How Long Should an NDA Last?

The short answer is the one you'll find on every other page: for ordinary business information, two to five years is typical, and anything in that range is usually enforceable. Two to three years is the most common.

If that's all you wanted, you have it. But that answer is also why so many NDAs fail the moment someone tries to rely on them. Because "how long should an NDA last" is actually two questions wearing one coat, and the people who get burned are the ones who only answered the first.

There are two clocks in every NDA. Most people only see one.

When you ask how long an NDA "lasts," you might mean one of two very different things:

1. The term of the agreement, how long the contract is alive and new disclosures are covered. Say you and a potential partner agree to swap confidential information for a year while you explore a deal. That one year is the term.
2. The survival period (sometimes called the restricted period), how long your duty to keep that information secret continues after the term ends or the relationship is over.

These are not the same number, and the second one is the one that actually protects you. A one-year term with a three-year survival period means: you exchange information for a year, and the obligation to protect anything disclosed during that year runs for three years after.

Here's where I've watched deals go sideways. People negotiate the term down, "let's just make it a one-year NDA", feeling like they've limited their exposure. Then a dispute comes up in month fourteen, and they discover the confidentiality obligation expired with the term, because no one drafted a survival period at all. The information they thought was protected for years was protected for exactly as long as the contract was open. That's not a hypothetical edge case. It's one of the most common drafting failures in short-form NDAs.

So the first real answer to "how long should it last" is: decide both numbers on purpose. A term that matches the length of the actual conversation, and a survival period, typically two to five years. That reflects how long the information stays sensitive.

When the clock starts matters as much as how long it runs.

A clause that says obligations last "three years" sounds precise until you ask: three years from what? Signing? The end of the relationship? Each individual disclosure?

A survival period measured from the signing date can quietly expire while you're still actively sharing information. A period measured from each disclosure keeps every piece of information protected for its full window, no matter when it changed hands. The second is almost always what the disclosing party actually wants, and it's almost never what the short free template they downloaded says.

This is the kind of thing that never comes up in the negotiation and decides everything in the lawsuit.

Trade secrets break the rules, and a fixed term can destroy them.

Now the part that does the most damage when it's missed.

A trade secret, your source code, your customer algorithm, your secret formula, is protected by law for as long as it remains secret. That protection comes from trade secret law, not from your contract: most states have adopted some version of the Uniform Trade Secrets Act, a few (notably New York) protect trade secrets under common law, and the federal Defend Trade Secrets Act of 2016 sits on top of all of it. The defining feature is that there's no expiration date. The protection lives as long as the secrecy does.

So watch what happens when you wrap a trade secret in a typical NDA that says "all confidentiality obligations terminate three years after the agreement ends." You've just told a court that the parties agreed your trade secret stops being protected on a date certain. Some courts will hold you to exactly that, your own contract becomes the evidence that you didn't treat the information as a perpetual secret. You took something the law would have protected forever and put a three-year fuse on it.

The fix is simple and almost always missing from form NDAs: carve trade secrets out of the fixed term. Ordinary confidential information is protected for, say, three years; trade secrets are protected for as long as they remain trade secrets. One extra sentence. It's the difference between a clause that protects your crown jewels and one that hands an opponent a defense.

Can an NDA last forever?

For ordinary business information, be careful here. A perpetual or indefinite confidentiality obligation on everything invites a court to ask whether it's reasonable, and an obligation a business can never escape, covering information that stopped being sensitive years ago, is the kind of term a judge may decline to enforce or read down. Overreaching doesn't make your NDA stronger; it gives the other side an argument that the whole clause is unreasonable.

The defensible structure is the layered one: a finite period for ordinary information, and indefinite protection reserved for genuine trade secrets, which the law already treats that way. That's not a compromise. It's the version most likely to actually hold up.

So what should your NDA say?

As a working default for a standard commercial NDA:

• Term: as long as the actual exchange of information needs, often one to two years, or tied to the life of the underlying relationship.
• Survival period for ordinary confidential information: two to five years after the term ends (three is a reasonable middle).
• Trade secrets: carved out, protected for as long as they remain secret.
• Start of the clock: measured from each disclosure, not just the signing date, if you're the one sharing sensitive material.

Those four choices matter more than the single number everyone fixates on. And which of them is right for you depends on which side of the NDA you're on, if you're mostly receiving information, you may want shorter, cleaner obligations; if you're mostly disclosing, you want the survival period and the trade-secret carve-out doing real work.

See how the NDA in front of you actually handles this.

Here's the practical problem: you can know all of this and still not be able to tell, at a glance, whether the NDA someone just sent you gets it right. Does it even have a separate survival period? Does it carve out trade secrets, or quietly put a fuse on them? When does its clock start?

That's exactly what YayNDA shows you. Drop in the NDA you were sent, and your own, or our free balanced template, and the tool compares them clause by clause, including how each one handles duration, and tells you which language is the stronger choice. You don't have to spot the missing survival period yourself. You just have to decide which version you'd rather sign.