Reviewing a Non-Disclosure Agreement in the UAE: Which Clauses Actually Define the Scope of Protection?

What does the new UAE law say about confidential information?

The Civil Transactions Law issued by Federal Decree-Law No. 25 of 2025 came into force on 1 June 2026, replacing the Civil Transactions Law of 1985. ^{[1, 2]} The new law contains specific provisions on pre-contractual negotiations, which is the stage at which most NDAs are signed.

Article 121 provides that negotiations must be started, conducted and ended in good faith, that negotiating does not oblige anyone to conclude a contract, and that a party who negotiates or breaks off in bad faith is liable for the actual loss the other party suffers, not for the profit it expected from the contract. ^{[1, 2]} Article 122 requires each party to tell the other about information of decisive importance to its consent, and the parties cannot agree to limit or exclude this duty. ^{[1, 2]}

Article 123 is the most relevant here: anyone who uses or discloses, without permission, confidential information obtained in connection with negotiations or a contract is liable under the general rules. ^{[1, 2]}

Why is the statutory rule not enough?

Article 123 sets out the principle of liability, but it does not answer the questions disputes usually turn on: what counts as confidential, what use is permitted, who may see it and when the obligation ends. A written agreement settles those questions.

WIPO describes an NDA as a binding contract that creates a confidential relationship, in which the recipient undertakes not to pass the information to third parties or use it for anything other than the stated purpose, and stresses that the obligation only works if the information covered is clearly identified. ^[3]

How do you define confidential information without losing protection?

The definition is the foundation of the agreement. The usual mistakes are making it so broad that it becomes meaningless, such as “all information relating to the company”, or so narrow that it covers only “trade secrets”. WIPO suggests a definition wider than trade secrets, with examples of categories such as business plans, customer lists and formulas, combined with a way for the discloser to designate what it treats as confidential. ^[3]

In practice, a good definition covers three things:

• Categories: pricing, development plans, technical data, customer data and supplier terms.
• Form: written, electronic and oral information, and anything seen during site visits or demonstrations.
• Identification: marking documents, or a written notice summarising oral disclosures within an agreed period. WIPO expressly recommends dealing with orally disclosed information. ^[3]

Purpose and recipients: limiting use, not just disclosure

A specific purpose

Many agreements prohibit passing information to third parties but do not restrict how the recipient uses it. In most cases the real risk is not a leaked file, but the recipient using your pricing or plans in a competing bid or its own product.

So state the purpose in one specific sentence, such as “evaluating a possible contract for the supply of an e-learning platform”, and provide that any use outside that purpose needs written consent. WIPO treats defining the authorised uses, such as evaluating a possible deal or licence, as a core element of the agreement. ^[3]

Who may see the information?

The recipient is rarely a single person. There are the relevant employees, affiliated companies, legal and financial advisers and sometimes funders. The agreement should set out:

• who may receive the information, by role rather than by name, on a need-to-know basis;
• the recipient’s duty to bind those people to confidentiality at least as strict as its own, and its liability for their breaches;
• the rule on disclosure to anyone else, which is a prohibition unless there is written consent.

WIPO advises limiting what is shared with third parties to what is necessary and keeping a record of who holds copies of confidential documents. ^[3]

Exclusions, duration and ending

Exclusions and compelled disclosure

Standard exclusions include those WIPO names expressly: information that becomes public through no fault of the recipient, and information the recipient can show it developed independently. ^[3] Agreements usually add information the recipient already knew before disclosure or received from a third party without restriction.

More important than listing an exclusion is deciding who must prove it: put the burden of showing that an exclusion applies on the recipient. Add a compelled-disclosure clause: if a court or regulator demands the information, the recipient notifies the discloser promptly where the law allows and discloses only what is required.

Duration and return or destruction

Set two separate periods: the period during which information is exchanged, and how long the confidentiality obligation survives after the exchange ends. The parties can agree that certain categories, such as technical know-how, stay protected for as long as they remain confidential.

When the purpose ends, or on the discloser’s request, the recipient returns or destroys the information and confirms this in writing, which WIPO includes in its guidance on managing confidential documents. ^[3] Do not forget back-ups and email: if they cannot technically be erased, agree that they remain confidential and are isolated from use.

When the exchange includes personal data

Customer, trainee or employee files are personal data, and an NDA does not by itself deal with the obligations that come with processing them. At federal level, the Personal Data Protection Law prohibits processing without the data subject’s consent except in specified cases, requires a processor to follow the controller’s instructions and contracts and to erase data when the period ends, and sets conditions for transferring data outside the country. ^[4]

The federal law does not apply to companies in free zones that have their own data protection legislation, ^[4] so check which law applies to each party. The practical rule: do not share real personal data at the evaluation stage if substitute data will do.

Common mistakes at signing

Even a well-drafted NDA can lose its effect through simple procedural mistakes. The most frequent are:

• Signing after disclosure has started: if files were exchanged before signing, state that the agreement covers information disclosed from a specified earlier date.
• The wrong party: one group company signs while another receives the information. Name the parties by their legal names and list the affiliates covered.
• The other side’s one-way template: it protects only the discloser, yet you will be disclosing too. Establish which way information will flow before accepting any template.
• Conflict with the main contract: if a later contract has its own confidentiality clause, or states that it supersedes all prior agreements, make clear which text governs the information exchanged before signing.
• No governing law or forum: state both expressly, especially where one party is abroad or in a free zone.

Hypothetical example: evaluating an e-learning platform

Hypothetical example: A training centre in Dubai is evaluating an e-learning platform supplier, which needs its development plan, price list and a sample of subscriber records.

The team defined the purpose as evaluating a contract for the platform within three months, limited recipients to the supplier’s project team and its legal adviser, and required a written notice within a set number of days for anything presented orally in meetings. Instead of real subscriber records it provided a test file with substitute data, and required copies to be destroyed and a certificate provided at the end of the evaluation, with any back-ups that could not be erased remaining protected. The wording went to the legal adviser before signing.

Conclusion

The new UAE law establishes liability for using or disclosing confidential information without permission, but it is the agreement that draws the boundaries of protection. Before signing, check five clauses: definition, purpose, recipients, exclusions and ending, and treat personal data as a separate matter with its own law.