Confidentiality disputes between freelancers and clients are more common than payment disputes in some sectors — and far harder to resolve after the fact. Unlike a missed invoice, a confidentiality breach can result in injunctions, damages claims, and reputational damage that no late payment clause can compensate for. Getting your NDA or confidentiality clause right before work starts costs nothing. Getting it wrong after a breach costs considerably more.
NDA vs Confidentiality Clause vs Data Processing Agreement
The three instruments serve different purposes and are not interchangeable.
| Instrument | When Used | What It Covers | Required By |
|---|---|---|---|
| Standalone NDA | Before the service contract is signed — discovery, pitch, tender phase | Information shared pre-contract, covering both parties during evaluation | Neither party; contractual choice |
| Confidentiality clause (inside service contract) | During and after the engagement | Information shared while performing the services; survives termination | Neither party; contractual choice |
| Data Processing Agreement (DPA) | Whenever you process personal data on behalf of the client | GDPR-mandated processing rules, security, sub-processors, breach notification | GDPR Art. 28 — mandatory |
For most freelance engagements, a confidentiality clause inside the service contract is sufficient. Use a standalone NDA only when you are exchanging sensitive information before any contract exists — for example, during a competitive pitch where the client shares their product roadmap.
What Should Be Marked Confidential
A confidentiality clause is only as strong as its definition of "Confidential Information." The definition should explicitly include:
- Trade secrets — formulas, processes, business methods, technical know-how
- Client data — customer lists, pricing, margins, internal financial data
- Unreleased products and roadmaps — product designs, software source code, marketing plans
- Pricing and commercial terms — the rates you charge, the rates the client charges its own customers
- Personnel information — employee details, compensation, organisational charts
What Cannot Be Kept Confidential
The clause must also carve out information that is not protectable, because courts will void an over-broad clause in its entirety. Standard carve-outs include:
- Information already in the public domain at the time of disclosure
- Information independently developed by the receiving party without reference to the confidential information
- Information received from a third party with no confidentiality restriction
- Information required to be disclosed by law, regulation, or court order (with notice to the disclosing party where legally permitted)
Post-Termination Duration by Country
| Country | Typical Duration | Legal Basis | Notes |
|---|---|---|---|
| Germany | 2–5 years standard; indefinite for trade secrets | BGB §138; GeschGehG §2 | Clauses over 5 years for general info risk invalidity under §138 |
| France | No statutory limit; must be proportionate | Loi sur le secret des affaires (Art. L151-1 Code de Commerce) | Courts assess proportionality; 3 years is a safe default |
| Netherlands | No statutory limit; reasonableness test | BW Art. 6:248 | 2 years widely used and enforced |
| EU baseline | No EU-wide limit for contractual confidentiality | Directive 2016/943 (trade secrets only) | Trade secrets protected indefinitely while secret is maintained |
Mutual vs One-Way Confidentiality
A one-way (unilateral) clause protects only the client's confidential information — the standard position when a client shares business data with a freelancer.
A mutual clause protects both parties. Insist on mutual confidentiality when:
- You are sharing your own proprietary pricing models, methodologies, or creative processes
- You are disclosing client-specific customisations of your tools or frameworks
- The engagement involves co-development where both parties contribute intellectual property
Sample One-Way Confidentiality Clause (2-Year Tail)
"The Contractor agrees to hold all Confidential Information of the Client in strict confidence, not to disclose it to any third party without the Client's prior written consent, and not to use it for any purpose other than performing the Services under this Agreement. This obligation survives termination of this Agreement for a period of two (2) years. 'Confidential Information' means all non-public information disclosed by the Client to the Contractor in connection with the Services, whether disclosed in writing, orally, or by inspection of tangible objects, and whether or not marked 'confidential'."
Sample Mutual NDA Clause (Copy-Paste Ready)
"Each party ('Disclosing Party') may disclose Confidential Information to the other party ('Receiving Party') in connection with this Agreement. The Receiving Party shall: (a) hold all Confidential Information of the Disclosing Party in strict confidence using at least the same degree of care it uses to protect its own confidential information, but no less than reasonable care; (b) not disclose such Confidential Information to any third party without the Disclosing Party's prior written consent; and (c) use the Confidential Information solely for the purpose of performing its obligations under this Agreement. This obligation survives termination for two (2) years. Standard carve-outs apply for information that is: (i) publicly known without breach of this clause; (ii) independently developed; (iii) received from a third party without restriction; or (iv) required to be disclosed by law, provided the Receiving Party gives prompt written notice to the Disclosing Party."
GDPR Interaction: When You Need More Than an NDA
An NDA or confidentiality clause is a commercial agreement. GDPR is a regulatory obligation. They operate independently, and you need both when personal data is involved.
If your freelance work involves accessing, processing, or storing personal data belonging to the client's customers, employees, or prospects — even incidentally — you are a data processor under GDPR Art. 4(8). The client is the data controller. GDPR Art. 28 mandates a written Data Processing Agreement specifying:
- The subject matter, duration, nature, and purpose of the processing
- The type of personal data and categories of data subjects
- Your obligations and rights as processor (including sub-processor restrictions)
- Security measures (appropriate to the risk under Art. 32)
- Breach notification obligations
A DPA is not optional and cannot be substituted by an NDA. Failure to have one exposes both parties to regulatory action from the relevant supervisory authority.
Enforcement: What Happens If the Client Breaches
In Germany, breach of a qualifying trade secret gives rise to claims under GeschGehG §6 (injunction), §10 (damages including loss of profit and unjust enrichment), and §12 (recall and destruction of infringing documents). Courts can grant interim injunctions within days.
In France, the Loi sur le secret des affaires (transposing EU Directive 2016/943) provides equivalent injunctive and damages remedies through the tribunal judiciaire.
Across the EU, the Trade Secrets Directive (2016/943/EU) gives you a minimum floor: member states must provide injunctions, corrective measures, and compensation for damages caused by unlawful acquisition, use, or disclosure of trade secrets.
For general confidential information that does not qualify as a trade secret, you rely on contract law: breach of contract damages measured by your actual loss or the client's gain from the breach.
Generate a freelance contract with a properly drafted confidentiality clause — including post-termination tail, carve-outs, and GDPR DPA flag — using the Freelance Contract Generator.