Understanding Tattletale Clauses in NDAs: Key Issues and Responses

Here's How to Contract's quick take on tattletale clauses found in some NDAs and confidentiality provisions. These quick takes are from How to Contract's NDA Playbook, which we share as part of our NDA courses and All-Course Annual Pass.

What do these clauses do?

By when does the receiving party have to tell the disclosing party of the breach? What kind of breaches are covered? All or only material ones? How does this requirement overlap with data breach disclosure obligations under privacy laws? Whose breach has to be disclosed? Is it their employees, authorized parties, or any third party?

Sample clause

“Recipient will immediately notify Discloser if Recipient learns of any loss or any actual or attempted unauthorized access to, or use or disclosure of, any Confidential Information in the custody or control of Recipient or its Authorized Recipient. Recipient will cooperate with Discloser to investigate and mitigate any adverse effects.”

Big Issues

These clauses require the receiving party to notify and assist the disclosing party if there’s a breach of confidentiality obligations. They are sometimes called the "tattletale clause” because they require a party to report breaches by their own employees, representatives, or third parties. These clauses favor disclosing parties and are resisted by receiving parties.

Disclosing party’s issues and responses

Disclosing parties want immediate notice. They may need to act fast to pursue an injunction or take other action to prevent further harm. Script: “You have to tell us immediately. We need to know so we can take proactive steps to ensure our information qualifies as trade secrets. If we fail to take steps after disclosure, we could lose that status.”

Receiving party’s issues and responses

Receiving parties have to take care not to violate their other agreements or obligations to their employees. Whose knowledge triggers the requirement? Script: “If there is a legal requirement to disclose a breach, we'll notify you. Otherwise, we can't be in breach because some information was inadvertently disclosed. There's no other obligation to tell you every time we fail to meet a requirement. It also doesn't work in the real world. There’s rarely a smoking gun and we don’t want you coming after us.”

You can download this one-page Quick Take from the NDA and Confidentiality Learning Hub.