NDA in Portugal: Template, Key Clauses and Local Law (2026)

What an NDA is under Portuguese law A non-disclosure agreement in Portugal, an acordo de confidencialidade, is a contract in which one or both parties promise to protect information they receive and to use it only for an agreed purpose. It rests on freedom of contract under article 405 of the Codigo Civil, which lets parties set binding terms, and on the duty of good faith in pre-contract dealings under article 227. Alongside the contract sits a statutory trade secret regime in the Codigo da Propriedade Industrial (CPI), which transposed the EU Trade Secrets Directive 2016/943 into Portuguese law. So a Portuguese NDA does two jobs: it creates contractual duties you can enforce, and it supports the statutory trade secret protection, which requires the holder to have taken reasonable steps to keep the information secret. ## The core rules that shape a Portuguese NDA Trade secrets under the CPI. The CPI protects information that is secret (not generally known or readily accessible), has commercial value because it is secret, and has been kept secret through reasonable steps by the person in control of it. An NDA is one of those reasonable steps. The CPI provides remedies including injunctions and damages, and specialised intellectual property court routes exist for these disputes. Contractual freedom and good faith. Beyond the statutory floor the parties can agree broader confidentiality duties. Portuguese courts have recognised that confidentiality obligations can bind even before a definitive contract is signed, through pre-contract good faith. Damages. Compensation for breach follows the general Civil Code rules on civil liability. A clear NDA, with a defined scope and obligations, makes a claim far easier to run. GDPR and RGPD. Where the shared information includes personal data, the EU General Data Protection Regulation and the Portuguese implementing law apply. An NDA that moves personal data should set out the purpose, the security measures and the respective roles, so the confidentiality duty and the data protection duty line up. ## Mutual or one-way, and how far to reach Decide first whether the NDA is one-way or mutual. A partnership, joint venture or acquisition discussion usually needs a mutual agreement because information flows both ways; a one-sided pitch may justify a one-way obligation. A lopsided document is the most common reason a counterparty resists signing. Be realistic about reach. An NDA binds the parties and the people they allow to see the information, and it supports a trade secret claim under the CPI, but it cannot stop a competitor who independently develops the same idea and it cannot revive secrecy once information is genuinely public. That is why the carve-outs are not a weakness but a sign of a credible agreement. For information you need to protect over the long term, pair the NDA with practical measures (limited access, marking documents confidential, secure systems), because the CPI protects a trade secret only while the holder keeps it secret through reasonable steps. Where the agreement sits ahead of a larger deal, Portuguese pre-contract good faith can mean confidentiality binds even before the main contract is signed, so the duty is live from the first exchange. An NDA matched by real protective habits is worth far more than one that claims broad protection while the information circulates freely. ## A usable template Adapt to your facts and have a Portuguese lawyer review it where the stakes are high. ACORDO DE CONFIDENCIALIDADE / NON-DISCLOSURE AGREEMENT 1. Parties. [Disclosing party], NIPC [number], and [Receiving party]. [State if mutual.] 2. Purpose. The information is shared only to [evaluate / perform ...]. 3. Confidential information. Defined as [non-public business, technical, financial and commercial information in any form], with the carve-outs below. 4. Exclusions. Information that is public through no fault of the receiver, already lawfully held, independently developed, or lawfully received from a third party. 5. Obligations. Keep the information secret, use it only for the Purpose, limit access to those who need it and are bound by equivalent duties, and apply reasonable security measures. 6. Personal data. Where the information includes personal data, process it only for the Purpose and in line with the GDPR and the Portuguese data protection law. 7. Term. Confidentiality lasts [term]; trade secrets stay protected under the CPI for as long as the information remains secret. 8. Return or destruction. On request or at the end, return or destroy the information and copies. 9. Remedies. Breach entitles the disclosing party to damages and injunctive relief, including the measures available under the CPI. 10. Governing law and jurisdiction. Portuguese law; the competent court, including the intellectual property court for trade secret matters. Signatures, NIPC, date. ## A short walk through the key clauses Definition of confidential information decides most disputes. Tie it to the purpose and avoid a definition so broad a court will not take it seriously. Personal data deserves its own clause whenever personal information changes hands, because the GDPR duties sit on top of the contract and are separately enforced. Term and remedies should separate ordinary confidential information, which can have a fixed period, from trade secrets, which stay protected under the CPI while they remain secret, and should point to the CPI remedies and the specialised court route. ## Red flags to check before signing - A vague definition of confidential information that protects nothing or claims to cover everything.

• No carve-outs for public, pre-held or independently developed information.
• Personal data flowing with no reference to the GDPR and the Portuguese data protection law.
• A fixed short term applied to genuine trade secrets, cutting protection short.
• No return or destruction obligation and no clear remedy clause. ## Keeping the NDA under control after signing An NDA is only as good as the care you take after signing: who received what, for what purpose, for how long, and when information must be returned or destroyed. Across many counterparties these obligations scatter quickly. Drafting the NDA from a clear template, checking that the definition and carve-outs are sound and that personal data is handled under the GDPR and the Portuguese law, and keeping the terms and return dates in one place can sit in a single AI workspace tuned to how your company shares information. Adira is built around that idea: it drafts from a template, models the contract as linked clauses so it can flag a weak definition or a missing data clause, and keeps obligations and dates together. Adira is India-first today, with jurisdiction set per contract and an international mode for others; deep, verified coverage of Portuguese law is on its roadmap rather than established, so treat Portugal specific output as a draft for a Portuguese lawyer to confirm. This page is general information, not legal advice. Portuguese rules change, so confirm the current position for your situation.