TL;DR
Below is the mutual non-disclosure agreement we use to open every conversation on a $5–50M business acquisition — the exact wording, and the reasoning behind each clause. Download the .docx → if you want to skip straight to filling it in.
Two things worth saying up front:
- This is a template, not legal advice. Every NDA should be reviewed by counsel for your jurisdiction and the specifics of your deal. What follows is the version we use as a starting point.
- Mutual, not one-way. In LMM M&A, both sides are exchanging sensitive information — the buyer's return criteria, the seller's financials, the intermediary's buyer list. A one-way NDA where only the buyer signs is a red flag; sellers who care about confidentiality should be signing too.
What an M&A NDA actually needs to do
Most NDA templates on the internet are written for tech-startup pitch conversations. They're too broad ("all information exchanged"), too long (5+ pages), and miss the four things that actually matter in an M&A transaction:
- Define "confidential information" specifically. Not "everything" — that's unenforceable. Name the categories: financial records, customer lists, employee compensation, pricing strategy, trade secrets.
- Bind the recipient's advisors. Buyers bring in lawyers, accountants, lenders. The NDA needs to explicitly extend to representatives, and require the buyer to be responsible for their compliance.
- Non-solicit — and be specific about scope. A generic "won't hire your people" is meaningless. Name the classes: senior management, customers, and key vendors. Time-bound it (12–24 months is defensible; 5 years reads as overreach and courts will strike it).
- Return-of-materials clause with teeth. Not just "destroy on request" — spell out that the recipient will certify destruction in writing within 10 business days, and the residual-knowledge exception (memory doesn't count as retained material) is disclosed explicitly.
Every other clause is boilerplate. Get these four right and you have a defensible agreement.
The template, section by section
Here's the full text. Comments in [BRACKETS] are what you replace before sending. Annotations after each section explain why the wording is what it is.
1. Parties + effective date
MUTUAL NON-DISCLOSURE AGREEMENT
This Mutual Non-Disclosure Agreement (this "Agreement") is entered into as of
[EFFECTIVE_DATE](the "Effective Date") by and between[BUYER_LEGAL_NAME], a[STATE][ENTITY_TYPE]("Buyer"), and[SELLER_LEGAL_NAME], a[STATE][ENTITY_TYPE]("Seller") (each a "Party" and collectively the "Parties").
Nothing tricky here — just make sure you're using the full legal names, not d/b/a names. If you don't have a signed engagement letter naming the seller entity, ask for it before you sign. Sellers who won't share their legal entity name are hiding something.
2. Purpose
The Parties wish to discuss a potential business transaction involving the possible acquisition by Buyer of
[SELLER_LEGAL_NAME]or substantially all of its assets (the "Transaction"). In connection with evaluating the Transaction, each Party (as "Disclosing Party") may disclose Confidential Information to the other Party (as "Receiving Party").
"Potential" is doing important work here — it means the NDA doesn't obligate either party to actually pursue the deal. Some NDAs try to slip in an exclusivity term at this stage; strike it. Exclusivity is a separate document at LOI time.
3. Definition of confidential information
"Confidential Information" means any non-public information disclosed by the Disclosing Party to the Receiving Party, whether orally, in writing, electronically, or by inspection, including without limitation: (a) financial statements and projections, tax returns, capitalization tables, and debt schedules; (b) customer lists, customer contracts, and pricing terms; (c) employee lists, compensation, and organizational structure; (d) supplier and vendor identities and terms; (e) intellectual property, trade secrets, know-how, and proprietary technology; (f) business plans, marketing strategies, and forecasts; and (g) the existence and status of the discussions between the Parties, including that a possible Transaction is being contemplated.
This is the section every internet NDA gets wrong. Notice we're enumerating categories, not saying "everything." Also notice (g) — the fact that you're even talking is itself confidential. Sellers care about this a lot; nothing signals a stalled process to a seller's customers and employees like a rumor of a sale.
