What counts as confidential?
Every NDA has to answer one question before it does anything else: what information is the agreement actually protecting? The definition clause answers it. And in most NDAs, the answer is written by the disclosing party's lawyer with the incentive to define 'confidential' as broadly as possible.
The broader the definition, the more behavior counts as a breach. When 'confidential information' is defined to include 'any information disclosed by either party in any form,' the recipient is essentially agreeing not to discuss anything that happened in the relationship — including innocuous facts, public information the discloser also happens to use, and anything later remembered from conversation.
Definitions matter because they multiply every other risk in this taxonomy. A perpetual term is more dangerous when the definition is overbroad. A weak return-or-destruction clause is worse when the universe of covered material is undefined. The definition is where the contract decides how much of your life and work it covers.
The defensible default — and where it breaks
A workable definition does three things: it names the categories of information being protected, it provides a method for marking or designating disclosures as confidential, and it acknowledges what is not confidential (the exclusions covered in Category 02).
The Silicon Valley-style standard defines confidential information as material that is either marked 'Confidential' at the time of written disclosure, or — for oral disclosures — confirmed in writing within a defined window (typically 30 days). This forces the disclosing party to be deliberate about what it claims as confidential, and it gives the recipient a basis for knowing what is and isn't covered.
The aggressive variant skips the marking and confirmation requirements entirely. Anything disclosed in any form, whether marked or not, oral or written, is deemed confidential. This is popular because it's easier to draft and creates maximum coverage for the disclosing party. It is also frequently held to be unenforceable as too vague to be a meaningful obligation.
What this looks like in real contracts
What NDASentry flags in this category
1.1 Overbroad definition of confidential information
Definitions that sweep in 'any and all information,' 'all communications,' or anything 'discussed' between the parties trigger this finding. The risk is enforceability: courts regularly hold overbroad definitions unenforceable for being indefinite. The practical risk is worse — the recipient lives under chilling-effect uncertainty about what they can say or use, regardless of whether the contract would actually hold up.
1.2 Vague or undefined confidential information
The definition is missing, circular ('information that is confidential'), or refers only to undefined categories. Without clear scope, every other obligation in the agreement is harder to comply with and harder to enforce. NDAs without a definition section, or with one that defers to 'as the parties may agree,' fall into this pattern.
1.3 Oral disclosures swept in without written confirmation
The agreement covers oral and visual disclosures without requiring follow-up writing identifying what was disclosed. This creates after-the-fact ambiguity: years later, the disclosing party can claim that a particular conversation constituted protected disclosure. Defensible drafting requires oral disclosures to be confirmed in writing within a defined window (typically 30 days).
We are scoring a corpus of public NDAs to publish prevalence data for each pattern in this taxonomy. The findings — including what percentage of real NDAs contain the patterns above, broken down by industry and jurisdiction — will appear here when the study is complete.