If a business counterparty has breached your NDA, act quickly but in order. First confirm that the information it used falls within the NDA’s definition and is not caught by an exclusion. Then preserve the evidence, send a measured letter demanding that it stop, return or destroy the material and give written undertakings, and decide whether you need an urgent court injunction. Your company can usually claim for breach of contract, and often for breach of confidence as well. If personal data is involved, assess your own PDPA obligations in parallel, because those deadlines run separately.
This guide is for owners and directors whose confidential information was shared with another business under a non-disclosure agreement: a buyer or investor after a deal fell through, a prospective joint venture partner, a distributor or a supplier. Problems with former employees raise different issues and are covered in our guide on a former employee taking your clients and confidential information.
How do you know the NDA has actually been breached?
Suspicion is not enough. A distributor launching a similar product, or a failed bidder approaching your customers, may feel like a breach, but the company has to show that the other side used or disclosed information the NDA protects. Read the agreement against five questions before you say anything to the other side:
- Definition. Does the information fall within the definition of confidential information? Some NDAs protect only material marked “confidential”, or oral disclosures confirmed in writing within a set time. If you did not follow that procedure, the contractual claim may be weaker.
- Exclusions. Most NDAs exclude information that is already public, was already known to the recipient, was independently developed, or was received from a third party without restriction. Expect the other side to rely on these.
- Permitted purpose. NDAs usually allow use only “for the purpose of evaluating the proposed transaction”. Using the information to compete, price against you or approach your customers is outside that purpose.
- Permitted recipients. Check who the recipient was allowed to share with (directors, employees, advisers, financiers) and whether it is responsible for their breaches.
- Term. Confirm the confidentiality obligation was still running. Some NDAs expire after two or three years, or a set period after the talks ended.
If the NDA was signed as part of an MOU or term sheet, also check whether the confidentiality clause was expressed to be binding even though the rest of the document was not.
What if the NDA does not quite cover it?
The contract is not your only protection. Singapore law also protects confidential information through the equitable claim for breach of confidence. In I-Admin (Singapore) Pte Ltd v Hong Ying Ting [2020] SGCA 32, the Court of Appeal held that once the information has the necessary quality of confidence and was received in circumstances importing an obligation of confidence, a breach is presumed, and the defendant must show its conscience was not affected. The court described this modified approach as protecting the owner’s interest in avoiding wrongful loss, and later decisions have discussed how far it extends where the claimant’s complaint is that the defendant made a wrongful gain.
For a company dealing with a counterparty, this matters in two ways. Information exchanged in serious commercial negotiations will often be received in confidence even where the NDA is narrow, and a confidence claim can sometimes reach a third party who received the information knowing it was confidential. For a fuller explanation of the claim, see our guide to breach of confidence and protecting trade secrets.
What should the company do in the first week?
- Preserve the evidence. Keep the signed NDA, the data room access logs, the index of documents disclosed, emails attaching the information, meeting notes and the evidence of misuse (a customer’s email, a competing quotation, a product listing). Screenshot web pages with dates and URLs. Do not edit or “tidy up” files.
- Stop further disclosure. Close data room access, revoke shared drive links and stop any remaining exchanges with the counterparty.
- Map what was disclosed. Prepare a schedule of exactly which documents went to whom and when. Vague allegations of “our confidential information” rarely persuade a court.
- Check the dispute clauses. Note the governing law, whether disputes go to the Singapore courts or to arbitration, any notice requirements, and any clause in which the recipient accepts that damages would not be an adequate remedy.
- Assess personal data. If the information includes customer or employee personal data, start your PDPA assessment now (see below).
- Decide urgency. If the information is about to be used in a way that cannot be undone, such as a product launch or a mass approach to your customers, take legal advice on an interim injunction before sending a letter that gives the other side time to act.
What should the letter to the other side ask for?
In most cases the first formal step is a letter, from the company or from lawyers. The Rules of Court 2021 expect parties to consider amicable resolution before going to court, and a clear, specific letter also builds the record for any later application. The letter should:
- identify the NDA, the clauses breached and the information concerned, without repeating the confidential content in the letter;
- set out the evidence of misuse in factual terms;
- demand that the recipient immediately stop using and disclosing the information;
- require the return or destruction of all copies, including copies held by advisers and in backups, as the NDA allows;
- ask for written undertakings, signed by an authorised officer, by a short deadline;
- ask the recipient to identify everyone to whom it disclosed the information; and
- reserve the company’s rights to claim damages and seek an injunction.
Keep the tone measured. Threats that overstate your rights, or accusations made to the counterparty’s customers or the press, can create their own exposure. Our guide to sending a cease and desist letter covers the risks for the sender in more detail.
