Drafting an NDA in Malaysia: Key Clauses and Common Pitfalls

A Non-Disclosure Agreement (“NDA”) is often treated as a relatively standard document: define “confidential information”, prohibit disclosure, specify a duration, and sign.

In practice, the quality of the drafting can become critical when a dispute arises. Malaysian cases show that merely having a signed NDA does not necessarily establish that particular information was confidential or that a breach has occurred. Conversely, carefully drafted contractual obligations can provide protection that goes beyond the ordinary equitable duty of confidence.

So, what should a properly drafted NDA contain?

1. Define the Confidential Information — But Be Specific

One of the most important parts of an NDA is the definition of “Confidential Information”.

A common approach is to insert a long generic list:

That may look comprehensive, but it is not always particularly helpful.

In Dynacast (Melaka) Sdn Bhd & Ors v Vision Cast Sdn Bhd & Anor [2016] 3 MLJ 417, the Federal Court emphasised that a party alleging misuse of confidential information must sufficiently identify what information was actually confidential and allegedly misappropriated. Merely alleging that a defendant misappropriated the company's “private and confidential information” was insufficient.

A similar problem arose in Ganesh Raja a/l Nagaiah & Ors v NR Rubber Industries Sdn Bhd [2017] 2 MLJ 396, where the Court of Appeal stressed the importance of identifying the confidential information with specificity.

How should it be drafted?

Instead of simply writing:

consider identifying what is commercially valuable about the customer information, for example:

Instead of merely:

consider:

This is not simply about making an NDA longer. It is about identifying why the information deserves protection.

The decision in Worldwide Rota Dies Sdn Bhd v Ronald Ong Cheow Joon [2010] 8 MLJ 297 is illustrative. The Court recognised that information concerning customers, cost prices and customers' particular needs and requirements may constitute confidential information. The former employee had access to the company's costing information and customer information and subsequently used that knowledge competitively.

The lesson is simple: describe the substance of what you are protecting, rather than relying entirely on labels.

2. Consider Protecting Information That May Not Technically Be “Secret”

This is a particularly interesting drafting point.

Parties sometimes assume that an NDA can only cover information which would independently satisfy the legal test for confidential information.

That need not always be how the contract is structured.

In Inhome Group Sdn Bhd v Dream Home Structural Works Sdn Bhd & Anor [2025] MLJU 2129, the NDA contained an express provision recognising that information might be contractually required to receive confidential treatment even though it might not technically be secret or confidential in nature.

This illustrates an important distinction between:

the equitable doctrine of confidence, under which the court determines whether information possesses the necessary quality of confidence; and

the parties' contractual obligations, under which parties can expressly agree how specified information is to be handled.

A professionally drafted NDA can therefore go beyond simply saying:

Depending on the commercial circumstances, the parties can expressly identify categories of information that must be treated as confidential under the contract, even where there may later be an argument over whether every individual piece of information technically constitutes a trade secret.

This can be particularly useful for internal documents, working materials, commercial discussions, draft proposals, presentations and compilations of information.

There should nevertheless be sensible exclusions for information genuinely in the public domain, independently developed, or lawfully obtained from another source. The aim is not to label the entire world “confidential”, but to remove unnecessary uncertainty over information the parties genuinely intend to protect.

3. Don't Just Prohibit “Disclosure” — Restrict Use, Copying and Retention

Another common drafting weakness is an NDA that essentially says:

That addresses only disclosure.

What if the recipient never tells anybody else, but instead:

• downloads the information;
• sends it to a personal email account;
• copies it onto a personal device;
• uploads it to cloud storage;
• retains it after leaving employment;
• reproduces the information;
• uses it to prepare a competing proposal; or
• uses it for its own commercial benefit?

This is where Karen Yap Chew Ling v Binary Group Services Bhd [2023] 4 MLJ 792 is particularly instructive.

The case involved extensive copying of company information into the employee's personal control before she left to join a competitor. It demonstrates why an NDA should address unauthorised access, copying and retention, rather than focusing exclusively on onward disclosure.

Similarly, in Systemizer Technic Sdn Bhd v Tan Chee Heng & Anor [2024] MLJU 2321, confidential material was used in connection with soliciting the former employer's clients.

A stronger NDA should therefore regulate acts such as:

accessing, using, downloading, copying, reproducing, extracting, transferring, transmitting, retaining, storing, modifying or disclosing Confidential Information.

It should also expressly prohibit using the information for the recipient's own benefit or for the benefit of another person or competing business.

That is considerably more useful than a one-line promise not to “disclose”.

4. State Exactly What the Information May Be Used For

An NDA should not merely say what the recipient cannot do. It should also say precisely what the recipient can do.

For example:

or:

This is commonly called the Permitted Purpose.

Without it, a recipient may argue that although it did not disclose the information, the NDA did not expressly prevent the particular use that it made of it.

A properly drafted NDA therefore separates two obligations:

Non-disclosure: Who may receive the information?

Non-use: What may the recipient actually do with it?

5. Control Who Else May Receive the Information

In reality, confidential information is rarely seen by only the person signing the NDA.

A company may need to disclose it to its:

• directors;
• employees;
• accountants;
• lawyers;
• consultants;
• financiers; or
• related companies.

The NDA should identify Permitted Recipients and ordinarily limit disclosure to persons who genuinely need the information for the permitted purpose.

It should also address an important question:

Who is responsible if one of those people leaks the information?

Where appropriate, the NDA can require the receiving party to ensure that its representatives are subject to equivalent confidentiality obligations and make the receiving party responsible for breaches by persons to whom it has disclosed the information.

