NDA Breach Remedies in India: Damages, Injunctions and Proof

A former employee uploads a pricing workbook to a personal cloud drive three days before resigning. The company discovers it six weeks later when a customer mentions a discount that only that workbook could have revealed. The NDA is signed and clear. The question now is not whether there was a breach but what the company can actually do about it — and how quickly. Every day that passes makes the information harder to retrieve and the loss harder to prove.

Remedies for NDA breach in India are often described as if a signed agreement automatically produces an injunction. It does not. The court or tribunal asks specific questions: is the information genuinely confidential, was it defined, did the recipient have access, is there a credible threat of further use, and can the loss be measured? This guide sets out the remedies available, the tests applied, the limitation clock, and the practical steps that determine whether a claim succeeds or collapses in the first week.

What counts as an NDA breach

Breach is not limited to handing a document to a competitor. The obligation typically has several limbs, and failing any one of them is a breach: disclosing information to an unauthorised person, using it for a purpose outside the agreement, failing to protect it with reasonable security, failing to return or delete it on termination, or failing to notify the discloser of a compelled disclosure or a security incident. A recipient who leaves a shared drive open to the public has breached a security obligation even if no one downloaded anything.

Three elements must be established. First, the information must fall within the contractual definition. Second, the recipient must have received it or had access to it. Third, the recipient's conduct must fall outside what the agreement permits. In practice the second element is often the contested one — recipients argue they never received the specific document, or that the information came from another source.

There is also breach of confidence outside contract, recognised in Indian law as an equitable action. It can apply where no NDA exists but information was shared in circumstances importing an obligation of confidence. The elements are that the information has the necessary quality of confidence, was imparted in circumstances importing an obligation, and was used in an unauthorised way. This route is useful when the NDA is unsigned or missing, but it is harder to prove and offers narrower remedies.

Injunctions: the primary remedy in most NDA disputes

An injunction restrains the recipient from further disclosing or using the information. It is the remedy most disclosers actually want, because damages rarely compensate for a trade secret that has already been published. Indian courts derive the power to grant injunctions from the Specific Relief Act, 1963 and, in pending suits, from the Code of Civil Procedure, 1908.

Interim and ex parte relief

An interim injunction under Order 39 of the CPC is granted while the suit is pending, to preserve the status quo. The applicant must show a prima facie case, that irreparable injury will occur if relief is refused, and that the balance of convenience favours the grant. In confidentiality disputes, the irreparable injury argument is usually strong because once information is disclosed it cannot be undisclosed.

Where there is a genuine risk that the recipient will destroy evidence or publish immediately, an ex parte application can be made without notice to the other side. Courts grant this sparingly and require full and frank disclosure from the applicant. An ex parte order obtained on incomplete facts is vulnerable to being set aside, and the fallout can damage the credibility of the main claim.

Relief is usually framed narrowly: restraining disclosure to named parties, restraining use for a defined commercial purpose, requiring delivery up of documents and devices, and requiring preservation of records. Courts are reluctant to grant orders that amount to a blanket restraint on carrying on business, because that edges into the restraint of trade problem under Section 27 of the Indian Contract Act, 1872.

Permanent injunction and the trial

A permanent injunction is granted at the end of the trial, once the court is satisfied that the obligation exists and has been breached or is threatened. In confidentiality cases, the trial often turns on documentary evidence: the signed NDA, the record of what was disclosed, access logs, forensic reports and witness testimony. The discloser who kept poor records will struggle, even with a strong agreement.

Section 14 of the Specific Relief Act lists contracts that cannot be specifically enforced, including contracts for personal service. That does not prevent an injunction restraining breach of a negative obligation such as confidentiality; it prevents an order compelling someone to continue working. The distinction matters when an employer seeks to restrain a departing employee — the court will not force the person to stay, but it can restrain misuse of information.

