NDA for Employees in India: Clauses That Actually Hold Up

A sales manager resigns on a Friday, copies the CRM export to a personal drive over the weekend, and joins a competitor the following month. The company's employee NDA is a two-page template downloaded in 2019. It prohibits "disclosing any confidential information" but never defines what that means, has no clause requiring return of data, and imposes a two-year non-compete that the company's own lawyer privately doubts is enforceable. When the company tries to act, it discovers the agreement protects almost nothing that matters.

Employee confidentiality agreements in India are signed in enormous volume and read almost never. Most are copied from a foreign template, layered with restrictions that Indian courts will not enforce, and stripped of the few clauses that would actually help. The result is a document that creates a false sense of security for the employer and, for the employee, a set of obligations whose scope is genuinely unclear. This guide sets out what an NDA for employees in India should contain, which clauses tend to hold when tested, and how to avoid the drafting errors that make the agreement worthless at the moment it is needed.

What an employee NDA is meant to do

An employment NDA is a unilateral confidentiality agreement. The employer discloses business information to the employee so the employee can do the job; the employee undertakes not to misuse or disclose it. Unlike a commercial NDA between two businesses, the flow of information is structurally one-directional — the employer is not receiving trade secrets from the employee in any meaningful sense — so the document should be drafted as a one-way obligation rather than a mutual one.

The agreement has three practical jobs. First, it defines what the employee may not take or share, in terms specific enough to be enforced. Second, it establishes the employer's ownership of work product, usually through a separate IP assignment clause or a combined confidentiality and IP clause. Third, it creates a paper trail that supports an injunction or a damages claim if the employee leaves and the information surfaces elsewhere.

What it cannot do is prevent competition. Indian law treats restraints on trade with considerable hostility, and an NDA that tries to function as a non-compete usually fails at the confidentiality part as well, because courts read the whole document and react badly to overreach.

The statutory backdrop Indian employers need to know

Three statutes do most of the work. The Indian Contract Act, 1872 governs whether the agreement is a valid contract at all. Section 27 of that Act voids "every agreement by which any one is restrained from exercising a lawful profession, trade or business of any kind". The section has a narrow exception for the sale of goodwill of a business, which does not help an employer. Indian courts have generally read Section 27 strictly, and post-employment non-compete clauses have usually been held void, while confidentiality obligations limited to protecting proprietary information have been treated as outside its scope because they restrain misuse of information rather than the freedom to trade.

The second statute is the Specific Relief Act, 1963. Section 14 lists contracts that cannot be specifically enforced, and personal service contracts fall within that list. An employer cannot obtain an order forcing an employee to keep working. What the employer can seek is an injunction restraining breach of a negative obligation — typically an order not to disclose or use confidential information — and courts have granted such relief where the obligation is clear and the information is genuinely confidential.

The third layer is the law on trade secrets and data. India has no standalone trade secrets statute; protection comes through contract, breach of confidence, and to some extent the law of unfair competition. Where personal data is involved — customer databases, employee records, health information — the Digital Personal Data Protection Act, 2023 imposes separate obligations on the employer as a data fiduciary. An NDA should not be written as though the DPDP Act does not exist, because an employee handling personal data is handling material the employer has statutory duties over.

For certain regulated sectors there are additional overlays. Employees of banks, insurers and intermediaries are subject to sectoral confidentiality requirements; IT and IT-enabled service employees may be covered by client contracts that flow down obligations. An NDA that ignores these will not align with the employer's actual compliance posture.

Clauses that hold, and clauses that do not

The difference between an enforceable NDA and a decorative one is rarely the length. It is whether each clause is tied to a legitimate protectable interest and drafted with enough precision that a court can see what is prohibited.

Clauses that tend to survive scrutiny

A carefully defined confidentiality obligation covering identified categories of information — technical know-how, source code, pricing and margin data, customer and prospect lists, supplier terms, product roadmaps, unpublished financials — is the core. The definition should specify that information is covered whether oral, written or observed, and should require oral disclosures to be confirmed in writing within a short period so the record is not purely testimonial.

A purpose limitation clause, restricting use of the information to the employee's duties, is equally important. Without it, an employee can argue that using the information in a new venture was never prohibited, only disclosing it was.

