# Confidentiality Clauses in Research Agreements: What to Include By the end of this guide, you will be able to read a draft research agreement, find every provision that controls what you can share and publish, draft replacement language, and hand your contracts office a clean, justified redline. You will also have a model confidentiality clause, a verification routine for the final text, and a table of the parameters that matter most. Have these on hand before you start: - The draft agreement in an editable format, such as Word, or a PDF you can convert to text - A redline tool, meaning software that displays proposed edits, for example Microsoft Word with Track Changes turned on - The contact for your technology transfer, sponsored programs, or contracts office - The funder's or partner's written policies on data sharing and publication A confidentiality clause in a research agreement decides who may see your data, materials, and interim results, who may talk about them, and how long those duties last. Weak wording can block a thesis chapter or a conference talk. Strong wording protects everyone and then gets out of the way. ## What a Confidentiality Clause Does in a Research Agreement A confidentiality clause, sometimes called a nondisclosure provision, is the part of a contract that obliges each party to protect nonpublic information exchanged during a project. It defines what counts as confidential, who may receive it, which uses are allowed, which disclosures are excused, and when the duty ends. Two boundary points keep this clause in its lane. First, confidentiality is not ownership. The clause restricts disclosure, while separate provisions assign ownership of data, materials, and inventions. Second, confidentiality is not secrecy about the existence of the project. Most agreements allow the parties to state that a collaboration exists, and some funders require it. The sharing of human biological materials and associated data in collaborative research keeps increasing, which is exactly why agreements need robust, explicit terms [1]. You will meet confidentiality clauses in several kinds of research agreements: - **Sponsored research agreements.** A company, foundation, or agency pays your institution to perform defined work. The clause protects the sponsor's proprietary information and often your institution's as well. - **Collaboration agreements.** Two or more institutions act as partners, and each discloses information the other must protect. - **Material transfer agreements (MTAs).** These govern transfers of biological materials, such as cell lines, reagents, or associated data, between institutions. - **Data use agreements.** These control the exchange of datasets, often human data, and usually carry their own confidentiality and security terms. - **Confidential disclosure agreements (CDAs).** Often called nondisclosure agreements (NDAs), these are signed before detailed discussions so parties can exchange ideas without losing rights or control. Whatever the wrapper, the confidentiality clause inside it carries most of the practical risk. The next section shows why with two published cases. ## Why the Wording Decides the Science Two published case studies show how clause language reaches into research conduct. The first examined commercial research funding at scale. Freedom of Information requests, the legal mechanism for obtaining documents from public institutions, returned 87,013 pages of records. From those records, researchers identified five agreements between the Coca-Cola Company and public institutions in the United States and Canada [2]. The provisions gave the company the right to review research in advance of publication, together with control over study data, disclosure of results, and acknowledgement of its funding. Some agreements went further and specified that Coca-Cola held the ultimate decision about any publication of peer-reviewed papers before its approval of the researchers' final report [2]. Language with that structure gives a funder a quiet veto over the literature. The second case comes from pharmacoeconomics, the field that studies the value of medicines. The incremental cost-effectiveness ratio (ICER) is the standard summary measure in cost-effectiveness analysis, expressed as the additional cost of a treatment divided by its additional health benefit. Confidentiality clauses in agreements between pharmaceutical companies and payers often keep the negotiated net price secret. A simulation built on a real cost-effectiveness model submitted to the Italian Medicines Agency showed that moving the price input from a transparent price to a confidential net price changed the estimated ICER and, with it, the interpretation of the analysis [3]. A confidentiality clause changed what a published number actually meant. The lesson from both cases is the same. Confidentiality clauses in research agreements are not boilerplate. Publication rights, data control, and disclosure terms decide whether you can present your work, correct the record, and let others reproduce your numbers. The walkthrough below turns that lesson into clause language you can propose. ## Drafting a Confidentiality Clause in a Research Agreement, Step by Step Work through the eight steps in order. Each step produces text you can paste into a redline, which is the tracked-changes version of the draft you send back to the other party. ### Step 1. Inventory what needs protection List every category of nonpublic information the project will exchange. A typical life science project includes: - Unpublished research data and interim analyses - Biological materials and their properties, such as growth conditions, sequence data, or assay results - Methods, protocols, and know-how, meaning the practical skills and judgment that never appear in a paper - Code, models, and algorithms - Draft grant applications and budgets - Personal data, if the project involves human participants Write the list down and share it with your contracts office. It becomes the