A Client NDA Clause That Almost Caused a Real Problem

The NDA looked standard — confidentiality around internal data, strategy documents, anything genuinely sensitive. Buried in a broader definition of "confidential information" was language broad enough to cover the fact that the engagement happened at all, which would have meant I couldn't reference the client by name, describe the work, or use it as a case study, ever, even in anonymized form.

I almost signed it without catching this, because the clause wasn't flagged as unusual — it was buried in a definitions section that reads like boilerplate on a first pass. A colleague who reviews contracts for a living caught it when I mentioned the engagement in passing, and asked whether the NDA let me talk about it at all.

The clause that costs you later is rarely the one written in alarming language. It's the one written in boring language, in a definitions section nobody reads twice.

What I negotiated instead

• An explicit carve-out allowing reference to the engagement's existence and general nature, with specific sensitive details still protected.
• A requirement that any case study content be submitted for client approval before publishing, which is a reasonable ask and easy to agree to.
• A defined post-engagement date after which more detail could be shared, rather than an indefinite blanket restriction.

The client's legal team agreed to all three changes without pushback, which told me the original broad language wasn't a deliberate attempt to silence case studies — it was just unexamined boilerplate, copied from a template built for a different kind of vendor relationship. I now read every NDA's confidentiality definition specifically looking for whether it would block future case study use, because that single clause type is the one most likely to be broad by accident rather than by design.