Damages and liquidated sums under the Contract Act

Section 73 of the Indian Contract Act, 1872 allows the injured party to recover compensation for loss caused by the breach, provided the loss naturally arose in the usual course of things or was in the contemplation of the parties when they contracted. Section 74 addresses liquidated damages: where a sum is named in the contract as payable on breach, the court may award reasonable compensation not exceeding that sum. Indian courts treat a genuine pre-estimate of loss differently from a penalty, and a wildly disproportionate figure may be reduced.

Proving loss from an NDA breach is the hard part. The discloser must connect the breach to a measurable harm: a lost contract, a price erosion, a customer who moved to a competitor, the cost of redeveloping a leaked process. Vague assertions that the information was "valuable" are not enough. Practical evidence includes lost tender documents, customer communications showing the competitor's knowledge, forensic reports on data exfiltration, and expert evidence on the value of the trade secret.

Where loss cannot be quantified, the discloser may still recover nominal damages, and may seek an account of profits where the recipient made money from the misuse. An account of profits requires the discloser to establish that the recipient benefited from the information, which is often easier in cases where the recipient launched a competing product shortly after receiving the material.

Legal costs are a separate question. Indian courts have discretion over costs and do not routinely award full indemnity costs. A contractual clause requiring the breaching party to indemnify the discloser for costs of enforcement can improve the position, though courts retain discretion over whether to enforce it.

Other remedies that are often overlooked

Delivery up is an order requiring the recipient to hand over or destroy documents, devices and copies. It is often sought alongside an injunction and is particularly useful where the information is contained in physical files or on devices that can be identified.

Beyond the injunction and the damages claim, the discloser should consider the following, each of which addresses a different part of the problem:

• Delivery up — an order requiring the recipient to hand over or destroy documents, devices and copies.
• Account of profits — recovery of the money the recipient made from the misuse, where that can be traced.
• Declaration — a judicial finding that the information is confidential and that the recipient is in breach.
• Contractual termination — ending the underlying commercial agreement for cause, where the agreement allows it.
• Criminal complaint — only where the conduct also falls within a specific offence such as unauthorised access under the Information Technology Act, 2000.
• Costs and indemnity — recovery of enforcement costs where the NDA contains an indemnity or the court awards costs.

A declaration that the information is confidential and that the recipient is in breach can be useful in a commercial dispute where the discloser needs a judicial finding to show customers or investors. It does not produce money but it can repair reputational damage.

Where the breach involves unauthorised access to computer systems after authorisation has been withdrawn, the Information Technology Act, 2000 contains provisions on unauthorised access and data theft that can support a criminal complaint. These provisions are narrow and should not be treated as a substitute for civil action, but they can be relevant where an employee or contractor continues to access systems after termination.

Termination of the underlying commercial agreement is another lever. If a vendor breaches confidentiality, the master agreement may allow termination for cause, which is often more valuable than damages. The NDA should be read together with the commercial agreement to see what remedies that document provides.

Arbitration or court: where to bring the claim

Most well-drafted NDAs include an arbitration clause. The Arbitration and Conciliation Act, 1996 governs the process and allows interim relief from the tribunal or, before the tribunal is constituted, from a court under Section 9. Arbitration is usually faster and more private than litigation, which matters when the dispute involves commercially sensitive information that would otherwise become part of the public record.

Court litigation is preferable where the discloser needs urgent ex parte relief and the arbitration clause does not provide a fast route to a tribunal, or where the dispute involves multiple parties who are not all bound by the arbitration agreement. Indian courts have been willing to grant interim protection in aid of arbitration, but the procedural steps add time.

The choice should be made at drafting stage, not after the breach. An NDA that leaves dispute resolution silent forces the parties into a jurisdictional argument before they reach the merits. If arbitration is chosen, the seat, the number of arbitrators and the appointing authority should all be specified.

Limitation: how long you have to act

The Limitation Act, 1963 prescribes three years for a suit founded on a contract, running from the date the breach occurs or from the date the breach becomes known to the plaintiff where the breach is concealed. For a continuing breach — an ongoing failure to return documents, or continuing use of information — the clock may run from each act, which can extend the window. This is a general position and depends on how the claim is framed.