backbone of the definition in Step 2 and the recipient list in Step 3. ### Step 2. Define Confidential Information precisely A vague definition fails in two opposite directions. Too broad, and the clause covers your seminars, teaching, and thesis. Too narrow, and a partner's know-how leaks without any remedy. Name the categories, allow any form of disclosure, and decide whether a written marking is required. University negotiators often accept confidentiality without marking in research settings, because lab data rarely arrives stamped. Here is a model definition you can adapt: ```text CONFIDENTIAL INFORMATION means nonpublic information disclosed by one party (the "Discloser") to the other (the "Recipient") under this Agreement, including unpublished research data, biological materials and their properties, methods, protocols, interim analyses, code, models, and draft publications, in any form, whether or not marked "Confidential." Confidential Information does not include information that the Recipient can show (a) was public before disclosure, (b) became public through no fault of the Recipient, (c) was already in the Recipient's possession without a duty of confidentiality, (d) was developed independently by individuals of the Recipient without access to the Discloser's information, or (e) was received from a third party without a duty of confidentiality. ``` The exceptions paragraph is standard practice across commercial and academic agreements. Without it, the duty would never end for anything, and no research project can operate under a duty like that. ### Step 3. Name who may receive it Specify who may access confidential information and the standard they must meet. The working principle is need to know, meaning a person receives confidential or sensitive information only if that person needs it to do assigned work. A working group of senior research integrity officers and journal editors recommended that institutions broaden and reconsider how they apply need-to-know criteria to confidential research information and data [4]. Model language: ```text The Recipient may disclose Confidential Information only to those employees, students, and approved collaborators who need it to perform this Agreement and who are bound by confidentiality obligations at least as protective as this clause. The Recipient remains responsible for any breach by those individuals. ``` Match the list to reality. If a core facility, an external sequencing provider, or a community advisory panel will touch the data, the clause must allow it now, not after someone has already shared a spreadsheet. ### Step 4. Protect the right to publish ![Decision path for checking a sponsor review clause, ending in either a safe review window or an approval right to replace.](/article-images/illustrations/confidentiality-clause-research-agreement-publication-review.webp) Publication is where research agreements are won or lost. The Coca-Cola case study found that researchers can negotiate successfully to remove restrictive clauses, and its authors recommended that journals ask authors to attach their funder agreements so the terms become visible [2]. Your goal is a review window, not an approval right. Here is the pattern to strike, paraphrased from the case study, and a replacement you can propose: ```text RESTRICTIVE DRAFT (before) The Investigator shall not publish or present the results without the prior written approval of Sponsor. Sponsor shall have the ultimate decision regarding any publication of peer-reviewed papers prior to its approval of the Investigator's final report. NEGOTIATED VERSION (after) The Investigator may publish and present the results without approval. The Investigator will send Sponsor a copy at least thirty (30) days before submission solely to remove Sponsor's Confidential Information and to provide patent notice. Any patent-related hold shall not exceed ninety (90) days in total. ``` Two details carry the weight. The stated purpose of the review must be limited to removing confidential information and providing patent notices. And any delay requested for patent reasons needs a fixed maximum, so a patent filing cannot become an open-ended publication hold. The thirty-day and ninety-day figures are common starting points in sponsored research drafting, not legal requirements, and both are negotiable. ### Step 5. Set the term, survival, and return duties ![Calculation of a confidentiality expiry date from a January 15 2026 effective date, a three year project and a five year survival period.](/article-images/illustrations/confidentiality-clause-research-agreement-survival-expiry.webp) Three time elements control the clause. The term is the life of the project. The survival period is how long the duty continues after the project ends. The return-or-destroy duty says what happens to documents, data, and materials at the end. A common structure is a fixed survival period of several years after the agreement ends, with longer protection for trade secrets, meaning information that keeps its value only while it stays secret, and for personal data. Compute the actual expiry date before you sign so nobody guesses later: ```text Effective date: January 15, 2026 End of performance: January 14, 2029 (3-year project) Survival period: 5 years after the end of performance Obligations expire: January 14, 2034 ``` Model language: ```text These obligations begin on the date of each disclosure and continue for five (5) years after this Agreement ends. Obligations covering personal data continue as long as required by the data protection terms of this Agreement, and obligations covering trade secrets continue for as long as the information remains a trade secret. ``` The return-or-destroy clause needs a carve-out for records your institution must keep for compliance, such as grant records and laboratory notebooks. Without that carve-out, a destruction duty can collide with sponsor record-retention requirements. ### Step 6. Check the residuals and remedies provisions A residuals