Free NDA Template
for the UK
A non-disclosure agreement governed by the law of England & Wales, Scotland or Northern Ireland. Includes UK GDPR and Data Protection Act 2018 compliance, AI tools prohibition, standard exclusions and injunctive relief clause. No signup required.
- No signup required
- Free forever
- Reviewed June 2026
- UK GDPR clause included
Branding (optional)
1 — Disclosing Party
2 — Receiving Party
3 — Purpose, Term & Jurisdiction
PDF: choose "Save as PDF" in the print dialog.
Non-Disclosure Agreement
Effective Date: enter date above
1. Parties
Disclosing Party: Disclosing Party name
Receiving Party: Receiving Party name
2. Permitted Purpose
Information may only be used for: the Purpose.
3–9. Standard Clauses
Confidential information definition · Standard exclusions · Obligations · Permitted disclosures · UK GDPR compliance · AI tools prohibition · Return of materials · Remedies
10. Governing Law & Jurisdiction
Term: 2 years
Governing law: England and Wales. The courts of England and Wales shall have exclusive jurisdiction.
Disclosing Party
Signature
Print name: _______________
Title: _______________
Date: _________________
Receiving Party
Signature
Print name: _______________
Date: _________________
Template preview
Parties
1. Agreement Parties
This Non-Disclosure Agreement ("Agreement") is entered into on [Date] between [Disclosing Party Name], [Registered Address] ("Disclosing Party"), and [Receiving Party Name], [Address] ("Receiving Party"). Only the Disclosing Party will disclose Confidential Information under this Agreement.
Confidential Information
2. Definition of Confidential Information
"Confidential Information" means all non-public information disclosed by the Disclosing Party in any form — written, oral, electronic, visual or otherwise — that is marked "Confidential" or that a reasonable person would understand to be confidential in the circumstances, including but not limited to: business plans, financial information, customer and supplier lists, pricing, technical specifications, software, trade secrets, processes, intellectual property, and personal data (as defined under the UK GDPR).
Exclusions
3. Standard Exclusions
Confidentiality obligations under this Agreement do not apply to information that: (a) is or becomes publicly available through no breach by the Receiving Party; (b) was rightfully known to the Receiving Party before disclosure without restriction; (c) was independently developed by the Receiving Party without reference to the Confidential Information; or (d) is required to be disclosed by law, court order, regulatory authority or the rules of a recognised investment exchange, provided the Receiving Party gives prior written notice to the Disclosing Party where permitted.
UK GDPR Compliance
4. Data Protection — UK GDPR and DPA 2018
To the extent that Confidential Information includes personal data (as defined by the UK General Data Protection Regulation and the Data Protection Act 2018), the Receiving Party shall process such personal data only for the Permitted Purpose, shall implement appropriate technical and organisational measures to protect it, and shall not transfer it outside the United Kingdom without the prior written consent of the Disclosing Party and in compliance with Chapter V of the UK GDPR.
📄 Download the full template — includes AI tools prohibition, permitted disclosures, return of materials and injunctive relief under English or Scottish law.
Download the full template — free
Fill in your details above and download a ready-to-send UK NDA.
What's included in this template
How to use this UK NDA template
Choose your governing law based on where both parties are based
If both parties operate in England or Wales, select "England and Wales" — this gives access to the High Court and Commercial Court, which have extensive NDA and trade secret enforcement expertise. If both parties are based in Scotland, Scottish law and the Court of Session are equally appropriate. If parties are split across borders, England and Wales is the most commonly chosen governing law for UK commercial NDAs. Note that the governing law choice does not prevent either party from seeking an emergency injunction (interim interdict in Scotland) in whichever court is most readily accessible at the time of a breach.
Add a UK GDPR / Data Processing Agreement if the confidential information includes personal data
This NDA includes a UK GDPR compliance clause, but if you are sharing significant volumes of personal data — employee records, customer lists, health data, or financial data linked to identifiable individuals — a standalone Data Processing Agreement (DPA) is required under Article 28 of the UK GDPR. The DPA formalises the controller–processor relationship, specifies technical and organisational measures, and sets out the data subject rights procedure. The NDA's UK GDPR clause covers incidental personal data within business information; it is not a substitute for a full DPA when data processing is the primary activity.