Interim relief is not governed by the limitation clock in the same way, but delay is fatal in practice. A court asked for an urgent injunction six months after the breach will ask why the applicant waited. The answer needs to be documented — the date of discovery, the investigation, the forensic report — because an unexplained gap suggests the information was not actually valuable or the breach was tolerated.

Arbitration is also subject to limitation; the Limitation Act applies to arbitral proceedings. A claim filed after three years may be met with a limitation defence at the outset.

Remedies compared

Evidence: what you need before you file

Confidentiality cases are won or lost on records. Before filing, assemble the signed NDA and any amendments, the schedule listing what was disclosed, the actual documents or data sets shared and the date they were shared, access logs from systems, the employee's or vendor's acknowledgments of policy, and any communications suggesting misuse. If the breach involves digital exfiltration, a forensic report identifying what was copied, when and to where is far more persuasive than an assertion.

Preservation is urgent. Send a written notice to the recipient requiring preservation of all documents, devices, backups and communications relating to the information. This creates a record and puts the recipient on notice; destruction after notice strengthens the inference of bad faith. Internally, preserve email, chat and system logs before routine retention policies delete them.

Witness evidence matters where the disclosure was oral. The person who attended the meeting should record what was said and when. Contemporaneous notes are far stronger than reconstruction months later.

Mistakes that sink NDA claims

The first is an undefined or overbroad definition. If the agreement covers "all information" without specificity, the recipient argues that nothing was identifiable as confidential, and the court may agree that the obligation is too vague to enforce.

The second is failing to prove access. The discloser assumes the recipient saw the document because it was in a shared folder. Without access logs or an acknowledgment of receipt, the link is circumstantial.

The third is waiting. Delay undermines the irreparable harm argument and gives the recipient time to sanitise devices.

The fourth is claiming a loss that cannot be connected to the breach. A general drop in revenue after a leak is not proof that the leak caused it. The claim needs a specific commercial consequence.

The fifth is ignoring the arbitration clause and filing in court, or filing in the wrong forum. This can add months of procedural argument.

The sixth is failing to stamp the agreement. An unstamped NDA may be inadmissible until deficit duty and penalty are paid, which is a poor position when seeking urgent relief.

Frequently asked questions

Can I get an injunction without proving actual loss?

Yes. An injunction restrains breach and does not require proof of quantified loss. You need to show a prima facie case, that the information is confidential, that the recipient had access, and that there is a credible risk of further disclosure or use. Irreparable injury is the key argument, and it is usually easier to establish for trade secrets than for ordinary commercial information.

What is the limitation period for an NDA breach claim?

Typically three years from the date of breach or from the date the breach became known, under the Limitation Act, 1963. Continuing breaches may extend the window because each act of misuse can be a fresh breach. Treat three years as the outer limit and act much sooner if interim relief is needed.

Are liquidated damages enforceable in India?

Section 74 of the Indian Contract Act, 1872 allows the court to award reasonable compensation not exceeding the sum named in the contract. A genuine pre-estimate is more likely to be upheld; a figure that looks like a penalty may be reduced. The claimant still has to prove the breach, though not necessarily the exact loss where a sum is named.

Can an NDA breach be a criminal offence?

Breach of a confidentiality contract is a civil wrong. Criminal liability arises only where the conduct also falls within a specific offence — for example, unauthorised access to a computer system under the Information Technology Act, 2000, or theft of data where the elements of a criminal offence are met. A criminal complaint is not a substitute for a civil claim and should be pursued only on legal advice.

What should I do in the first 48 hours after discovering a breach?

Preserve evidence before anything else — system logs, emails, device records. Send a written preservation and cease-and-desist notice to the recipient. Identify precisely what information was taken and who has seen it. Instruct counsel on whether to seek interim relief and in which forum. Do not confront the recipient informally in a way that gives them time to delete material.

Drafting Support

Our drafting team prepares NDAs with remedies clauses, dispute resolution provisions and evidence-friendly schedules that make enforcement practical rather than theoretical. If a breach has already occurred, we can review the agreement and the facts to advise on the forum and the relief worth pursuing.