clause lets a party keep using general knowledge and know-how retained in unaided memory after the agreement ends. Companies often ask for residuals. A one-sided residuals clause lets the sponsor absorb your lab's general learning while your lab must forget everything, so make it symmetric or strike it. Model language: ```text The Recipient may retain and use general knowledge, skills, and experience acquired during the project, provided that the Recipient does not disclose or use Confidential Information in a manner inconsistent with this clause. ``` Check remedies next. Confidentiality clauses typically provide for injunctive relief, meaning a court order that compels or stops conduct, because money cannot always fix a leak. Watch for liquidated damages, a pre-agreed sum payable on breach. A damages figure sized to a company's commercial losses can expose a university lab to liability far beyond the project's budget. ### Step 7. Plan for students, trainees, and public contributors The people who handle confidential information are rarely the people who sign the agreement. Thesis committees, rotation students, visiting researchers, technicians, and core facility staff all need coverage under the Step 3 recipient clause. Patient and public involvement (PPI) means research conducted with and by the public rather than simply about them. A co-produced study of doctoral research found that PPI is a growing component of health and social care research and recommended embedding it early in research careers [5]. If your project includes patient advisors or community representatives, the recipient list must cover them, and the agreement should state how they access, store, and discuss project information. A clause that names only employees and co-investigators can turn your advisory panel into an accidental breach. ### Step 8. Redline, verify, and route through your institution Turn on Track Changes, propose your edits, and add a one-sentence comment under each change explaining the reason. Reviewers on the other side accept justified edits faster. Then verify the draft with a keyword sweep. Export the agreement to plain text and search it: ```bash grep -inE "confidential|disclos|publish|residual|survive|approv" agreement.txt ``` Expected output looks like this, with line numbers from your own document: ```text 14: CONFIDENTIAL INFORMATION means nonpublic information disclosed by one party 23: The Recipient may disclose Confidential Information only to those employees 31: Nothing in this Agreement restricts the Recipient's right to publish 38: These obligations begin on the date of each disclosure and continue for five 44: The Recipient may retain and use general knowledge, skills, and experience 52: Publication of the results shall require the prior written approval of Sponsor ``` Line 52 in this example is exactly what the sweep exists to catch, an approval right buried in a section nobody reads twice. In Word, the same sweep is Ctrl+F with each keyword. Run a final presence check against the eight elements: ```text FINAL CHECK (all eight should be present) [ ] Definition names the categories and allows any form [ ] Exceptions cover public, known, independent, third-party [ ] Recipients limited to need-to-know with equal obligations [ ] Publication carve-out with a review window for removal only [ ] Patent hold capped at a fixed maximum [ ] Survival period fixed, with trade secret and personal data exceptions [ ] Return or destroy with a records-retention carve-out [ ] Residuals symmetric, remedies limited to injunctive relief ``` Finally, route the redline through your institution. Agreements are negotiated by offices, and preparation shortens the process. In a qualitative study of researchers at two Ugandan research institutions, participants named robust ethical and legal frameworks, multidisciplinary teams, and transparency as facilitators of successful agreement development and execution, while power dynamics between institutions, limited understanding of the process, and protracted bureaucratic approvals were the main barriers [1]. You cannot remove the bureaucracy, but you can shorten it. Three tips cover most situations: - Send a complete package: the redline, the justification comments, the funder's policies, and the access list. - Flag publication and data-control terms as priority items so negotiators spend time where the risk sits. - Ask for the other side's standard positions in writing early, because surprises at signature cause the longest delays. ## Key Clause Parameters at a Glance | Clause element | What to specify | Red flag to watch for | |, - |, - |, - | | Definition of Confidential Information | Named categories, any form, marking optional | "All information exchanged" with no exclusions | | Permitted recipients | Roles with a need to know, equal obligations, institutional responsibility | Undefined "affiliates" or "partners" | | Publication | Review window limited to removing confidential information and patent notices | Approval rights, vetoes, or "ultimate decision" language | | Term and survival | Fixed years after the agreement ends, longer for trade secrets and personal data | Indefinite duties for every category | | Exceptions | Public, already known, independent development, third-party source | Missing or one-sided exceptions | | Return or destruction | Trigger events plus a records-retention carve-out | Destruction duties that conflict with grant records | | Residuals | Symmetric right to retain general knowledge | Residuals for one party only | | Remedies | Injunctive relief for breach | Liquidated damages sized to a commercial budget | ## Common Mistakes and Limitations **Reading the science plan and signing the rest.** The Coca-Cola case study carried the title "Always read the small print" because the provisions that mattered sat in the agreement, not in the study protocol [2]. Set aside thirty minutes with the legal text for every agreement, regardless of who sent it. **Accepting review that behaves like approval.