NDA Review Checklist: What to Check Before You Sign

You were emailed a “standard” form the night before a call and you will skim two pages. An NDA review checklist before signing starts with the frozen file: match who actually discloses, lock definition plus the two clocks, hunt residuals, then sign, redline, or escalate. Signing feels like a courtesy. The risk is years of restriction, not a missed meeting.

In August 2026, Priya, a solo consultant, gets a one-way NDA from a US buyer 40 minutes before a product walkthrough. She will share pricing and a client-anonymised case study. The form has no independent-development exclusion, a perpetual term, and “unaided memory” residuals on page 4. Typical mistake: treating the PDF as politeness.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

When is an NDA worth a careful read?

An NDA is worth a careful read whenever you will disclose something you cannot cheaply replace — pricing, process, a client story, or code — and the other side sent their paper. Do not wait until you are in the room. GOV.UK guidance tells disclosers not to speak until the other side has signed and returned the form, and to check it does not restrict future work.

In practice the rush is the trap. For example, a title that says Mutual can still bind only you. Map who will speak. If you will disclose, demand matching obligations or a side letter — keep that form check short. Confirm legal names and signatory authority.

• Do: freeze the version you will sign. Refuse to disclose until it is signed and returned.
• Do not: treat “standard NDA” as a courtesy signature before a call.

What should definition, exclusions, and duration actually say?

Confidential information should be tied to a specific permitted purpose, not “any information in any form, whether or not marked.” A tight definition plus four carve-outs and two clocks is what to look for in an NDA. You can widen a purpose later. You cannot narrow it after you speak.

UK guidance still treats 3 or 5 years as a common commercial window. 2026 write-ups put ordinary data at 2–5 years, 2–3 years common, trade secrets “as long as they remain secrets.” Blanket perpetuity on a pricing deck is a flag. Split the clocks: term is not survival. Cooley GO makes the same split.

Require the four exclusions in the Common Paper Mutual NDA: public through no fault; already known; third-party without restriction; independently developed. Add compelled disclosure with notice. Missing independent development is how Priya’s walkthrough becomes a fight.

• Do: propose 2–5 years for ordinary data plus a trade-secret rider that lasts only while the secret stays secret.
• Do not: accept “whether or not marked” with no independent-development exclusion.

Where do residuals and hidden restraints hide?

Residuals sit on page 4 under a calm heading. The clause lets the recipient use what an employee retains in “unaided memory” even though the NDA pretends to lock it. If you disclose core IP, treat residuals as High. Strike or walk.

Residuals are hard to prove, because nobody can show what was “remembered” versus copied. Ctrl-F non-compete, non-solicit, exclusivity, and IP assignment of future work. Interview plus restraint is a stop.

• Do: search residuals, unaided memory, non-compete, non-solicit, exclusivity, assignment.
• Do not: assume a short NDA has no extra powers.

Which NDA red flags need a severity action?

A red flag is only useful if it has a severity and an action. Build a one-page log: clause → High / Medium / Low → sign, redline, or escalate. This is the gap “review in 60 seconds” posts skip. Name a reviewer on every High row before anyone countersigns.

How do you run the checklist before you sign?

Run this workflow on the frozen file: freeze version → form check → definition and exclusions → clocks → hunt passengers → ops duties → venue → sign / redline / escalate. A playbook — a one-page list of your default positions — keeps the steps from drifting.

If an exhibit — an attached schedule — sits in the packet — the exact file set that will be signed — review it too. Optional first-pass highlighter, then a named human opens every High clause.

Should you escalate this NDA to a lawyer?

Escalate when a High flag sits on residuals over core IP, a hidden restraint, perpetual everything, missing exclusions, exclusive foreign venue you cannot afford, or a gag on crime reporting. Spend lawyer time on High rows only.

On venue, GOV.UK warns that England and Wales is not Scotland, and exclusive courts fail if you must sue where the leak happens.

UK limits are dated. Acas (updated 25 March 2026) says an NDA cannot stop whistleblowing, equal-pay talks, or reporting a crime. Victims and Prisoners Act 2024 guidance adds that NDAs signed on or after 1 October 2025 cannot validly gag specified crime-related disclosures.

Success bar before the call: mark each core clause pass/fail, produce a one-page log (clause → severity → action), and either sign a clean NDA, send 3–5 focused redlines, or stop and send High items to counsel.

• Do: send counsel the High list, the frozen file, and the redlines you want.
• Do not: escalate a clean 3-year mutual with the four carve-outs just from nerves.

Do not paste the frozen NDA into a public chatbot; use the confidential-contract AI gate first.