NDA South Africa: What Small Businesses Need to Know

A non-disclosure agreement (NDA) — also called a confidentiality agreement — is a legally binding contract in which one or more parties agree to keep certain information confidential. In South Africa, NDAs are governed by the common law of contract and must meet the standard requirements for a valid agreement: offer, acceptance, consideration, capacity, and lawful purpose. There is no specific NDA legislation in South Africa, but courts will enforce a well-drafted NDA as a binding contractual obligation.

You should consider an NDA before sharing any information that gives your business a competitive advantage or that a third party could misuse. Common situations include: sharing a business concept or pitch with a potential investor or partner; engaging a contractor, freelancer, or consultant who will access client data, systems, or proprietary processes; entering supplier or distribution negotiations where pricing, margins, or product details are disclosed; and onboarding employees in roles with access to trade secrets, client lists, or confidential strategy.

A unilateral NDA binds only one party — typically the recipient of confidential information. This is appropriate when only one party is disclosing sensitive information, such as when a business shares its concept with a potential investor. A mutual NDA binds both parties and is appropriate when both sides will share confidential information — for example, in a joint venture or merger discussion. Using a unilateral NDA when a mutual one is needed (or vice versa) can leave one party unprotected or create an imbalance that undermines the agreement.

A valid and enforceable NDA in South Africa should clearly define: (1) the parties — full legal names and capacity; (2) the definition of confidential information — specific enough to be meaningful, broad enough to cover what you actually need protected; (3) exclusions — information already in the public domain, independently developed by the recipient, or received from a third party without restriction; (4) the obligations of the receiving party — how information may be used, stored, and shared; (5) the duration — how long the obligation lasts; (6) the permitted purpose — the specific reason the information is being shared; (7) remedies — what happens on breach, including whether the disclosing party may seek an interdict; and (8) governing law — South African law and the jurisdiction of South African courts.

South African courts apply a reasonableness standard to the duration of confidentiality obligations. There is no fixed rule, but indefinite NDAs covering all information are more likely to be challenged. A reasonable duration depends on the nature of the information: trade secrets and proprietary formulas may justify longer protection (5–10 years or longer); business plans and pricing information typically warrant 2–5 years; general business discussions may only need 1–2 years. The duration should reflect how long the information retains commercial value.

The Protection of Personal Information Act 4 of 2013 (POPIA) imposes obligations on anyone who processes personal information in South Africa. If your NDA involves the sharing of personal information — client lists, employee data, customer records — POPIA compliance is a separate and additional requirement. An NDA does not substitute for POPIA compliance: the receiving party must still process any personal information lawfully, with a legitimate purpose, and in accordance with the eight conditions for lawful processing. Your NDA should acknowledge POPIA obligations where personal information is involved.

The most frequent NDA mistakes we see at ClauseWise: using a foreign template (US or UK NDAs do not reflect South African law and may include unenforceable provisions); defining confidential information too broadly or too vaguely; failing to specify the permitted purpose; omitting exclusions, which can make the NDA appear unreasonable; not including a governing law clause; signing without dating (undated NDAs create disputes about when obligations began); and treating a signed NDA as a guarantee — an NDA creates a legal obligation, but enforcement still requires evidence of breach and loss.