Most NDAs Never Get Enforced – But You’d Be Stupid to Skip One

Most Indie deals never see NDAs enforced. But if you skip it, you're one dumb leak away from disaster.

In the indie and startup scene, you rarely see an NDA actually enforced.

Not in $2K Notion templates, not in $50K SaaS flips, not even in six-figure newsletter acquisitions.

So does that mean you shouldn't bother?

No.

The whole point of an NDA isn't enforcement. It's deterrence. It's the digital equivalent of a "Beware of Dog" sign. You might not own a Rottweiler, but you'd rather nobody hopped the fence to find out.

And sometimes having one isn't just sensible, it's a genuine legal consideration. Think GDPR, data handling, EU users. You're not only guarding against an opportunist. You're keeping yourself on the right side of regulators with terrifying acronyms.

What an NDA actually is

A promise with legal teeth.

A Non-Disclosure Agreement says: I'll let you look under the hood of my business, but if you run off and tell people what you saw, I have a contract that lets me come after you.

In indie deals, that usually covers:

• Source code
• Internal metrics such as MRR, churn and CAC
• Customer lists
• Roadmaps and unreleased features

You don't need a law degree. You do need to not be naive. If you're new to sizing up a business before you buy, our guide on how to buy a micro-business without getting screwed covers the wider ground an NDA sits inside.

Why bother if nobody enforces them

Two reasons: signal, and downside cover.

Signal. You're not a tourist. You take deals seriously, and that makes sellers open up faster.

Downside cover. Most of the time an NDA never gets called on. It earns its keep in the rare case where your shiny new asset gets cloned by someone who had access.

And then there's data protection. If you're handling personal data from EU users and it's shared without a lawful basis, the penalties are not small. For the most serious breaches, GDPR sets a ceiling of tens of millions or a percentage of global annual turnover, whichever is higher. That's a general point, not legal advice, and the exact exposure depends on your circumstances, so take proper counsel if EU personal data is in the deal. If the data itself is part of what's changing hands, the laws on selling a user database are worth reading before you agree to anything.

The indie checklist: what your NDA should cover

This isn't big law. Keep it tight and readable.

What counts as confidential. Spell it out. Source code, user data, product roadmaps, metrics. Be boringly specific.

Who's bound. Buyer, seller, and any advisors or developers who see the material. If they're in the room, they're in the document.

How long it lasts. One to three years is typical. Indefinite usually just means nobody thought about it.

What happens on a leak. At minimum, a clause that makes the consequences explicit, so both sides know a breach has teeth.

One-way or two-way

• Unilateral NDA. The seller shows you things and you keep quiet. The most common setup.
• Mutual NDA. You both share sensitive material. Use this when you're bringing your own IP, valuation frameworks or custom tools to the table.

Pick what fits the deal. Don't just grab the first template you find and cross your fingers.

When you actually use an NDA

Here's where it earns its place:

• Before you see the Stripe account
• Before you get access to the codebase
• Before you download the customer list
• Before anyone reveals pricing experiments or growth tactics

If you're poking around someone else's private numbers, you need permission and discretion. The same discipline applies once you're actually in the books. Doing technical due diligence properly is the natural next step after the NDA is signed.

An illustrative scenario: how skipping an NDA sank a deal

This one is made up to make the point, not a real deal, but it's the kind of thing that happens.

Picture Emma, a solo founder in Brighton. She's built a Chrome extension that auto-optimises LinkedIn posts for reach, using a combination of sentiment analysis and trending-topic injection. A neat little tool, pulling in roughly $2K MRR and growing slowly but steadily. She lists it privately for about $25K.

A buyer, call him Alex, reaches out through a Slack group. He seems sharp and asks good questions. Emma, flattered by the interest and not wanting to kill the momentum, shares access to the codebase, her Notion docs, the Figma mockups and the analytics. No NDA.

Alex goes quiet for two weeks. Then a near-identical tool appears: same core logic, slightly different interface, same value props, same stack. Some of the animations look familiar.

Emma has little to work with. Ideas themselves generally aren't protected by copyright, only the specific expression of them, and there was no patent. Without an NDA there's no confidentiality agreement to point to either. All she has left is a frustrated thread that fades in a day.

The lesson here is simple: selling cold, with no agreed process, leaves you exposed. A curated listing platform sets the expectation that NDAs and diligence come before access, which is exactly the friction that protects a seller here.

What if it does get breached

Be honest with yourself: most of the time you'll just be annoyed and vent online.

But if you're serious about pursuing it:

• Gather the record. Screenshots, emails, access logs. Build a timeline.
• Talk to a lawyer, especially if you're in the EU or handling personal data.
• Lead with a measured legal letter, not a rage thread. A calm, well-worded notice tends to achieve more.

None of that is legal advice, and confidentiality and IP law vary by country, so a local lawyer is the right call if real money is on the line.

When you don't need one

The part no lawyer likes to say out loud:

• Initial cold conversations. You don't ask for an NDA on first contact.
• Publicly available information. If it's on the landing page or in a blog post, it isn't confidential.
• When the seller refuses and the stakes are low. Some indie sellers hate paperwork. If you're only after high-level information, you can often skip the drama.

An NDA isn't a deal-breaker. It's a tool, not a religion.

Final take

An NDA is a bit like a prenup for a digital fling. You hope you never need it. If things go sideways, you'll be glad it exists.

And even when nobody ever enforces it, that signature changes the tone of the whole deal. It says you're serious.

So get the NDA. Keep it light, keep it clear, and don't become the cautionary tale. If you want to see the kind of businesses these agreements actually protect, browse the listings.

Got burned?

Ever had a deal go south because someone leaked your metrics, or got cloned because you shared the code too soon? Hit reply and tell us what happened. We won't name names. If you'd rather just keep learning from other people's mistakes, get the weekly digest.

Free download

Here's a simple starting point: a dual-use NDA template for Europe and the US. Drop it into your AI prompts or hand it to your lawyer for review. It's concise, practical for small acquisitions, and written to be workable in both regions. Treat it as a draft to adapt, not finished legal advice.

Simple NDA Template – EU and US ready