Electronic signatures are fully valid in the UK under the Electronic Communications Act 2000
You do not need wet-ink signatures for a UK NDA. Electronic signatures — including typed names, scanned signatures, and e-signature platform signatures — are legally valid for simple contracts in the UK under the Electronic Communications Act 2000 and the Electronic Signatures Regulations 2002. For the highest evidential weight, use a qualified electronic signature (QES) platform such as DocuSign or Adobe Sign, but for standard commercial NDAs a simple e-signature is sufficient. Use Bonsai for fast, tracked e-signatures on this agreement.
Get it signed before any disclosure — UK NDAs have no retroactive effect
A UK NDA protects information disclosed after the agreement is signed. Information shared before signing carries no contractual confidentiality protection. This is particularly important in UK business culture, where it is common to share overview materials or pitch decks informally before formalising terms. Always send the NDA first, get both signatures, and then disclose. If you need to share something urgently before signing, follow up immediately in writing stating that the information was shared in confidence pending execution — this may provide some equitable protection. The Limitation Act 1980 gives you six years from the breach to bring a claim under the agreement.
Frequently asked questions
- Yes. An NDA is fully legally binding in the UK when signed by both parties and meeting the standard requirements for a valid contract: offer, acceptance, consideration, and certainty of terms. A signed NDA does not need to be witnessed, notarised, or executed as a deed to be enforceable — a simple signed agreement is sufficient. The consideration is the exchange of promises: the disclosing party agrees to share information; the receiving party agrees to keep it confidential. UK courts routinely enforce NDAs and will grant injunctions to prevent imminent breaches where monetary damages would be an inadequate remedy.
- No. A standard UK NDA does not require a witness or deed execution. A simple contract signed by both parties — including electronic signatures — is legally sufficient and binding from the moment of signature. If you want the NDA to carry a 12-year limitation period (rather than the standard 6 years under the Limitation Act 1980), you may execute it as a deed, which requires each party's signature to be witnessed by an independent adult. For most commercial NDAs, a 6-year limitation period is more than adequate and a simple signed contract is the standard approach used by UK solicitors.
- If both parties are based in England or Wales, choose "England and Wales." If both parties are in Scotland, Scottish law is appropriate. If parties are split between England and Scotland, England and Wales is the most common choice because the High Court and Commercial Court have extensive NDA and intellectual property enforcement expertise. Northern Ireland has its own legal system — use Northern Ireland law if both parties are based there. The governing law choice does not prevent a party from seeking an emergency injunction (in Scotland, an interim interdict) in whichever court is most immediately accessible at the time of a breach.
- Since Brexit (January 2021), the UK has its own data protection regime — the UK GDPR and Data Protection Act 2018. If the confidential information you share includes personal data (names, email addresses, employee records, customer data, financial data linked to individuals), the receiving party may become a data processor under UK GDPR, requiring a formal Data Processing Agreement (DPA) under Article 28. This NDA includes a UK GDPR clause covering incidental personal data within business disclosures, but it is not a substitute for a full DPA when data processing is the primary purpose. This template also prohibits the receiving party from transferring personal data outside the UK without written consent.
- Not without significant modifications. A US NDA typically references US state law (Delaware, New York, California etc.), US-specific remedies and court procedures, and contains no UK GDPR provision. Using it in a UK context creates problems: the governing law clause references a foreign jurisdiction; UK GDPR obligations are absent; "attorney" should be "solicitor"; and US injunction procedures differ from UK court procedure. This UK-specific template is drafted under English law, references UK data protection legislation, uses UK legal terminology and gives jurisdiction to the courts of England and Wales (or Scotland or Northern Ireland).
- A UK NDA can specify any confidentiality term, but courts will scrutinise excessively long terms as potential restraints of trade. For standard business NDAs, 1–3 years is enforceable without issue. For trade secrets with long commercial value, 3–5 years is defensible. Indefinite NDAs are generally enforceable for trade secrets (which have no statutory expiry under the Trade Secrets (Enforcement, etc.) Regulations 2018) but may be challenged for general business information. The Limitation Act 1980 gives 6 years to bring a breach of contract claim (12 years if executed as a deed), so the confidentiality term is separate from the limitation period on any claim for breach.
Bonsai handles e-signatures and secure document storage — used by freelancers and consultants across the UK.