NDAs and NCAs: what your business needs to know

NDA: Non-Disclosure Agreement

What is an NDA and why is it needed?

An NDA (Non-Disclosure Agreement) is a contract under which a party that gains access to confidential information undertakes not to disclose or use it for any purposes other than those agreed upon. An NDA is entered into with employees, contractors, partners, investors, and any other individuals who gain access to significant company data, before such access is granted.

Categories of information typically protected by an NDA include: technical documentation and source code, customer databases and contact details, financial performance and business plans, marketing strategies and advertising materials, terms of agreements with partners, and the company’s internal processes and policies.

Trade secrets as a separate legal category

It is also important to distinguish the concept of a trade secret — information that has actual economic value precisely because it is not known to third parties and that its owner takes reasonable steps to keep confidential. Article 505 of the Civil Code of Ukraine expressly recognizes trade secrets as an object of intellectual property rights.

Typical examples of trade secrets in IT and other industries include: a software algorithm or machine learning model, a manufacturing technology or formula, a complete customer database with order history, a unique business model or pricing mechanism, and the results of marketing research.

An important nuance: trade secret status does not arise automatically. A company must demonstrate that it has taken reasonable measures to protect the information — restricted access, marking documents as “confidential,” entering into NDAs with everyone who has access, and implementing technical safeguards such as encryption and access controls. Without such measures, a court may refuse to recognize information as a trade secret, even if it is objectively valuable.

Proving an NDA breach: what courts accept

The most challenging practical aspect of NDA disputes is proving that disclosure actually occurred. In practice, courts accept a wide range of evidence, including emails, screenshots of messages from messengers and social media, system logs recording access to files and databases, document metadata, and the findings of technical (computer forensic) examinations.

The key requirement is the proper preservation and documentation of evidence. A screenshot without confirmation of its authenticity or a system log without maintaining the chain of custody may be challenged by the other party. It is advisable to implement access-logging systems for confidential data in advance — this is not only a technical measure but also a legal safeguard.

Essential elements of an effective NDA

Based on our experience, the outcome of an NDA dispute largely depends not on the fact of the breach itself, but on the quality of the agreement’s wording. An NDA should include:

Clear definition of confidential information: a list of specific categories of data (source code, technical solutions, business plans, customer databases, financial information). General phrases such as “all company information” are often considered insufficiently specific by courts.

Term of the agreement: standard practice is to maintain confidentiality throughout the entire period of cooperation and for an additional 2–3 years after it ends. For particularly sensitive information, such as technological trade secrets, the term may be longer or indefinite.

Procedure for returning or destroying materials: a clear mechanism and deadline for returning or deleting documents, files, and access credentials after the cooperation ends.

Liability for breach: a fixed penalty and/or a mechanism for recovering actual damages and lost profits. Combining both mechanisms generally provides the strongest practical position in court.

Exclusions from confidentiality: information that becomes public through no fault of the relevant party or was already known to that party before the NDA was entered into is generally excluded from the scope of protection. This makes the agreement more balanced and more resilient to challenges.

Case law: when an NDA works and when it does not

A notable example from case law: an employee published information about the company’s sales volumes and counterparties on social media. The court found that this constituted a breach of confidentiality obligations and awarded the company damages for lost profits.

In contrast, in another case, the claim was dismissed because the company failed to prove which specific data constituted confidential information and what specific harm the disclosure had caused. The conclusion is clear: the effectiveness of an NDA is determined not by the parties’ intentions, but by the quality of the legal definition of the protected subject matter and the ability to prove actual harm.

NCA: non-compete agreements and their limitations in Ukraine

What is an NCA?

An NCA (Non-Compete Agreement) is an agreement that restricts an employee’s or partner’s ability, after the end of their cooperation, to work for competing companies, establish a similar business, or solicit clients and members of their former employer’s team.

The purpose of an NCA is to prevent a situation in which a person, having gained access to internal processes, technologies, and customer databases, immediately uses this knowledge for the benefit of a competitor or their own similar business. The problem is that an NCA directly restricts an individual’s constitutional right to work — which is why legislation and courts approach such agreements much more cautiously than NDAs.

Legal status of NCAs in Ukraine: why courts often refuse to enforce them

The Constitution of Ukraine guarantees the right to work as one of the fundamental human rights. For this reason, non-compete agreements have traditionally been considered problematic under the general Ukrainian legal framework: courts rarely recognize such agreements as valid and enforceable in disputes, particularly in the context of ordinary employment relationships outside special legal regimes.

