NDA in Malaysia: Template, Key Clauses and Local Law (2026)

What an NDA is in Malaysia, and what local law supports it A non-disclosure agreement (NDA), also called a confidentiality agreement, is a contract that lets parties share sensitive information while keeping it private. It can be one way, where only one side discloses, or mutual, where both do. In Malaysia an NDA is a contract under the Contracts Act 1950, and it binds when the parties, the information covered and the obligations are clear and the purpose is lawful. Malaysian law supports confidentiality through three overlapping routes: - Contract. A clear NDA is enforceable under the Contracts Act 1950. The important point is that section 28, which voids clauses that restrain a lawful trade or profession, is aimed at non-competes, not at genuine confidentiality duties. An NDA that protects information rather than barring someone from working is on firmer ground than a post-term non-compete.

• Breach of confidence. Even without a contract, the common law action for breach of confidence can protect information that has the quality of confidence, was shared in circumstances importing an obligation of confidence, and is used without permission. An NDA records and strengthens that duty.
• Personal Data Protection Act 2010. Where the shared information includes personal data, the PDPA 2010, as amended, adds duties that a contract cannot sign away. Address data handling separately from the general confidentiality duty. This is general guidance, not legal advice. Confirm the current position with a Malaysian lawyer before you rely on any clause. Last verified October 2026. ## Malaysia NDA template (mutual) Copy the block below and fill the bracketed fields. For a one way NDA, keep the obligations on the receiving party only. ``` NON-DISCLOSURE AGREEMENT Made on [DATE] BETWEEN: [PARTY A NAME], company no. [no.], of [address] AND [PARTY B NAME], company no. [no.], of [address] (each a "Party", together the "Parties") 1. PURPOSE The Parties wish to share information to evaluate [describe the purpose] (the "Purpose"). 2. CONFIDENTIAL INFORMATION "Confidential Information" means any non-public information disclosed by one Party to the other, in any form, that is marked confidential or that a reasonable person would treat as confidential, including [technical, commercial, financial, customer and personal data]. 3. OBLIGATIONS The receiving Party will keep the Confidential Information secret, use it only for the Purpose, share it only with those who need it and are bound by like duties, and protect it with reasonable care. 4. EXCLUSIONS The duties do not apply to information that is public through no breach, was already known, is independently developed, or must be disclosed by law or a court (with notice where allowed). 5. PERSONAL DATA Where Confidential Information includes personal data, each Party will comply with the Personal Data Protection Act 2010. 6. TERM AND SURVIVAL This Agreement runs for [N] years. The duties of confidence continue for [N] years after it ends, and for trade secrets for as long as the information stays secret. 7. RETURN OR DESTRUCTION On request or on the end of the Purpose, the receiving Party returns or destroys the Confidential Information and copies, subject to legal retention needs. 8. NO LICENCE Nothing here transfers any ownership or licence in the information, beyond the limited right to use it for the Purpose. 9. REMEDIES The Parties agree that damages may not be enough, and a Party may seek an injunction to stop or prevent a breach. 10. GOVERNING LAW AND DISPUTES This Agreement is governed by the laws of Malaysia, and disputes go to [the courts of Malaysia / arbitration under the AIAC]. Signed: Party A: __________ Party B: __________

- **Confidential Information (clause 2).** Be precise, so a court can apply the definition. Avoid a definition so broad it covers everything, and so loose a court cannot enforce it.
- **Personal data (clause 5).** If any shared information is personal data, the PDPA 2010 applies on top of the contract. Its duties cannot be waived by agreement.
- **Term and survival (clause 6).** Separate the life of the agreement from the life of the duty. A trade secret can stay protected for as long as it is kept secret.
- **Remedies (clause 9).** Say that damages alone may not be enough and that a party can seek an injunction, which is the usual remedy to stop a leak before more harm is done. ## Red flags to check before you sign - A definition of confidential information so wide or so loose that a court cannot apply it.
- No carve-out for information that is public, already known, independently developed or required by law.
- A missing personal data clause where the shared information includes personal data under the PDPA 2010.
- A confidentiality duty that ends with the contract, leaving trade secrets unprotected.
- Trying to use an NDA as a hidden non-compete, which section 28 can strike down.
- No return or destruction obligation at the end of the Purpose. ## Breach of confidence and the remedy that matters When confidential information leaks, the remedy a business usually wants first is an injunction, a court order to stop the other side using or sharing the information before more harm is done. Malaysian courts can grant one where there is a serious issue to be tried and damages alone would not be an adequate remedy. That is why the remedies clause in the NDA should record that damages may not be enough and that a party may seek an injunction. It does not bind the court, but it supports the application. To succeed in a breach of confidence claim, the information must have the necessary quality of confidence, it must have been shared in circumstances that imposed an obligation of confidence, and it must have been used or disclosed without permission. A well drafted NDA helps on all three: it marks the information as confidential, records the obligation in writing, and defines the permitted use so any other use is a breach. Keep evidence of what was disclosed and when, because the claim turns on proving those points. ## A note on jurisdiction and Adira's coverage The PDPA 2010 has been amended recently, so confirm the current data protection duties with Malaysian counsel where personal data is involved. Adira is India first in its depth today and uses an international setting for other jurisdictions. Deep, verified Malaysian coverage is on Adira's roadmap rather than established today, so treat any Malaysia specific output as a draft to check locally. ## Where a contract workspace helps A template gets you a sound NDA. The ongoing work is keeping every NDA consistent, knowing which counterparties are under which terms, tracking when a duty of confidence expires, and holding each signed version in one place so you can prove what was agreed. When drafting, review and tracking live in one AI workspace tuned to how your company shares information, the purpose, survival period and personal data terms stay consistent across every NDA, with edits made in plain language. [Adira](https://adiralaw.com) is one workspace built to work this way, with Malaysian depth on its roadmap. This template alone is enough to put a fair NDA in place today.