Third-party NDA.
Review confidentiality and information-sharing obligations for vendors, advisers and other external counterparties.
The right support.
With the details in view.
A third-party NDA governs information shared with an outside vendor, adviser, consultant or other counterparty. The terms should follow what that party needs to do and which personnel or subcontractors need access. Confidentiality is only one part of the arrangement; data processing, service responsibilities and IP ownership may need additional provisions.
First, establish what applies
Documents should reflect the transaction, parties, location and applicable law. Drafting, legal advice, disputes, execution, stamping and registration need appropriate professional review; a template alone does not complete those steps.
What the scoped work can cover
- Counterparty-specific NDA
- External access and permitted-use schedule
- Vendor onboarding and exit checklist
A useful brief.
A stronger starting point.
Bring these inputs and existing records to the drafting discussion. They help turn a standard format into a document that reflects your situation.
- 01
Counterparty details and the underlying engagement
- 02
Information, systems and customer records involved
- 03
Vendor personnel and subcontractor access requirements
- 04
Security, incident reporting and permitted processing expectations
- 05
Engagement end date and deletion or retention needs
Share sensitive records only through an agreed secure channel after the engagement is confirmed. Do not send passwords, OTPs or signing keys.
One step.
Then the next.
A clear sequence, with room to resolve the details that are specific to your business.
- 01
Review external access
Understand the vendor’s work and the information necessary to perform it.
- 02
Control onward sharing
Define approved people, subcontractors and disclosure responsibilities.
- 03
Draft connected obligations
Align confidentiality with the services contract and any data-processing requirements.
- 04
Operationalise the terms
Agree signing, access approval, incident contacts and end-of-engagement handling.
Scope, fees and timing are agreed after review. Document readiness, professional review and any authority queries affect the schedule. Statutory charges, testing, execution and other third-party costs are identified where relevant.
Keep the next
responsibility in view.
Review access when subcontractors or scope change, and obtain the agreed return or deletion confirmation at exit.
Explore obligations beyond your core businessGood questions.
Useful answers.
01Is an NDA enough for a vendor handling personal data?+
Usually the full arrangement needs review, including processing instructions, security, retention and applicable privacy requirements.
02Can a vendor share material with subcontractors?+
Only on the agreed basis. The document should specify approvals and equivalent obligations where appropriate.
03Can this be added to an existing vendor agreement?+
Yes, but check conflicting terms, precedence and how the additional obligations become binding.