What remedies are available?
| Remedy | What it does | When it is most useful |
|---|---|---|
| Written undertakings | The recipient promises to stop, return or destroy material and not to use it | The breach is limited and the recipient wants to avoid litigation |
| Interim injunction | A court order restraining use or disclosure until trial | Ongoing or imminent misuse, where money would not repair the harm |
| Final injunction | A permanent order after the claim is decided | The information still has value and misuse could resume |
| Delivery up or destruction | Order to hand over or destroy documents and copies | The recipient still holds the material |
| Damages | Compensation for loss caused by the breach | Lost customers, contracts or price advantage can be proved |
| Account of profits | The defendant pays over profits made from the misuse | The recipient profited more than your provable loss |
Damages for breach of contract aim to put the company in the position it would have been in had the NDA been performed, and loss must be proved with evidence. Our guide to breach of contract damages explains how that loss is measured. Whether an account of profits is available depends on the claim and the facts, so take advice before choosing between remedies.
On timing, claims founded on contract are generally barred six years after the cause of action accrued under section 6(1)(a) of the Limitation Act 1959. In practice that is rarely the deadline that matters. An injunction is discretionary, and a company that waits months after discovering the misuse may find the court less willing to grant urgent relief.
What if personal data was involved?
If your company disclosed customer, employee or supplier personal data under the NDA and the recipient has misused or leaked it, your company may need to treat it as a possible data breach under the Personal Data Protection Act 2012. The Personal Data Protection Commission’s guidance is that an organisation must take reasonable and expeditious steps to assess whether a breach is notifiable, within 30 calendar days of having credible grounds to believe it occurred. A breach is notifiable if it is likely to result in significant harm to affected individuals or is of a significant scale (PDPC’s guidance uses 500 or more individuals). If it is notifiable, the PDPC must be told within 3 calendar days of that determination, and affected individuals generally must be told as soon as practicable.
This runs in parallel with the dispute and does not wait for it. The PDPC’s data breach reporting page sets out how to notify.
Example: a failed acquisition and a customer list
Example: This is a hypothetical scenario. A Singapore logistics company negotiates a sale to a larger competitor and, under an NDA, gives the bidder its customer list and contract rates through a data room. The talks end. Two months later, three of the company’s largest customers say the bidder has offered them rates slightly below their current contracts.
The directors download the data room logs, which show the bidder’s commercial team viewed the rates file several times. They confirm the NDA restricts use to evaluating the acquisition and that the confidentiality term runs for two years. They check that the customer list is not public. Because the bidder is still approaching customers, they take legal advice the same week. The lawyers send a letter demanding undertakings within a few days and prepare an injunction application in case the bidder refuses. The bidder gives undertakings, confirms destruction and identifies the employees who had access. The company keeps the evidence in case further approaches are made, and reviews whether any personal data in the file triggers a PDPA assessment.
Which NDA clauses help next time?
- A clear definition that does not depend on marking every document
- A narrow permitted purpose, with an express ban on using the information to compete or solicit customers
- A non-solicitation clause for customers and staff during and after the talks, where it is reasonable
- A list of permitted recipients, with the recipient responsible for their breaches
- Return or destruction on request, with a signed certificate of compliance
- An acknowledgement that damages may not be adequate and injunctive relief may be sought
- Governing law and a dispute forum that suits you, and a realistic confidentiality term
- Staged disclosure: send the most sensitive data (customer names, rates) only at a late stage, or in anonymised form. Our guide to an NDA before sharing customer data covers this.
Documents checklist
- Signed NDA and any MOU, term sheet or side letters
- Data room index, access logs and download records
- Emails and messages attaching or discussing the information
- Evidence of misuse, with dates
- Board minutes or notes on the decision to act
- Records showing the information was not public (internal access controls, confidentiality markings)
- Any correspondence with customers who were approached
Frequently asked questions
Can we sue if the NDA has expired?
The contractual obligation may have ended, but a breach of confidence claim may still be available if the information remains confidential and was received in confidence. Check whether any obligations were stated to survive termination.
The NDA says disputes go to arbitration. Can we still go to court for an injunction?
Often an arbitration clause still allows urgent interim relief from the court, and many arbitration rules also offer emergency arbitrators. Which route is faster depends on the clause, so check it at the start.
Does the NDA have to be signed to be enforceable?
Not always. A contract can be formed by conduct or by email acceptance, and a breach of confidence claim does not need a contract. An unsigned draft makes the case harder to prove, so keep the email trail.
Can we claim against the recipient’s adviser or new partner who received the information?
Possibly. A third party who receives information knowing it was disclosed in breach of confidence may be restrained. The NDA may also make the recipient liable for its advisers.
Should we tell our customers that the other company breached the NDA?
Be careful. Accusations to third parties can lead to a defamation or interference claim. Tell customers only what they need to know, in neutral terms, preferably after taking advice.
Need help with a breach of your NDA?
If your company, or you as a director or shareholder, is dealing with a counterparty that has breached an NDA or misused your confidential information, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines. Where your matter needs a lawyer, we will refer you to a firm on our panel of Singapore law firms that regularly handles commercial and confidential information disputes. Raffles Corporate Services is a corporate services provider, not a law firm, and this article is general information, not legal advice.
The Raffles Corporate Services Editorial Team, Raffles Corporate Services