Why Your NDA May Still Fail in Court

A signed Non-Disclosure Agreement (“NDA”) is important—but it is not conclusive proof that a breach has occurred.

When a confidentiality dispute reaches court, producing the NDA is only the starting point. The claimant must still identify the information said to be confidential, explain why it deserves protection and prove that the defendant used or disclosed it without authority.

Malaysian case law demonstrates a consistent theme: an NDA is only as effective as the information it protects and the evidence available to prove its breach.

1. You Cannot Identify the Confidential Information

One of the first questions the court is likely to ask is:

What exactly was the confidential information?

It may not be enough to rely on broad descriptions such as:

• customer lists;
• supplier information;
• pricing information;
• business strategies;
• technical know-how; or
• trade secrets.

These are categories of information—not necessarily the specific information allegedly taken or misused.

In Dynacast (Melaka) Sdn Bhd & Ors v Vision Cast Sdn Bhd & Anor [2016] 3 MLJ 417, the Federal Court emphasised the need to sufficiently identify the confidential information relied upon. General allegations that the defendants had misappropriated the claimant’s “private and confidential information” were inadequate.

Similarly, in Ganesh Raja a/l Nagaiah & Ors v NR Rubber Industries Sdn Bhd [2017] 2 MLJ 396, the Court of Appeal highlighted the importance of clearly identifying the information said to be confidential.

A claimant should therefore be able to say, for example:

That is much stronger than merely alleging that the defendant took a “customer list”.

The lesson is straightforward: before alleging that confidential information was misused, the claimant must know precisely what information it is referring to.

2. Calling Something “Confidential” Does Not Automatically Make It So

An NDA may define “Confidential Information” very widely. Some agreements attempt to cover virtually every piece of information relating to a company, its customers and its business.

Contracting parties may expressly agree that certain information must receive confidential treatment—even where an individual item might not independently amount to a trade secret.

However, merely applying the label “confidential” does not eliminate every dispute over the nature of the information.

The court may still consider matters such as:

• whether the information was already publicly available;
• whether it was commonly known within the industry;
• whether it had commercial value because it was not generally known;
• whether it was communicated in circumstances importing an obligation of confidence; and
• whether the company itself treated the information as confidential.

This means that a company’s conduct matters.

If supposedly confidential documents were freely circulated, accessible to everyone and never subjected to any access or security controls, the defendant may challenge whether the information was genuinely treated as confidential.

A company should therefore support its NDA with practical measures such as restricted access, password protection, document classifications, internal confidentiality policies and appropriate controls over downloads and external transfers.

3. You Cannot Prove That the Defendant Had Access to It

Even if the information is sufficiently identified and confidential, the claimant must connect it to the defendant.

Depending on the circumstances, this may require evidence showing that the defendant:

• received the information;
• had access to the relevant database or folder;
• downloaded or exported the files;
• forwarded them to a personal email address;
• copied them onto an external device;
• uploaded them to personal cloud storage; or
• obtained them through another person.

The strength of the evidential trail can determine the strength of the case.

In Karen Yap Chew Ling v Binary Group Services Bhd [2023] 4 MLJ 792, the former employee copied company information into accounts under her personal control shortly before leaving to join a competitor. The evidence involved a substantial database containing the company’s business partners, contacts and clients.

That factual link was far stronger than an allegation based only on the timing of the employee’s resignation.

4. You Suspect Misuse, but Cannot Prove It

A familiar commercial scenario looks like this:

An employee resigns, joins a competitor and soon begins dealing with some of the former employer’s customers.

The former employer may strongly suspect that its customer information was taken. But suspicion, even if understandable, is not necessarily proof.

In Jayonik Sdn Bhd v Agriquip Machinery Sdn Bhd, the existence of an NDA did not relieve the claimant of its obligation to establish what confidential information had actually been disclosed or misused. The claimant still had to prove the alleged breach.

By contrast, the cases in which confidentiality claims were stronger generally involved more concrete evidence.

In Systemizer Technic Sdn Bhd v Tan Chee Heng & Anor [2024] MLJU 2321, the evidence connected confidential business materials with the solicitation of the former employer’s customers.

In Inhome Group Sdn Bhd v Dream Home Structural Works Sdn Bhd & Anor [2025] MLJU 2129, the dispute involved identifiable material such as customer enquiries, quotations and technical drawings, together with evidence of how the former employee had dealt with that information.

The distinction is critical:

A competitor approaching the same customers does not, by itself, necessarily establish misuse. Evidence connecting the defendant to the protected information is required.

Relevant evidence may include emails, WhatsApp messages, file-access records, download logs, forwarded documents, device records, competing quotations containing distinctive information, witness testimony and forensic findings.

5. The Information Came From Somewhere Else

A defendant may admit possessing similar information but dispute its source.

For example, the defendant may argue that:

• the customer’s contact details were publicly available;
• the customer approached the defendant independently;
• the relevant pricing was commonly known in the industry;
• the information came from a lawful third party; or
• the defendant developed the material independently.

This is why the claimant must do more than point out similarities.

It should establish a credible chain showing:

1. what information it possessed;
2. how the defendant obtained access to it;
3. what the defendant subsequently did with it; and
4. why the similarity is unlikely to be coincidental or independently derived.

Distinctive internal errors, identical formatting, matching calculations, document metadata and unusually specific technical details may be particularly useful in establishing copying.

6. Your NDA Only Prohibits “Disclosure”

Some NDAs merely provide that the recipient must not “disclose” confidential information to another person.

