NDA vs Confidentiality Clause in South Africa

Both vehicles rest on the same South African common-law foundation. In Van Castricum v Theunissen 1993 (4) SA 93 (T), the court confirmed that a duty of confidentiality arises either contractually (express or implied) or in equity where the recipient receives information in circumstances importing an obligation of confidence. The Supreme Court of Appeal in FirstRand Bank Ltd v Wright 2020 ZASCA 94 reaffirmed that confidentiality obligations — whether standalone or embedded — are ordinary contractual terms enforceable under the reasonableness test articulated in Basson v Chilwan 1993 (3) SA 742 (A) when they operate as restraints.

The statutory overlay is POPIA. Section 19 of the Protection of Personal Information Act 4 of 2013 imposes a mandatory duty on every responsible party to secure the integrity and confidentiality of personal information by taking "appropriate, reasonable technical and organisational measures". Where the confidential information includes personal information of data subjects, the confidentiality instrument must align with POPIA\'s security-safeguards condition. Standalone NDAs make this easier to do deliberately; embedded clauses often inherit a generic data-protection clause elsewhere in the host contract, which can create alignment problems when the information flow does not match the primary commercial purpose.

A standalone NDA is the correct instrument where the confidentiality exchange precedes, exceeds, or outlives the commercial relationship. Classic use cases are M&A due diligence, venture-capital fundraising, product evaluation by a prospective customer, outsourced technical reviews by consultants, and multi-party JV discussions where no master contract yet exists. Because the NDA is self-contained, it can bind parties who will never be counterparties to the eventual deal (a corporate advisor, a prospective investor who ultimately declines).

A confidentiality clause is correct where the confidentiality obligation arises directly from, and is co-extensive with, an existing commercial relationship. Examples are the confidentiality clauses in an employment contract (where the employer-employee relationship supplies the context), in a shareholders\' agreement (where the parties are already bound by reserved-matters and information rights), or in a services agreement. The host contract supplies the definitions, duration, and remedies. The drafting risk is that the clause is often treated as boilerplate and fails to address post-termination survival, return of information, or subcontractor obligations — defects that a standalone NDA is less likely to carry because it is negotiated on its own terms.

The most common drafting failure in South African confidentiality instruments is the definition of "Confidential Information". Courts routinely refuse to enforce broad, catch-all definitions that effectively cover every communication between the parties. The information must be identifiable, not trivial, and not already in the public domain (FirstRand v Wright confirms that publicly available information cannot be the subject of a confidentiality claim).

The second failure is duration. A confidentiality clause that simply says "the receiving party shall keep the information confidential" with no end date raises a real risk of being held unreasonable. Best practice is an express period (3–5 years for commercial information, indefinite for trade secrets), coupled with clear return-or-destroy obligations.

The third failure is the interaction with POPIA. Where personal information is disclosed, the instrument should expressly incorporate the responsible-party / operator construct, specify sub-processor consent, and spell out cross-border transfer restrictions under POPIA section 72. Standalone NDAs handle this more cleanly than embedded clauses, which often rely on a separate POPIA clause elsewhere in the host contract — creating potential conflicts.

Finally, remedies. The common-law interdict is available as of right, but liquidated damages require an express pre-estimate of loss (Sasfin v Beukes 1989 principles). Standalone NDAs typically include them; embedded clauses rarely do.

South African courts do not distinguish in principle between NDAs and confidentiality clauses when considering enforceability — both are contractual, both are tested against the ordinary rules of contract and (where they restrain trade) the reasonableness test in Basson v Chilwan. In practice, however, standalone NDAs are easier to enforce because the definitions and remedies are negotiated with the single purpose of protecting confidentiality.

Interdict applications under the common law (Setlogelo v Setlogelo 1914 AD 221) require a prima facie right, a well-grounded apprehension of harm, the balance of convenience, and no alternative remedy. Plaintiffs relying on standalone NDAs typically satisfy these requirements more easily because the NDA itself demonstrates the commercial value of the information and the parties\' shared understanding of its sensitivity. Plaintiffs relying on embedded clauses must often first prove that the host contract is valid and that the clause survives termination — an additional evidentiary burden. For this reason, transactional lawyers routinely recommend a standalone NDA even where a host contract already exists, whenever the confidentiality exchange is commercially significant.