4. Exclusions
Confidential Information does not include information that: (a) is or becomes publicly known through no wrongful act of the Receiving Party; (b) was known to the Receiving Party prior to disclosure by the Disclosing Party, as evidenced by written records; (c) is independently developed by the Receiving Party without use of or reference to Confidential Information; or (d) is rightfully received by the Receiving Party from a third party without a duty of confidentiality.
Standard four exclusions. The one that comes up in disputes is (b) — the "we already knew" defense. That's why "as evidenced by written records" matters. Without that phrase, a bad-faith buyer can always claim they already had the information.
5. Obligations
The Receiving Party shall: (a) hold all Confidential Information in strict confidence; (b) use Confidential Information solely to evaluate the Transaction and for no other purpose; (c) restrict access to Confidential Information to those of its directors, officers, employees, attorneys, accountants, financial advisors, and financing sources (collectively, "Representatives") who have a need to know and who are bound by confidentiality obligations no less restrictive than those in this Agreement; and (d) be responsible for any breach of this Agreement by its Representatives.
The critical phrase is "be responsible for any breach... by its Representatives." This makes the recipient party the guarantor. Without it, if the buyer's accountant leaks something, you're chasing the accountant, not the buyer.
6. Non-solicit
For a period of
[NUMBER]months from the Effective Date (the "Restricted Period"), the Receiving Party shall not, directly or indirectly, without the prior written consent of the Disclosing Party: (a) solicit for employment or hire any senior management employee of the Disclosing Party's business; (b) solicit or induce any then-current customer of the Disclosing Party's business to terminate or reduce its relationship with the Disclosing Party; or (c) solicit or induce any then-current supplier, vendor, or key contractor of the Disclosing Party's business to terminate or materially adversely modify its relationship with the Disclosing Party.
Fill [NUMBER] with 12 or 18. 24 is defensible in most states; 36+ months will get struck by a court in California and most East Coast jurisdictions.
The three (a)(b)(c) categories are the ones that actually get litigated. Notice we don't say "any employee" — that's overbroad. Senior management is defensible. If the seller wants broader, they should ask specifically (e.g., "including the top 10 employees by compensation").
7. Return or destruction of confidential information
Upon the earlier of (a) the Disclosing Party's written request or (b) the termination of discussions regarding the Transaction, the Receiving Party shall, within
[NUMBER]business days, return or destroy all Confidential Information (including all copies, extracts, summaries, and derivative works), and shall provide written certification of such destruction signed by an authorized officer. The Receiving Party may retain one archival copy solely for regulatory compliance or as required by its document retention policies, provided such copy remains subject to the confidentiality obligations herein.
Set [NUMBER] to 10 — long enough to be practical, short enough that the seller doesn't worry. The written certification clause is what makes this real; without it, no one actually deletes anything.
The archival exception is what your buyer's counsel will insist on. Grant it — most audit / regulatory retention requirements are legitimate, and the residual confidentiality obligation stays intact.
8. Residual knowledge
Notwithstanding the foregoing, the Receiving Party shall not be prohibited from using, for any purpose, general knowledge, skills, and experience retained in the unaided memory of its Representatives, provided such use does not involve the intentional recall of specific Confidential Information.
This is the one clause every buyer's lawyer will insist on and every seller's lawyer will resist. It's the residual-knowledge exception — the idea that you can't erase what people remember. Grant it — it's standard in institutional M&A and the alternative (banning your team from thinking about what they learned) is unenforceable anyway.
The "intentional recall" qualifier is the seller's protection: if a buyer's associate leaves and starts a competing business from a whiteboard of everything they memorized, that's still actionable.
9. No obligation, no agency
Nothing in this Agreement shall (a) obligate either Party to enter into any Transaction or further negotiation; (b) grant the Receiving Party any license or right in the Confidential Information beyond the limited evaluation purpose stated herein; or (c) create any agency, partnership, or joint venture between the Parties.