Return and destruction obligations at exit, with a certification that personal copies have been deleted, give the employer something concrete to point to. Device and account provisions — company email, cloud storage, personal device usage — should state that data on personal devices used for work remains the employer's property and must be produced or wiped on exit, subject to the employee's own personal data being preserved.

An IP assignment clause assigning present and future work product created in the course of employment, including inventions, designs, code and content, is standard. Under the Copyright Act, 1957, works created in the course of employment are generally owned by the employer in the absence of an agreement to the contrary, but a written assignment removes doubt and covers material that may fall outside the employment relationship, such as work created partly at home.

A clause requiring notice to the employer before any compelled disclosure — a court order, a regulatory demand, a statutory investigation — allows the employer to seek protective orders. It does not override the legal compulsion, but it preserves the employer's ability to act.

Clauses that usually fail or create risk

Post-employment non-compete clauses are the classic example. A clause barring an employee from joining any business that competes with the employer, for a period of one or two years across a broad geography, is very likely to be treated as void under Section 27. Some employers try to save it by calling it a "non-compete to protect confidential information"; the label does not change the analysis, and a court may strike the clause while upholding the confidentiality obligations around it.

Blanket non-solicitation clauses are on firmer ground but still need care. A clause preventing an employee from soliciting customers they personally dealt with is more defensible than one barring any dealing with anyone on the employer's customer list. Clauses that prohibit an ex-employee from responding to unsolicited approaches are harder to justify.

Ownership clauses that claim all inventions "whenever conceived" without limiting them to the employment scope are overbroad. A clause capturing an invention made years after leaving, on the employee's own time and with no company resources, invites challenge and can taint the credibility of the whole agreement.

Confidentiality definitions that cover "all information concerning the company" are too vague to enforce. So are clauses that fail to carve out information the employee already knew, information in the public domain, and information the employee is legally required to disclose.

Stamp duty and execution practicalities

Employment contracts and standalone NDAs signed by employees are not subject to compulsory registration under the Registration Act, 1908. Stamp duty, however, may apply depending on the state and on how the instrument is characterised. Several states levy a nominal fixed duty on agreements; some treat an appointment letter or a service agreement differently from a standalone confidentiality deed. The rate varies by state and changes over time.

Execution discipline matters as much as the duty. Before the employee starts, the employer should complete the following steps:

• Sign before access — the NDA should be executed before the employee is given system credentials or customer data.
• Use the correct characterisation — a standalone confidentiality deed and an appointment letter attract different treatment in some states.
• Obtain a signature on every page — or execute in a form that makes page substitution difficult, such as a signed and initialled annexure.
• Record the date of signing — the date determines when the obligation starts and supports the timeline in any later claim.
• Witness or notarise where required — not a statutory requirement for validity, but useful evidence if execution is disputed.
• Keep the signed original — an emailed PDF is workable, but the employer should hold the executed instrument and a record of when it was given to the employee.

The safest practice is to confirm the position with the sub-registrar in the state where the agreement is executed, or with local counsel, rather than relying on a figure quoted in a template. If the agreement is executed on stamp paper, the stamping should match the characterisation — an agreement stamped as a service contract but drafted as a deed can create avoidable evidentiary problems.

Execution formalities matter more than employers expect. The agreement should be signed by someone with authority to bind the company, dated, and accompanied by an annexure listing the categories of confidential information or the policies the employee is agreeing to. Where the employee signs electronically, the Information Technology Act, 2000 gives legal recognition to electronic signatures in most commercial contexts, but an employment document signed through a generic click-through may face an authenticity challenge. A signing workflow that captures the identity of the signatory and retains an audit trail is preferable.

Employers should also keep a signed copy. This sounds trivial and is one of the most common failures in disputes: the HR file has the offer letter but not the NDA, or the NDA is unsigned because it was bundled into an onboarding portal the employee never completed.

What the NDA should cover in different roles

A single template applied to every employee is a compromise. The information exposure of a software engineer, a salesperson and a finance analyst is different, and the agreement should reflect that.