An exception is Diia City. Under this special legal regime, the legislature has expressly permitted the use of NCAs. Diia City residents may include non-compete provisions in gig contracts or employment agreements that have legal force, provided that the statutory requirements are met, including reasonable limitations on the term and territory, as well as compensation. This creates a unique legal opportunity in Ukraine for IT companies operating under this regime.

How NCAs are regulated in the EU: examples of Germany and France

European practice demonstrates how the interests of businesses and employees can be balanced without banning NCAs entirely, but instead by establishing clear limits on their use.

Principle of balancing interests

Regardless of the jurisdiction, the key principle for an effective NCA is a balance of interests: the business receives protection for its commercial interests against unfair competition, while the employee receives fair financial compensation for the restriction on their ability to work in their professional field. An agreement without compensation, a clearly defined term, or territorial limitations is highly likely to be deemed invalid or disproportionate.

Why an NDA is often sufficient without an NCA

In most practical situations, the company’s key business interest is not to prohibit an employee from working in the industry altogether, but rather to prevent the disclosure and misuse of specific information they have obtained. If this can be achieved through a well-drafted NDA, entering into an additional NCA — especially under the Ukrainian legal framework outside Diia City — is often legally ineffective and creates unnecessary risks of challenging the entire agreement.

NDA vs NCA: comparison table

Recommendations for businesses

How to build an effective confidential information protection system

• Create an internal register of confidential information: specify exactly what the company considers a trade secret, who has access to it, and at what level.
• Enter into NDAs before granting access to information, not retroactively — with employees during onboarding and with contractors and partners before discussing project details.
• Define the scope of confidentiality precisely: list specific categories of data rather than using general phrases. This can significantly increase the chances of success in court.
• Implement technical safeguards: access control based on the need-to-know principle, logging of activities involving sensitive files, and marking documents as “confidential.”
• Establish a clear procedure for returning or destroying materials and set specific deadlines for doing so after the cooperation ends.
• Define liability using a combination of measures: a fixed penalty plus the right to recover actual damages and lost profits.

When to consider an NCA

• Your business is registered or plans to register as a Diia City resident — in this case, an NCA has real legal enforceability.
• There is a specific, well-documented risk: a key employee has exclusive access to technology or a customer database, the loss of which could have a critical impact on the business.
• The company is prepared to provide fair compensation for the restriction period — this significantly increases the chances of the agreement being upheld, even in disputed situations.
• The restriction is proportionate: a specific territory, a specific term (not “forever”), and a specific scope of activity rather than a general ban on working in the industry.

Alternatives to NCAs that work better in the Ukrainian context

• A comprehensive and well-drafted NDA with an extended term after the end of cooperation (3–5 years for critical information).
• A non-solicitation clause (prohibiting the solicitation of clients and employees) — such a provision has significantly better chances of being upheld than a complete ban on working in the industry.
• An IP Assignment Agreement that assigns all developments created in the course of work to the company, regardless of the author’s subsequent place of employment.
• Retention bonuses and long-term incentive programs (including stock options) that economically motivate key employees to remain with the company, replacing legal compulsion with financial incentives.

Conclusions

For most companies, the real risk of information leakage is not associated with hacker attacks, but with people who have legitimate access to data in the course of their work. Therefore, the key task for a business is to establish rules for the use of internal information in advance and set them out in legally sound agreements.

• An NDA is a basic and almost universally applicable tool for protecting confidential information in Ukraine. It protects not only your business but also your partners and counterparties who entrust you with their data.
• The effectiveness of an NDA depends primarily on the quality of its wording: a specific list of protected information, a clearly defined term, a procedure for returning materials, and combined liability for breaches.
• In Ukraine, outside Diia City, courts will almost always find an NCA unenforceable due to the constitutional right to work.
• In Diia City and European jurisdictions, an NCA may be enforceable, but only if it is proportionate: limited in duration, geographically specific, and accompanied by mandatory compensation.
• In most practical situations, a well-drafted NDA combined with a non-solicitation clause addresses the main business risks without the need for a legally weak and potentially contentious NCA.

Simply signing an agreement does not guarantee protection. The effectiveness of an NDA or NCA depends on how clearly confidential information, restrictions, and the parties’ liability are defined — as well as on how effectively the company can prove a breach in court.