Boilerplate but important. Section (a) is the one that gets tested — sellers sometimes claim the NDA "obligated" the buyer to make an offer. It doesn't.
10. Remedies
The Receiving Party acknowledges that a breach of this Agreement may cause the Disclosing Party irreparable harm for which monetary damages would be inadequate, and that the Disclosing Party shall be entitled to seek injunctive relief and specific performance in addition to any other remedies available at law or in equity.
Injunctive relief matters because damages in an NDA breach are almost impossible to quantify. Without this clause, you're stuck arguing about "what would the harm have been if..."
11. Term
This Agreement shall commence on the Effective Date and continue in effect for a period of
[NUMBER]years, or until the closing of the Transaction (in which case the confidentiality obligations shall be superseded by the definitive agreements), whichever is earlier.
Set [NUMBER] to 3. Confidentiality obligations that last "in perpetuity" get struck in California and are hard to enforce anywhere. Three years is defensible and long enough to cover the practical lifecycle of the information (customer lists go stale, financials become historical).
12. Governing law + venue
This Agreement shall be governed by the laws of the State of
[STATE]without regard to its conflict-of-laws principles. Any disputes arising hereunder shall be resolved in the state or federal courts located in[COUNTY, STATE], and each Party consents to the exclusive jurisdiction thereof.
Pick a state that has friendly business courts. Delaware is common but overkill for LMM. In practice, use the state where the seller's business operates — it's harder for a buyer to fight the venue clause when they've already been diligencing an operating business there.
13. Miscellaneous
This Agreement constitutes the entire agreement between the Parties with respect to the subject matter hereof and supersedes all prior discussions and agreements. This Agreement may be executed in counterparts, including by DocuSign or similar electronic signature, each of which shall be deemed an original. Any waiver of any provision requires a signed writing from the waiving Party. If any provision is held unenforceable, the remaining provisions shall remain in full force and effect.
Standard. The "counterparts + electronic signature" phrasing is what lets you close the NDA over DocuSign without a wet-ink round.
14. Signature block
BUYER:
[BUYER_LEGAL_NAME]By: _______________________ Name:
[NAME]Title:[TITLE]Date: _______________________SELLER:
[SELLER_LEGAL_NAME]By: _______________________ Name:
[NAME]Title:[TITLE]Date: _______________________
Common mistakes we've seen (and fixed)
Three patterns that show up in NDAs sellers send us:
"5-year non-solicit on all employees." Too broad, too long. A court will strike the whole non-solicit clause rather than reforming it. Push back to 12–24 months on senior management + customers.
"Exclusivity during the evaluation period." This belongs in the LOI, not the NDA. If it's here, the seller is either inexperienced or trying to lock you in before you've seen anything.
"NDA remains in effect even after the deal closes." Contradicts standard M&A drafting — post-close, the definitive agreements govern confidentiality. If left in place, the parties can end up in a fight later over which document controls.
What happens after you sign the NDA
Once mutual NDAs are in place, the typical LMM M&A flow is:
Seller sends the CIM (Confidential Information Memorandum) — the marketing document with financials, business overview, and asking price. We wrote a guide on what actually goes into a good CIM that some readers find useful.
Buyer submits an IOI (Indication of Interest) — a non-binding letter with valuation range and structure.
Selected buyers get deeper diligence access — usually via a virtual data room. This is where NDAs matter most; violations tend to show up here.
Buyer submits LOI (Letter of Intent) — binding on process, non-binding on price. This is where exclusivity gets negotiated, if at all.
Download the .docx
Download the mutual NDA template as a Word document →
Fill in the bracketed fields, have your counsel review, and send via DocuSign or equivalent. Every clause above is in the .docx, formatted for a professional deal file.
If you want the whole M&A workflow — NDA templates, LOI generation, data room, Q&A tracking, and IOI comparison — all in one place, that's what Arendel is. We built it because we were sending NDAs like this one over Dropbox and DocuSign and email threads, and it was killing us.