Normal

Most commercial NDAs have a term of 2 to 5 years for general business information. This doesn't mean the information stops being confidential after 5 years — it means your legal obligation to actively protect it expires, and the information can be used or disclosed without penalty.

The 2-5 year range isn't arbitrary. It reflects a balance: the Disclosing Party gets a meaningful period of protection during which the information has commercial value, and the Receiving Party isn't burdened with indefinite obligations for information that eventually becomes stale. After 5 years, most business information — pricing models, marketing strategies, quarterly projections — has lost its competitive sensitivity anyway.

Some NDAs use a fixed calendar date instead of a number of years ('until December 31, 2031'). This is functionally the same as a term of years — just expressed differently. Make sure the date is reasonable and isn't so far out that it's effectively perpetual.

Trade Secrets: When Perpetual Protection Applies

Trade secrets are the exception to the 2-5 year rule. Because trade secret protection exists as long as the information remains secret (the Coca-Cola formula has been protected for over 130 years), many NDAs specify that trade secret information is protected indefinitely — or 'for so long as such information remains a trade secret under applicable law.'

This is standard and generally acceptable. The key is the NDA must distinguish between trade secrets and general confidential information. A clause that says 'all Confidential Information shall be protected in perpetuity' is a red flag — it imposes lifelong obligations for non-trade-secret information like meeting notes, draft proposals, and routine financial data.

If you're the Receiving Party, push for language like: 'The obligations of confidentiality shall survive for [3-5] years from the date of disclosure, except that trade secrets shall be protected for so long as they remain trade secrets under applicable law.' This protects the Disclosing Party's legitimate interests without overreaching.

Duration by Industry

Industry norms vary significantly. Here's what's typical:

• Technology and software: 2-3 years. Technology moves fast — a 5-year-old codebase or architecture is rarely still competitively sensitive.
• Pharma and biotech: 7-15 years. Drug development takes a decade or more. Clinical trial data and regulatory strategies retain value far longer than typical business information.
• Manufacturing and engineering: 5-7 years. Manufacturing processes and engineering specs evolve slowly, and the investment in developing them justifies longer protection.
• Financial services: 3-5 years. Trading algorithms age quickly, but client data and risk models have longer shelf lives.
• Media and entertainment: 2-3 years. Most unreleased content loses commercial sensitivity shortly after release.
• Employment NDAs: Often indefinite for trade secrets, 2-3 years for general confidential information post-employment.

Duration Red Flags to Watch For

When reviewing the duration clause, these are the warning signs:

• Perpetual obligations for all information, not just trade secrets — unreasonable and often unenforceable.
• No distinction between trade secrets and general confidential information — you're agreeing to indefinite protection for everything.
• Duration that doesn't start running from a clear date — 'from the date of disclosure' for each piece of information means you need to track disclosure dates for potentially hundreds of documents, each with its own expiry date.
• Automatic renewal — 'the term shall automatically renew for successive one-year periods unless terminated in writing.' You could be locked in forever if you forget to send the termination notice.
• Survival period that extends beyond the agreement term — if the NDA itself lasts 3 years but confidentiality survives for 10 years, you have obligations for a decade after the relationship ends.

How to Negotiate NDA Duration

Duration is one of the most commonly negotiated NDA terms. Here's how to approach it:

• Start with the industry standard — you'll get more traction saying 'the standard for software NDAs is 3 years' than 'I don't like 7 years.'
• Distinguish trade secrets from general information — concede perpetual protection for trade secrets in exchange for a 3-5 year cap on everything else. This is a reasonable compromise.
• Propose a single expiration date — instead of per-disclosure tracking, suggest 'obligations expire on [date 3-5 years from signing] for all information disclosed under this Agreement.' Easier to manage.
• If they insist on a long term, ask for a narrower [confidential information definition](/blog/nda-confidential-information) — fewer categories covered in exchange for a longer protection period.
• Check for [red flags](/blog/nda-red-flags-to-watch-for) in related clauses — a perpetual duration combined with liquidated damages is especially dangerous.

For extra confidence, run the full NDA through ContractRev's AI checker. It analyzes the duration clause in context with the rest of the agreement and flags unreasonable terms.