Enforcement: what an employer can realistically do

When an employee breaches confidentiality, the employer's options are an injunction, a damages claim, or both. An injunction application typically seeks to restrain further disclosure and use of the information, and may be paired with an order for delivery up of documents and devices. Indian courts have been willing to grant interim relief where the employer can show that the information is confidential, that the employee had access, and that there is a credible risk of further misuse.

Speed matters. An application filed weeks after the breach, when the information has already been circulated, is less likely to produce meaningful relief. Employers should have a documented incident response process — preserve logs, identify what was accessed, send a preservation notice to the employee, and move quickly on interim relief.

Damages are harder. Proving the quantum of loss from a disclosure is difficult, and Indian courts are conservative about speculative loss. A liquidated damages clause can help if it is a genuine pre-estimate and not a penalty, but the employer still needs to establish breach. An indemnity clause covering legal costs and third-party claims arising from the employee's breach is more practically useful.

Criminal remedies exist in limited circumstances. The Information Technology Act, 2000 has provisions on unauthorised access to computer resources and data theft that can apply where an employee accesses systems after authorisation is withdrawn. These are not a substitute for a civil claim and should not be the primary strategy, but they matter where the conduct involves unauthorised system access.

Mistakes employers make most often

The first is using a mutual NDA template for employees. It creates reciprocal obligations the employer never intended and makes the document look borrowed. Employees and their lawyers notice.

The second is signing the NDA after the employee has already started and already had access. The agreement should be executed before access is granted, and the onboarding checklist should make access contingent on a signed copy. A confidentiality obligation signed after the information has been seen is harder to enforce and easier to dispute.

The third is failing to update the agreement when the role changes. An engineer promoted into product leadership gains access to roadmap and pricing data that the original NDA never contemplated. A fresh acknowledgment or an amended schedule closes the gap.

The fourth is overreach. Adding a two-year non-compete to look tough, or claiming ownership of everything the employee invents, makes the document look unreasonable and gives the employee an argument that the whole agreement is an unenforceable restraint. Proportionate drafting is more enforceable, not less.

The fifth is having no exit process. The NDA says the employee must return information, but nobody checks. An exit checklist — revoke access, collect devices, confirm deletion, obtain a signed exit declaration — turns a paper obligation into an operational one.

The sixth is forgetting about personal devices and personal accounts. If employees use personal email or personal cloud storage for work, the NDA should address it explicitly and the exit process should cover it.

Frequently asked questions

Is an NDA mandatory for all employees in India?

No statute requires every employer to have one. It is a commercial and risk-management decision. Employers handling customer data, intellectual property or pricing information should have one for all employees with access to that material. For roles with no exposure to sensitive information, a short confidentiality and IP clause in the appointment letter may be sufficient.

Can an employer enforce a non-compete against an employee in India?

Post-employment non-compete clauses are generally treated as void under Section 27 of the Indian Contract Act, 1872. A restraint during employment is viewed differently, because the employee is bound by duties of fidelity while working. Employers should not rely on a post-employment non-compete as their primary protection; confidentiality, IP assignment and narrowly drawn non-solicitation clauses are more dependable.

Does the NDA need to be stamped?

It depends on the state and on how the instrument is characterised. Many states levy a nominal duty on agreements; some treat service agreements differently. Confirm the current rate with the sub-registrar in the state of execution. An unstamped agreement is not automatically void but can be inadmissible in evidence until deficit duty and penalty are paid.

What should an employee do before signing an NDA?

Read the definition of confidential information and check whether it captures things you already knew or information in the public domain. Look at the duration, the return-of-information clause and any restriction on future employment. If a non-compete is broad, ask for it to be narrowed to confidentiality and non-solicitation. Keep a signed copy.

Can an NDA stop an employee from using general skills and knowledge?

It should not, and a clause that tries to will be difficult to enforce. Confidential information is specific material — documents, code, data, formulas — not the general skills an employee develops through experience. An agreement that prohibits using "know-how" or "expertise" without limiting it to documented proprietary material is overbroad and risks being read down.

Drafting Support

Our drafting team prepares employee NDAs and combined confidentiality and IP assignment agreements calibrated to the role, the information actually handled and the state of execution. We also review existing templates for clauses that will not survive scrutiny, so the agreement protects information rather than merely appearing to.