Free non-disclosure agreement template
A free non-disclosure agreement template for Kenya. An NDA binds because the parties agreed it — there is no NDA statute — so the words have to do the work: define what is confidential, carve out what is not, and set a term. Where the information shared is personal data, the Data Protection Act applies on its own terms; section 30(1) prohibits processing without the data subject’s consent for specified purposes or one of the listed necessities, and no agreement between two other parties can set that aside.
What you still need to do
- Define the Purpose narrowly. Every other clause refers back to it, and a vague Purpose is a broad permission.
- Keep the carve-outs in clause 3. An NDA with no exceptions asks the receiving party to promise something they cannot perform, and is the version most likely to be argued over.
- Put a number of years in clause 7. Perpetual confidentiality over ordinary commercial information invites a dispute about whether the clause means anything.
- If personal data is being shared, this Agreement is not enough and is not a lawful basis. Section 30(1) of the Data Protection Act requires consent for specified purposes or one of the listed necessities, and that right is the data subject’s, not the parties’. Take advice and use a data sharing or processing agreement.
- Make sure whoever signs for a company has authority to bind it.
- Diarise six years from any breach — Limitation of Actions Act section 4(1)(a).
Why each clause is here
Every clause in this document is drawn from the provision named beside it, and the wording of each provision was read in the Act itself. Where the law fixes something a document cannot change, this is where it says so.
🔴 Define the Purpose narrowly and name it. Every later clause refers back to it — the permitted use, the people who may be told, and what has to be returned — so a Purpose written as "business discussions" gives the receiving party permission to use the information for almost anything. No Act we hold prescribes the wording of this clause.
🔑 Clause 3 is what keeps the agreement enforceable rather than merely long. Without the carve-outs, the receiving party is promising never to use information they may already have had or could learn anywhere — a promise a court is unlikely to read as intended, and one no sensible counterparty should sign. These four exceptions are the standard set in commercial practice. No Act we hold prescribes them.
Clause 5 exists because an NDA cannot override a legal obligation to disclose, and a clause that purports to is both unenforceable and misleading to the party relying on it. The right drafting is to permit the disclosure and require notice, so the disclosing party has the chance to go to court. No Act we hold prescribes this wording.
🔴 This is the clause people leave out and should not. Section 30(1) of the Data Protection Act provides that a data controller or data processor shall not process personal data unless the data subject consents to the processing for one or more specified purposes, or the processing is necessary on one of the listed grounds. Section 28(1) requires personal data to be collected directly from the data subject, subject to the exceptions in section 28(2). Those rights belong to the DATA SUBJECT, who is not a party to this Agreement — so two companies cannot agree between themselves to disapply them, and an NDA is not a lawful basis for sharing someone’s data.
Put a number in clause 7. A perpetual obligation over ordinary commercial information is the kind of term a counterparty strikes out, and one a court may read down. Section 4(1)(a) of the Limitation of Actions Act is the other reason dates matter: an action founded on contract may not be brought after six years from the date the cause of action accrued, which for a breach of this Agreement is ordinarily the date of the breach.
An NDA is an ordinary contract and no Act we hold requires it to be in any particular form, witnessed or registered. Where a party is a company, the person signing should have authority to bind it — a board resolution is the usual way to record that.
The provisions, in the Act’s own words
Spacing is normalised for reading. Every word is the Act’s.
A data controller or data processor shall not process personal data, unless— (a) the data subject consents to the processing for one or more specified purposes; or (b) the processing is necessary—
A data controller or data processor shall collect personal data directly from the data subject.
The following actions may not be brought after the end of six years from the date on which the cause of action accrued— (a) actions founded on contract