NDA in Spain: Template, Key Clauses and Local Law (2026)

What an NDA is under Spanish law A non-disclosure agreement in Spain, an acuerdo de confidencialidad or NDA, is a contract in which one or both parties promise to keep shared information secret and use it only for an agreed purpose. Under Spanish law it rests on two pillars. The first is ordinary contract law: obligations freely agreed bind the parties under article 1091 of the Civil Code, and freedom of contract is recognised in article 1255. The second is the trade secret law, Ley 1/2019 de Secretos Empresariales, which gives the disclosing party statutory remedies on top of the contract. An NDA in Spain has no mandatory form. Its strength comes from how precisely it is drafted and from whether the information it protects actually qualifies as a secret worth protecting. ## What local law adds to a generic template The trade secret test. Ley 1/2019 (which transposed the EU Trade Secrets Directive) protects information only where three things are true: it is secret, it has commercial value because it is secret, and the holder has taken reasonable measures to keep it secret. A signed NDA is the clearest evidence of those reasonable measures, which is why the contract and the statute work together. Breach can lead to civil claims for an injunction and damages, heard by the commercial courts (juzgados de lo mercantil). A criminal backstop. Articles 278 to 280 of the Spanish Criminal Code cover the discovery and disclosure of business secrets, especially where a legal or contractual duty of confidentiality exists. This is a serious backstop, not the main route, but it raises the stakes for a deliberate breach. Data protection overlay. If the confidential information includes personal data, the NDA must sit alongside the GDPR and the Spanish data protection law (LOPDGDD, Ley Organica 3/2018). Where one party processes personal data for the other, a separate article 28 data processing agreement is needed; a confidentiality clause does not replace it. Proportionate scope and duration. Spanish courts expect a confidentiality obligation to be defined and proportionate. Set a clear purpose, a clear definition and a reasonable duration, with genuine trade secrets protected for as long as they stay secret. A penalty clause (clausula penal) for breach is allowed, but a court can moderate it if it is clearly excessive. ## One-way or mutual, and the residual knowledge trap Decide early whether the NDA is unilateral, protecting one discloser, or mutual, protecting both parties. A mutual NDA is standard when both sides will share sensitive material, as in a partnership talk or an acquisition. The structure changes the obligations clause, so settle it before drafting. Watch the residual knowledge clause. Some NDAs let the receiving party freely use general know-how, ideas and concepts that its people retain in memory. For the discloser this can quietly gut the protection, because almost anything can be described as retained know-how. If you are the party sharing valuable information, resist a broad residual clause or narrow it so it cannot cover your actual trade secrets. ## Employees, whistleblowers and limits An NDA cannot override certain legal rights. It cannot stop a worker reporting wrongdoing to the authorities, and Spain now has a whistleblower protection law (Ley 2/2023) that protects certain disclosures. A confidentiality clause that tried to silence a lawful report would not be enforceable to that extent. When you bind individuals rather than companies, keep the obligation about genuine business secrets, make the carve-outs clear, and avoid language that reads as a gag on protected disclosures. A well-drafted NDA protects real secrets without overreaching, and an NDA that overreaches is more likely to be read down by a court. ## A usable template Adapt to your facts and have a Spanish lawyer review it. ACUERDO DE CONFIDENCIALIDAD / NON-DISCLOSURE AGREEMENT 1. Parties. [Disclosing party] and [Receiving party], with tax IDs and registered offices. State whether the NDA is one-way or mutual. 2. Purpose. The information is shared only to [state the permitted purpose]. 3. Definition of confidential information. All non-public information disclosed in any form, marked or reasonably understood as confidential, including [technical, commercial, financial, personal data]. 4. Exclusions. Information that is public without breach, already lawfully held, independently developed, or lawfully received from a third party. 5. Obligations. The Receiving party keeps the information secret, uses it only for the purpose, limits access to people who need it and are bound by equivalent duties, and applies reasonable protection measures. 6. Duration. During the discussions and for [X] years afterwards. Genuine trade secrets remain protected under Ley 1/2019 for as long as they qualify. 7. Return or destruction. On request or at the end, the Receiving party returns or destroys the information and confirms in writing. 8. Personal data. Where personal data is shared, each party complies with the GDPR and the LOPDGDD. 9. Remedies. Breach may give rise to damages and the trade secret remedies under Ley 1/2019, including an injunction. [Optional clausula penal of a reasonable amount.] 10. Governing law and jurisdiction. Spanish law; the commercial courts of [city]. Signatures, dated. ## A short walk through the key clauses Purpose and definition decide what is actually protected. A tight purpose stops the receiver reusing your information, and a clear definition avoids arguments about what was covered. Reasonable measures is the phrase that links the NDA to the statute. The obligations clause should describe real protection steps, because that is what the trade secret law rewards. Remedies should point to Ley 1/2019 so the statutory injunction and damages are available, with any penalty clause kept at a level a court will respect. ## Red flags to check before signing - A definition of confidential information so broad it covers everything.

• A perpetual, unlimited obligation with no defined term.
• No carve-outs for public or independently developed information.
• Personal data shared with no GDPR or LOPDGDD basis or processing agreement.
• A penalty clause set so high a court will cut it down. ## Keeping the obligation under control after signing An NDA in Spain matters most later, when you need to know who received what, under which purpose, for how long, and whether the term has expired. Drafting a Spanish NDA from a clean template, checking that its definition and duration are proportionate and that it links to the trade secret law, and tracking each NDA's purpose and expiry can sit in one AI workspace tuned to how your company handles confidential information. Adira follows that shape: it drafts from a template, models the NDA as linked clauses so it can flag an over-broad definition or a perpetual term, and keeps the purpose, counterparty and expiry date in one place. Adira is India-first today, with jurisdictions set per contract and an international mode for others; deep, verified coverage of Spanish law is on its roadmap rather than established, so treat Spain specific output as a draft for a Spanish lawyer to confirm. This page is general information, not legal advice.