A founder once told us she had signed forty NDAs in a year and could not remember the terms of a single one. That is the problem. The non-disclosure agreement has become the most signed, least read document in commercial life — and when something actually leaks, the gap between what people thought they signed and what a court will enforce becomes painfully visible.
This is not a template problem. It is a drafting and jurisdiction problem, and it gets sharper the moment the parties sit on different sides of a border.
Why most NDAs fail quietly
Most confidentiality agreements are never tested. The ones that are tend to fail for the same handful of reasons, and almost none of them are exotic.
- Vague definition of "Confidential Information." If the definition catches everything, it catches nothing — courts dislike clauses that effectively rebrand every conversation as confidential. The information should be identifiable, ideally by category, and ideally marked or notified.
- No clear permitted purpose. An NDA without a defined purpose ("evaluating a potential investment in the Company") gives the receiving party no boundary to respect and the disclosing party no breach to point at.
- Indefinite or unrealistic duration. Perpetual confidentiality looks strong on the page and weak in court. Trade secrets can warrant longer protection; ordinary commercial information usually cannot.
- No carve-outs that match reality. Disclosures compelled by regulators, required for tax filings, or made to professional advisers under duty of confidence will happen. If the NDA does not allow them, the receiving party is in technical breach from week one.
- Remedies that say nothing useful. "The parties agree damages may be inadequate" is fine; saying nothing about injunctive relief, return or destruction of materials, or the survival of obligations is not.
- Governing law and forum mismatched to the parties. This is where cross-border NDAs come apart.
Governing law is not a coin toss
The governing law clause is treated, in practice, as the last thing to negotiate. It should be one of the first. In a cross-border context it does three jobs at once: it tells a court which body of law interprets the contract, it shapes the available remedies, and — together with the jurisdiction clause — it determines whether a judgment is worth anything in the country where the breaching party actually holds assets.
A few principles worth holding in mind when drafting a cross-border NDA between a UK entity and a PRC counterparty:
- English law is well-suited to confidentiality disputes. It has a mature body of equitable doctrine on confidence, predictable approaches to injunctions, and judges experienced in commercial disclosure.
- PRC law has tightened considerably on trade secrets and data. For agreements where the confidential information sits on servers in mainland China, or where the receiving party is a PRC company with no UK assets, choosing English law may produce an unenforceable victory.
- Hong Kong law is often the quiet compromise. It is a common-law system, familiar to UK-trained lawyers, and Hong Kong judgments enjoy a reciprocal enforcement arrangement with the mainland that English judgments do not.
- Arbitration is usually better than litigation for this fact pattern. A seat in London, Hong Kong or Singapore with an institutional rule set (LCIA, HKIAC, SIAC) produces an award that is enforceable in both the UK and the PRC under the New York Convention. Court judgments are not as portable.
- Do not split governing law from jurisdiction without a reason. English law with PRC court jurisdiction creates work for everyone and certainty for no one.
What a UK / PRC dual-bound NDA actually contains
When we draft a mutual NDA template intended to bind a UK party and a PRC party in parallel, the structure tends to look like this:
- Parties and capacity. Full registered names in both English and Chinese characters, with unified social credit codes for PRC entities and company numbers for UK entities. Mismatched names are the single most common reason an NDA cannot be enforced against the entity that actually holds the information.
- Purpose clause. Narrow, factual, and dated where possible.
- Definition of Confidential Information. Category-based, with a sensible marking or notification mechanism, and explicit treatment of information embodied in samples, source code, customer lists and technical data.
- Standard exclusions. Public domain, independently developed, lawfully received from a third party, already known — drafted as the receiving party's burden to prove.
- Permitted disclosures. Affiliates, professional advisers, and disclosures required by law or regulator, with a notification obligation where legally possible.
- Data and cross-border transfer language. Where personal information is in scope, the NDA should sit alongside — not pretend to replace — the parties' obligations under UK GDPR and the PRC's data and personal information regime. A short clause acknowledging this, and committing to a separate data processing arrangement if needed, is usually enough.
- Term. A defined confidentiality period (commonly two to five years for commercial information; longer for clearly identified trade secrets), with the obligations surviving termination of any underlying discussions.
- Return and destruction. With a carve-out for archival copies held under legal or audit retention rules.
- Remedies. Express acknowledgement that damages may be inadequate and that injunctive or interim relief may be sought in any court of competent jurisdiction, notwithstanding the arbitration clause.
- Governing law and dispute resolution. Chosen deliberately, with arbitration as the default for genuinely cross-border matters.
- Language. If the agreement is executed in both English and Chinese, state which version prevails. Silence on this point causes more arguments than almost any other drafting omission.
Three patterns we see go wrong
The first is the forwarded template. A UK founder sends a PRC supplier the NDA their solicitor drafted for a domestic deal three years ago. It names English courts, ignores PRC data rules, and refers to "the Company" in a way that does not match the counterparty's registration.
The second is the mutual-in-name-only NDA. The obligations are reciprocal on the page but the carve-outs, the definition of confidential information, and the remedies are clearly written from one side. PRC counsel will notice; UK counsel will notice; the deal will slow down.
The third is the belt-and-braces over-reach: non-compete, non-solicit, IP assignment and confidentiality fused into one document, governed by English law, signed by a PRC individual with no UK nexus. Even if the confidentiality obligations would have been enforceable on their own, bundling them with provisions a PRC court will not recognise weakens the whole instrument.
A short closing note
Most NDAs do not need to be long. They need to be specific about what is protected, honest about how long, and deliberate about where a dispute would actually be resolved. The rest is housekeeping.
If you are drafting or reviewing a cross-border NDA and want a second pair of eyes — or a clean mutual NDA template drafted under UK law in English, with the option of a parallel Chinese version — JustiScript handles confidentiality agreements alongside the rest of our UK contract work at justiscript.com.
FAQ
Q: We're a UK startup signing an NDA with a Shenzhen manufacturer before a factory visit. English law or PRC law? A: For a one-off factory visit where the risk is the manufacturer copying your product, PRC law (or Hong Kong law) with arbitration seated in Hong Kong tends to be more enforceable on the ground, because that is where the manufacturer's assets and operations sit. English law looks reassuring but produces a judgment you may not be able to execute.
Q: Can a single NDA bind both a UK parent and its PRC subsidiary? A: It can, but each entity should be named separately with its own registration details, and the obligations should be expressed as joint and several where appropriate. A clause saying the NDA "extends to affiliates" is not a substitute for actually naming them.
Q: How long should a cross-border NDA last? A: For ordinary commercial information, two to five years from disclosure is normal and defensible. Indefinite terms should be reserved for clearly identified trade secrets, and even then expect a court — in either jurisdiction — to test whether the period is reasonable on the facts.