How does your business protect its trade secrets with a mutual NDA, and what would the draft Trade Secrets Law change?

What counts as a trade secret, in plain terms

In practical terms, a trade secret is information about your business that people in the market do not generally know, that has value because it is not known, and that your business treats as confidential. It does not have to be a complex invention: many of the most valuable secrets in small businesses are simple day-to-day information that gives you an edge over competitors. The question to ask about each piece of information is this: if it reached a competitor tomorrow, would you lose something? If the answer is yes, it is a candidate for a secret worth protecting.

• Pricing: profit margins, discount tables, the method used to build quotations, and special prices for key customers.
• Customer lists: contact names, purchase histories, each customer's preferences, and their contract renewal dates.
• Supplier terms: preferential prices, payment terms, volumes, and any exclusivity won through negotiation.
• Formulas and recipes: the ingredients of a food or cosmetic product, an industrial mix, or a proprietary manufacturing method.
• Source code: the software of your platform or app, its algorithms, and the design of its databases.
• Business plans: expansion plans, products in development, feasibility studies, and deals before they are announced.

On the other hand, information does not become a secret merely because you call it one. What is published on your website, known across the sector, or easily worked out by anyone from your product on the market is hard to treat as a trade secret. Protection therefore starts with a written list in which your business identifies its actual secrets, instead of assuming that every internal paper is confidential.

The checklist: the reasonable measures that prove you protected your secrets

In any dispute about leaked information, it will not be enough to say it was confidential. You will need to show that you treated it that way before the leak: who had access to it, on what terms, and what you did when the relationship ended. This is the idea of reasonable measures. They are not expensive security systems, but organised steps that fit the size of your business and leave a written trail. Follow these steps in order:

1. Prepare an internal register of the business's secrets: what they are, where they are kept, and who is responsible for each.
2. Sign an NDA before any outside disclosure, whether to a potential partner, a supplier, an investor or a technology provider, and not after the first meeting.
3. Mark documents, files and presentations that contain secrets as "Confidential", and state in the agreement that oral information is treated the same way once it is confirmed in writing.
4. Limit access on a need-to-know basis: separate system permissions, protected folders, and passwords that teams do not share.
5. Include the confidentiality clause in the contract of every employee who has access to this information, and remind them of it in writing whenever a sensitive file is handed over.
6. Carry out the return or destruction step when any relationship ends: recover documents and devices, request a written confirmation that copies were destroyed, and keep that confirmation on file.
7. Review the register and the agreements at least once a year, adding new secrets and removing what has become public.

Each of these steps produces evidence: an agreement signed on a date before disclosure, a document carrying a confidentiality mark, an access log, and a destruction confirmation. Together, this evidence is what turns your claim that information was secret into a fact you can prove.

What the mutual NDA states, section by section

The mutual NDA fits any relationship in which both sides exchange sensitive information: partnership negotiations, a joint venture, a technical integration between two platforms, or an acquisition study. Its strength lies in the clarity of its sections, not in its length. These are the sections you should find in any mutual NDA your business signs:

• Definition of confidential information and its exclusions: a definition covering written, oral and digital information, excluding what is public, already held by the recipient before disclosure, received from a lawful source, independently developed, or required to be disclosed by order of a competent authority.
• Permitted purpose: a specific description of the purpose for which the information may be used, such as evaluating a named partnership, and a ban on any use beyond it.
• Recipients and need to know: which employees and advisers may be given access, provided they genuinely need it and are bound by confidentiality no weaker than the agreement, with each party answerable for their breaches.
• Term and survival: the term of the agreement and how long the confidentiality duty survives after it ends, with the option for the duty to continue for as long as the information remains a trade secret.
• Return or destruction: a duty to return or destroy the information on request or once the purpose ends, with a written confirmation.
• Remedies and governing law: the injured party's right to seek an order stopping the breach and compensation for its loss, with the agreement governed by the laws of the Kingdom of Saudi Arabia and the competent judicial authority there.

A good agreement is no substitute for practice: if you sign it and then send the full price file, with no confidentiality mark, to a general email address at the other party, you have weakened with your own hands the evidence the agreement created. Make every disclosure specific, tied to the purpose, and documented.

When the one-way form fits instead

If information will flow in one direction only, the one-way NDA is clearer and easier to negotiate. Examples are a business sharing its product specifications with a factory to price production, presenting its plan to an investor, or handing its sales data to a marketing agency, without receiving comparable secrets in return. In these cases the obligations fall on the recipient alone, and there is less room for debate over clauses no one needs.

If, however, both sides are likely to exchange sensitive information, even later on, the mutual form is safer from the start, because the other party will usually ask for the same protection when its turn to disclose comes. For a fuller comparison of the two forms, see our guide on the one-way NDA and its template C-09.

How the employee confidentiality clause complements the NDA

Most leaks do not come from an outside partner but from an employee who leaves with the customer file. The Labor Law already requires the worker to keep the technical, trade and industrial secrets of the products they make or helped to make, and all professional secrets relating to the work or the establishment whose disclosure would harm the employer's interests. The Law also makes proven disclosure by the worker of the industrial or trade secrets of their work one of the cases in which the employer may terminate the contract without award, notice or compensation, provided the worker is given the opportunity to state their objections.

But the general statutory duty does not define what your business considers secret, what happens after employment ends, or how files and devices are recovered. This is where the Employee NDA and IP Assignment comes in: it identifies the secrets, extends the duty beyond the end of the relationship, organises return and destruction, and transfers to the business ownership of what the employee develops in their work.

The draft Trade Secrets Law: what it proposes and what to do now

The Saudi Authority for Intellectual Property has published a draft Trade Secrets Law on the Istitlaa platform, run by the Saudi Center for Competitiveness and Business, and opened it to public comment. According to what the draft's page shows, it is a standalone law whose provisions deal with the definition of trade secrets, the owner's rights, exceptions, civil compensation for infringement, penalties, and measures to protect secrets while cases are heard in court. In essence, the idea is to move trade secret protection into a clearer standalone statutory framework, and to extend protection to secrets that are presented in the court proceedings themselves.

Remember three things. First, this is a draft for comment, not a law in force, and its provisions may change before it is issued, or it may not be issued in its current form. Second, we do not reproduce the draft's text or its article numbers, periods or penalties here, so go to its official page on Istitlaa to read it and comment before the closing date shown there. Third, Sighaty does not represent the Authority or the platform, and this guide is our own independent explanation.

What this means in practice for your business: any modern trade secret law rewards the business that can prove it identified its secrets and protected them with serious measures. So the seven steps in the checklist above are not just preparation for a coming law; they are what protects your secrets today under contracts and the existing Labor Law duties. Start with the internal register, sign the mutual NDA before your next meeting, review your employees' contracts, then follow the draft's progress. We will update this guide and the related templates when any final text is issued.

Frequently asked questions