That can create an avoidable argument where the recipient did not disclose the information but allegedly:

• retained it;
• copied it;
• used it to prepare a competing quotation;
• relied on it to undercut prices;
• used it to approach customers; or
• exploited it for personal or commercial benefit.

In Worldwide Rota Dies Sdn Bhd v Ronald Ong Cheow Joon [2010] 8 MLJ 297, the former employee had access to customer information, cost prices and the specific requirements of customers. The evidence showed that the information was used competitively, including in securing the former employer’s customers.

A well-drafted NDA should therefore regulate not only disclosure, but also unauthorised access, use, copying, downloading, extraction, transfer, storage and retention.

Otherwise, the claimant may find that the conduct complained of does not fit neatly within the wording of the obligation it seeks to enforce.

7. The Restriction Is Really a Non-Compete in Disguise

An NDA protects confidential information. It should not be used indiscriminately to prevent a person from working, competing or dealing with an entire market.

This distinction is particularly important in Malaysia because section 28 of the Contracts Act 1950 generally renders agreements in restraint of trade void, subject to its statutory exceptions.

The law does not ordinarily prevent a former employee from using general knowledge, experience and skills acquired during employment. The restriction should focus on the employer’s genuine confidential information.

In Ganesh Raja, the breadth of the restrictions and relief sought raised restraint-of-trade concerns because they went beyond preventing misuse of specific confidential information.

Accordingly, an NDA that effectively says:

may attract a different legal analysis from a clause providing:

The former restricts commercial activity broadly. The latter targets the misuse of protected information.

8. Your Evidence Was Lost or Destroyed

Confidentiality disputes frequently involve electronic evidence that can be altered or deleted quickly.

In Centek Ltd & Ors v Farrah Dheeba bt Shaiful Ridzuan & Ors [2021] 9 MLJ 548, the evidence included emails and WhatsApp messages concerning confidential materials and the deletion of electronic information. The Court upheld powerful interlocutory measures, including a delivery-up order designed to preserve devices and electronic records for examination.

The case illustrates why immediate action may be necessary when a breach is discovered.

Practical steps may include:

• preserving relevant email accounts;
• securing access and activity logs;
• preventing routine deletion of records;
• retaining original messages and attachments;
• making forensic copies of relevant devices;
• identifying cloud accounts and external storage; and
• obtaining urgent legal advice on preservation and injunctive relief.

Screenshots may be helpful, but they are not always a complete substitute for the original electronic records and their metadata.

If the evidence disappears, even a well-drafted NDA may become difficult to enforce.

9. You Cannot Justify the Damages Claimed

Proving a breach does not automatically prove the amount of loss.

In Karen Yap, the High Court awarded approximately USD10.1 million based on an expert valuation of the confidential information. The Court of Appeal set that award aside because the valuation methodology was considered artificial, speculative, unrealistic and unreliable.

There was insufficient evidence connecting the information taken with actual income-generating business or a properly established loss.

The case provides an important warning: a claimant cannot simply assign a large value to its database and assume that the defendant must pay that amount.

Similarly, inserting a clause stating that every breach will result in payment of RM1 million does not necessarily guarantee an award of RM1 million. Such a provision remains subject to section 75 of the Contracts Act 1950, including the principle of reasonable compensation.

The claimant should therefore consider evidence of:

• lost transactions;
• diversion of customers;
• reduced margins;
• investigative and remedial costs;
• profits earned through the misuse;
• the commercial value of the information used; and
• the causal connection between the breach and the loss claimed.

10. You Pursue Inconsistent or Duplicative Remedies

Depending on the facts, a claimant may seek remedies such as:

• an injunction against further use or disclosure;
• return or destruction of confidential materials;
• preservation or delivery-up orders;
• damages; or
• an account of profits.

However, these remedies should not be pleaded or pursued as though they are automatically cumulative.

In Karen Yap, the Court of Appeal held that the claimant could not recover both compensatory damages and an account of profits for the same wrong. It had to elect between the alternative monetary remedies.

The difference is important:

• Damages generally compensate the claimant for loss suffered.
• An account of profits generally requires the defendant to surrender profits obtained through the wrongdoing.

The appropriate remedy depends on the facts and available evidence. A claimant should therefore consider its remedial strategy carefully instead of merely seeking every conceivable order.

A Signed NDA Is Only the Beginning

An NDA can define the parties’ obligations, expand contractual protection and provide a clear framework for handling sensitive information. But when litigation begins, the claimant must still build a case supported by facts and evidence.

In practical terms, the claimant should be able to answer:

1. What exactly was the confidential information?
2. Why was it confidential or contractually protected?
3. How did the defendant obtain it?
4. What did the defendant do with it?
5. What evidence proves that conduct?
6. What loss or gain resulted from the breach?
7. What remedy is legally and commercially appropriate?

The Malaysian cases show why some confidentiality claims succeed while others fail. The stronger cases do not rely solely on the existence of an NDA. They identify the particular information involved and support the alleged copying, retention, disclosure or use with concrete evidence.

For businesses, the work therefore begins before any dispute arises. The NDA must be drafted around the actual information and commercial relationship, while access controls, record-keeping and evidence-preservation procedures must operate alongside it.

When a suspected breach occurs, obtaining early legal advice can be crucial. Delay may allow the information to spread, customers to be diverted and electronic evidence to disappear.

This article is intended for general information only and does not constitute legal advice. Legal advice should be obtained based on the specific agreement, information and circumstances involved.