Mutual NDA
A German-law mutual NDA template covering GeschGehG trade-secret obligations and GDPR alignment.
In Germany, a mutual NDA (Geheimhaltungsvereinbarung) is a standard commercial document, but two substantive regimes pull on its drafting. The first is the Geschäftsgeheimnisgesetz (GeschGehG), which implemented the EU Trade Secrets Directive and requires the holder of a trade secret to take "reasonable steps" to protect it — an NDA is one such step.
The second is the GDPR. Where the information exchanged includes personal data, the NDA alone is not enough: the parties will also need an appropriate GDPR basis (controller-to-controller, or a data processing agreement under Article 28) and should reference it explicitly. The NDA should also make clear that it is governed by German law and that the competent courts are those of the agreed seat.
Required clauses for Germany (EU)
- Definition of Confidential Information
- Broad definition aligned with §2 GeschGehG trade secret criteria.
- Reasonable Protective Measures
- Explicit acknowledgement of measures required to preserve trade-secret status.
- GDPR Alignment
- Where personal data is involved, a reference to Article 28 GDPR and a separate DPA if processing on behalf.
- Term
- Three years with an indefinite tail for trade secrets.
- Governing Law — German Law
- Substantive German law, excluding the CISG.
- Jurisdiction
- Competent courts at the agreed seat, subject to mandatory rules.
- Written Form Clause
- §126 BGB-style text form requirement for amendments.
Example contract
A hand-written illustrative example. Not a substitute for legal advice on your specific situation.
GEGENSEITIGE GEHEIMHALTUNGSVEREINBARUNG (MUTUAL NON-DISCLOSURE AGREEMENT)
This Agreement is entered into on [Effective Date] between: (1) [Party A], a company organised under the laws of the Federal Republic of Germany, registered at the Handelsregister of [court] under HRB [number], with its seat at [address] ("Party A"); and (2) [Party B], a company organised under the laws of [jurisdiction], with its seat at [address] ("Party B"). Each a "Party" and together the "Parties".
PREAMBLE. The Parties wish to discuss a potential business relationship (the "Purpose") and will therefore exchange non-public information, including information that may constitute a trade secret (Geschäftsgeheimnis) under the German Trade Secrets Act (Geschäftsgeheimnisgesetz, "GeschGehG").
§1 CONFIDENTIAL INFORMATION. "Confidential Information" means all non-public information disclosed by one Party (the "Discloser") to the other (the "Recipient") in connection with the Purpose, whether disclosed in oral, written, electronic, or any other form, including in particular information marked as confidential and information that, by its nature, a reasonable recipient would treat as confidential.
§2 OBLIGATIONS. The Recipient shall: (a) use the Confidential Information solely for the Purpose; (b) treat it as strictly confidential; and (c) take reasonable protective measures within the meaning of §2 no. 1 lit. b GeschGehG, including restricting internal access on a need-to-know basis.
§3 EXCLUSIONS. The obligations do not apply to information that is or becomes publicly known through no breach of this Agreement, was already lawfully known to the Recipient, is independently developed, or is lawfully received from a third party without an obligation of confidentiality.
§4 PERSONAL DATA. To the extent the Confidential Information includes personal data within the meaning of Article 4(1) of the General Data Protection Regulation (GDPR), the Parties shall process such data only in accordance with applicable data protection law. If either Party processes personal data on behalf of the other, the Parties shall enter into a separate data processing agreement pursuant to Article 28 GDPR before such processing begins.
§5 TERM. This Agreement shall remain in force for three (3) years from the Effective Date. Confidentiality obligations shall survive for a further two (2) years, and indefinitely for information that qualifies as a trade secret under the GeschGehG.
§6 RETURN AND DELETION. Upon written request, each Party shall return or securely delete the other Party's Confidential Information, subject to mandatory statutory retention obligations.
§7 GOVERNING LAW. This Agreement shall be governed by the substantive laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods.
§8 JURISDICTION. The exclusive place of jurisdiction for all disputes arising out of or in connection with this Agreement shall be the courts competent for the registered seat of Party A, to the extent legally permissible.
§9 WRITTEN FORM. Amendments to this Agreement must be made in writing (Textform). This also applies to any amendment of this written form clause.
The Parties have signed this Agreement in two original counterparts.
Frequently asked questions
- Is an NDA required to protect a trade secret under the GeschGehG?
- Not strictly, but the GeschGehG requires "reasonable protective measures" to qualify for trade-secret status, and a signed NDA is one of the clearest such measures.
- Does a German NDA also cover GDPR obligations?
- No. An NDA is not a substitute for a GDPR data processing agreement. If personal data is exchanged, you need an appropriate GDPR basis separately.
- Can we draft the German NDA in English?
- Yes. Bilingual German commercial practice often uses English, especially in cross-border deals. The governing language for interpretation should be stated.
Draft my own
Start with a conversation. Contracts.io will draft a mutual nda tailored for Germany (EU).
Draft this contract