The One-Way NDA: When Your Business Should Choose It Before Sharing Its Secrets

When a one-way agreement is enough instead of a mutual one

The practical rule is simple: ask who will disclose to whom. If confidential information will flow only from your business to the other side, the one-way agreement is the better fit. If both parties will exchange secrets, as in exploring a partnership, a joint venture or negotiating the integration of two services, you need a mutual agreement that protects both sides equally, which is template C-08, covered in our separate guide to the mutual NDA.

These are the most common cases in which your business is the only disclosing party:

• A supplier or service provider you ask for a quotation, so you share specifications, order volumes and your current prices.
• A freelancer or developer who needs access to source code, databases or a test environment to complete a defined task.
• A marketing or design agency that receives the full brief, the launch plan and possibly customer lists before you sign the services contract.
• A prospective investor to whom you present financial statements, the growth plan and the pricing model. Some investors decline to sign at early stages, so in that case limit what you share to what you can accept leaving the room.

If the recipient is your own employee, the route is different, because employee confidentiality is governed by the employment relationship and covered by template E-08, the Employee NDA and IP Assignment, not by a commercial agreement with an outside party.

What you share, and why customer data needs its own clause

The agreement's value lies in timing: sign before you send, not after. A creative brief reveals an unannounced launch plan, a price list exposes your margins to a potential competitor, source code is the product itself, and financial figures reveal your negotiating position. Each of these files loses part of its value the moment it leaves without a written commitment.

Customer data is different, because it is not only your trade secret but the personal data of individuals. The Personal Data Protection Law, issued by Royal Decree M/19 and its amendments, keeps your business responsible for that data even after you hand it to another party. So it is not enough for the agreement to say the data is confidential. It must limit its use to the defined purpose, prohibit passing it to anyone else, and oblige the recipient to return or destroy it on request.

If the other party will process customer data on your behalf on an ongoing basis, such as an agency running your campaigns or a developer hosting your database, a non-disclosure agreement alone is not enough, and you need template I-04, the Data Processing Agreement, alongside it. We do not cite article numbers or penalty amounts from the law here because they are outside what we verified for this guide, and the official text is the reference.

Clause by clause: definition, purpose and who may receive it

The most important clause is the definition of confidential information, because every other obligation is measured against it. A definition that is too broad is hard to defend, and one that is too narrow leaves gaps. Balanced drafting lists the categories you actually share and covers what is disclosed orally or by demonstration, then expressly excludes what cannot fairly be treated as secret.

After the definition come the clauses that govern how the recipient handles the information:

• Permitted purpose: it defines precisely the only permitted use, such as preparing a quotation, carrying out a defined development task or evaluating an investment opportunity, and any use outside it is a breach.
• Who may receive it on the receiving side: access is limited to the employees and advisers who need the information for that purpose, provided they are bound by confidentiality no weaker than the agreement, and the recipient remains liable for any breach by them.
• No copying or reverse engineering: copying is prohibited except as the purpose requires, and so is decompiling code or prototypes to extract how they work.
• No transfer of rights: it states that disclosure grants the recipient no licence or intellectual property right in the information.

Term, survival after the relationship ends, and return or destruction

The agreement needs two separate periods: the disclosure period, during which information is shared, and the confidentiality period, which continues after the relationship ends. A common mistake is letting confidentiality end with the collaboration, so the supplier you did not contract with is free to use your prices the next day. The survival clause therefore states that the confidentiality obligation continues after termination for a period the parties agree, and the obligation for trade secrets and personal data is usually drafted to last for as long as they remain confidential. This guide gives no single standard period, because choosing it is a contractual decision for the lawyer to review according to the type of information.

This is completed by the return or destruction clause, which gives you the right to recover your information at any time, not only when the contract ends. It matters most for customer data, because it lets you show that you regained control of the data once the purpose ended.

Remedies and governing law in Saudi Arabia

An agreement that does not say what happens on breach remains a moral promise. The remedies clause therefore sets out your right to claim compensation for damage caused by unauthorised disclosure or use, and your right to seek an immediate stop to the breach without waiting for the damage to be quantified. Some businesses set an agreed compensation amount in advance, which is an option that needs a licensed lawyer's review to judge the amount and its drafting, and we suggest no amount here.

• Governing law: it states expressly that the agreement is governed by the laws in force in the Kingdom of Saudi Arabia, which matters especially with a freelancer, agency or investor outside the Kingdom.
• Dispute forum: it names the competent Saudi courts, or arbitration if you agree on it, so that a dispute does not turn into an argument about where to litigate.
• Prevailing language: in a bilingual agreement it states that the Arabic text prevails in case of any difference.
• No obligation to contract: it clarifies that signing the agreement does not oblige either party to enter into any later deal, so the decision to contract with the supplier or investor remains free.

Practical steps before you send the first file

1. Set the direction of flow: if only you will disclose, choose the one-way agreement C-09, and if the exchange runs both ways, choose the mutual agreement C-08.
2. Write the purpose in one clear sentence, because it is the line against which you will measure any later use.
3. Classify what you will share, and if it includes customer data, reduce it to the minimum needed and add the Data Processing Agreement I-04 if processing will continue.
4. Fill in the template and sign it with the person authorised to sign on the other side before sending anything.
5. Mark the files as confidential, keep a record of what you sent and when, then request return or destruction when the purpose ends.

Template C-09 is a certified draft and a strong starting point, but it does not replace legal advice on an existing dispute, and the Arabic text prevails.

Frequently asked questions