6. Deal With Return and Destruction — Including Electronic Copies

The NDA should explain what happens when:

• negotiations end;
• the transaction does not proceed;
• the business relationship terminates; or
• the disclosing party demands its information back.

Simply requiring the recipient to “return all documents” is increasingly inadequate.

Confidential information may exist in emails, downloads, phones, laptops, personal drives, cloud storage, messaging applications, backups and extracts incorporated into other documents.

The NDA should therefore consider requiring the recipient to:

return or permanently destroy the information and all copies, extracts and reproductions; delete electronic copies under its control; and, where appropriate, provide written certification confirming destruction.

There may need to be carefully drafted exceptions for automatic backups or documents that must legally or professionally be retained.

The importance of controlling electronic copies is particularly apparent from cases such as Karen Yap and Centek Ltd & Ors v Farrah Dheeba bt Shaiful Ridzuan & Ors [2021] 9 MLJ 548, where electronic records and forensic evidence played an important role.

7. Include the Usual Exceptions — But Draft Them Properly

Not everything should remain confidential simply because it happens to fall within a broad definition.

Common exclusions include information which:

• was already lawfully known to the recipient;
• becomes publicly available other than through a breach;
• is lawfully received from an independent third party; or
• is independently developed without using the confidential information.

The NDA should also deal with compelled disclosure.

For example, what happens if the recipient is ordered by a court or regulator to produce the information?

Instead of treating this automatically as a breach, the agreement can require the recipient, where legally permitted, to promptly notify the disclosing party, disclose only what is legally required, and reasonably cooperate with attempts to obtain protective measures.

8. Can an NDA Last Forever?

This deserves particular attention in Malaysia.

The short answer is:

Potentially, yes — but the drafting and nature of the information matter.

There is no reason why every category of information should necessarily receive the same confidentiality period.

For ordinary commercial information whose sensitivity diminishes quickly, a fixed period, for example, two, three or five years, may be appropriate.

But certain information may remain commercially sensitive for much longer. A genuine trade secret, proprietary formula, manufacturing process or enduring technical know-how may retain its confidential character indefinitely.

Malaysian case law also gives useful guidance.

In Dynacast, the Federal Court discussed Svenson Hair Center Sdn Bhd v Irene Chin Zee Ling [2008] 7 MLJ 903, which concerned continuing confidentiality obligations. The authorities recognise that the protection of confidential information after termination depends significantly on the express contractual terms and the circumstances of the case.

There is also a practical reason for this.

If a genuinely valuable trade secret remains secret ten years later, it would be commercially odd if the recipient could simply wait for a five-year NDA to expire and then disclose it.

A better drafting approach may therefore be to split the duration.

For example:

General Confidential Information: protected for five years following termination.

Trade Secrets: protected for so long as the information remains a trade secret or otherwise retains its confidential character.

This is usually more defensible and commercially sensible than indiscriminately declaring:

It also reduces the risk of the confidentiality obligation appearing to operate as a disguised restraint on lawful competition, particularly in an employment context.

9. Do Not Turn the NDA Into a Non-Compete

This distinction is particularly important in Malaysia because of s 28 of the Contracts Act 1950.

An NDA protects information.

A non-compete attempts to prevent someone from carrying on a business or profession.

Those are not the same thing.

In Ganesh Raja, the injunction sought was sufficiently broad that it would have prevented the defendants from contacting or transacting with the claimant's customers and suppliers. The Court of Appeal was concerned that the relief went beyond protecting confidential information and impinged upon restraint-of-trade principles.

So rather than drafting:

the NDA should ordinarily focus on the actual protected interest:

the recipient must not use specified confidential customer information obtained through the relationship for an unauthorised purpose.

The distinction can be crucial.

10. Think About Enforcement Before the NDA Is Signed

A good NDA should be drafted with the possibility of a future breach in mind.

If information is leaked tomorrow, what does the innocent party actually need?

Depending on the circumstances, the NDA may address:

• injunctive relief;
• return/delivery-up and destruction;
• damages;
• account of profits;
• preservation of confidential materials;
• governing law and jurisdiction; and
• contractual consequences of breach.

Malaysian cases show that injunctions, delivery-up orders, damages and accounts of profits can all become relevant remedies in confidentiality disputes.

But drafters should be cautious about simply inserting:

A contractual figure does not necessarily mean that the court will automatically award that amount. The operation of s 75 Contracts Act 1950 and the requirement for reasonable compensation must be considered.

The Takeaway

An effective NDA is not necessarily the one containing the longest definition of “Confidential Information”.

It is one that answers practical questions clearly:

What exactly are we protecting? Who may access it? Why are they receiving it? What are they permitted to do with it? What are they prohibited from doing? How must it be stored? When must it be returned or destroyed? How long does protection continue? And what happens if the agreement is breached?

The Malaysian cases provide an especially important drafting lesson: specificity matters.

Instead of simply writing “customer list”, identify the non-public customer information that carries commercial value.

Instead of merely prohibiting “disclosure”, regulate access, use, copying, downloading, retention and transfer.

And instead of automatically imposing the same confidentiality period on everything, consider whether different categories of information require different periods of protection — including continuing protection for genuine trade secrets.

An NDA should ultimately be drafted around the information, the relationship and the commercial risk involved, rather than treated as a generic template to be signed before information changes hands.

This article is intended for general information only and does not constitute legal advice. Legal advice should be obtained based on the specific agreement, information and circumstances involved.