One-way vs mutual confidentiality agreement

A seller asked to sign a confidentiality agreement, or to send one, will meet two shapes of the same document. In one, only the party receiving information is bound. In the other, each side promises to protect what it gets. “One-way” and “mutual” are labels for these two shapes; the sources cited here do not use them, so this page works from what BDC and the federal privacy statute say about who is bound. The difference matters because a seller may be handing over financials, customer details and staff information, and the buyer may have information of its own to protect.

What a one-way agreement is

A one-way agreement puts the duty on one side: the party that receives information. BDC describes a confidentiality agreement as a document, prepared before or alongside the letter of intent, in which a party undertakes not to use, disclose or permit the disclosure of confidential information transmitted to it during the negotiations and the due diligence process, except to evaluate its participation in the proposed transaction. Read as written, that duty sits with the party receiving the information. In a sale, ask whether that party is the prospective buyer.

What a mutual agreement is

A mutual agreement binds both parties, so each promises to protect what the other discloses. BDC says the letter of intent is very often preceded by a confidentiality agreement that aims to protect the information and documents belonging to both parties. That wording describes an agreement covering both sides’ information. A buyer may disclose its financing arrangements, plans for the business or its own customer data, and a mutual form can cover those under the same promise.

What the privacy statute adds

Federal privacy law shows both directions in two stages. Under s.7.2(1) of the Personal Information Protection and Electronic Documents Act (PIPEDA), organizations that are parties to a prospective business transaction may use and disclose personal information without the knowledge or consent of the individual if they have entered into an agreement that requires the organization that receives the information to use and disclose it solely for purposes related to the transaction, protect it by security safeguards appropriate to the sensitivity of the information and, if the transaction does not proceed, return it to the organization that disclosed it, or destroy it, within a reasonable time. The information must also be necessary to determine whether to proceed with the transaction and, if so, to complete it. If the transaction is completed, s.7.2(2) sets different conditions, including an agreement that requires each of the parties to meet them and notice to the individual, by one of the parties, within a reasonable time after completion. Section 7.2 applies in addition to ss.7(2) and (3), and s.7.2(4) excludes a transaction whose primary purpose or result is the purchase or sale of personal information. Where Quebec’s private-sector privacy law applies, it has its own text.

Why the direction of the duty matters

The Canadian Intellectual Property Office says a trade secret is business information that derives its value from its secrecy, and lists non-disclosure or confidentiality agreements among the ways to keep it secret. It adds that once a trade secret is made public, it loses its business value and legal remedies become complex. For a seller, that is one reason to have the receiving party bound before the financials are shared. BDC adds that a letter of intent is not intended to be fully binding unless expressly stipulated, but where it so provides it will create binding obligations, particularly on confidentiality and exclusivity, so check whether the letter of intent repeats, narrows or replaces what the earlier agreement said. For the question of whether the two names mean the same document, see is a confidentiality agreement the same as an NDA.

Factors that point to one form or the other

• If only the seller’s information will be shared, a duty on the receiving party covers what is being disclosed; if the buyer will also disclose financing, plans or customer data, a duty on both parties covers that too.
• If personal information of customers or employees will be disclosed, check whether the agreement has the terms PIPEDA s.7.2 lists for using and disclosing it without the individual’s knowledge or consent, or those in Quebec’s private-sector Act where it applies.
• If the document is silent on what happens when the deal does not proceed, check whether it requires return or destruction of the information.
• If the parties include a company, its owner personally or advisers, confirm who actually signs and is bound.