** If the sponsor's comments can delay or block a manuscript, the clause is an approval right whatever its label. Test the language by asking what happens when the review deadline passes with no reply. **Defining confidential information as everything.** Overbroad definitions can swallow seminar slides, thesis chapters, and teaching material. They also make honest compliance impossible, because nobody can treat a whole lab's output as sealed. **Forgetting the people who handle the data.** Agreements that name only principal investigators exclude students, postdocs, technicians, and public contributors. The gap forces quiet workarounds, and quiet workarounds are how breaches happen. **Ignoring internal sharing.** Need to know applies inside your institution too. A departmental seminar, a lab meeting with a visitor, or a shared drive with open permissions can all count as disclosure. **Treating MTAs and CDAs as boilerplate.** Small wording differences decide real outcomes, such as whether the properties of a transferred cell line count as confidential information or as publishable observations. **Letting confidentiality hide inputs that affect interpretation.** When prices, contract terms, or analysis inputs stay secret, readers cannot judge whether a published estimate is robust, so push for transparency carve-outs for anything a publication depends on. **Skipping the institutional route.** Signing individually, or negotiating directly with a company contact, can bind your institution to terms its counsel never saw and slow every later step. **Keeping no inventory.** If you cannot list where confidential files live, you cannot meet a return-or-destroy deadline, and you cannot demonstrate compliance after a dispute. This guide explains common drafting practice in research settings. It is not legal advice, and contract law differs by jurisdiction. Individual agreements need review by your institution's contracts, technology transfer, or counsel office before anyone signs. ## Aligning Confidentiality With Scientific Collaboration and Research Tools Scientific collaboration runs on shared infrastructure, so the clause and the tools must match. A clause that no tool can enforce is a promise on paper only. These research collaboration tools work only if their permission settings mirror the text: - **Access-controlled storage.** Keep confidential files in institution-managed storage with permission lists that match the permitted-recipient clause. Personal cloud accounts and public repositories are out of scope by default. - **Version control for code.** A private Git repository with named collaborators satisfies both the clause and reproducibility. Make the repository public only after the publication conditions are met. - **[Structured data](/blog/data-analysis/what-is-structured-data) capture.** Research data platforms with role-based access map cleanly onto need-to-know language, because each role sees only what its work requires. - **Communication platforms.** Guest access settings should match the recipient list. A guest who is not a permitted recipient should not sit in the channel where interim results circulate. - **Marking conventions.** If the agreement requires a "Confidential" marking, apply it in file names or headers so the duty stays visible to everyone handling the file. Keep an inventory of the systems where confidential information lives. When the agreement ends, that inventory is how you meet the return-or-destroy duty on time and show your work. Two trends in research practice make this alignment urgent. Living evidence synthesis keeps a review continually updated as new evidence arrives, rather than treating it as a one-time publication. An international modified Delphi survey with 29 experts defined living evidence synthesis as continual updating for topics with uncertainty in the evidence and reached consensus statements on considering, conducting, publishing, and implementing such syntheses [6]. An agreement that freezes data and code into a single transfer makes that model impossible, so ask for ongoing data flow terms whenever the project design is iterative. The second trend is external accountability. When journals raise research integrity or publication ethics concerns, institutions and journals need identified contacts and a shared understanding of which information can move between them [4]. Draft the clause so that responding to a journal inquiry about research integrity is never a breach. A one-line carve-out for disclosures required by law or required to address research integrity questions covers it. ## Frequently Asked Questions ### What is a confidentiality clause in a research agreement? It is the contract provision that obliges each party to protect nonpublic information exchanged during a project, and it should define the information, the permitted recipients, the exceptions, the publication rights, and the duration of the duty. ### Can a sponsor block publication of my results? A well-drafted agreement should not, but some commercial agreements have granted sponsors prepublication review and even approval rights, so negotiate for a review window limited to removing confidential information and patent notices. ### How long should confidentiality obligations last? A fixed period after the agreement ends, commonly several years, with longer protection only for trade secrets and personal data that stay protected under other terms. ### Is an NDA the same as a confidentiality clause in a research agreement? No. An NDA or CDA is a standalone agreement signed before detailed talks, while the confidentiality clause sits inside the research agreement and is tailored to the project's data, materials, and publication plans. ### Can I present sponsored research at a conference or in my thesis? Yes, if the agreement carves out publications and presentations and requires only advance notice to the sponsor so it can remove its confidential information and provide patent notice. ### What exceptions apply to confidential information? The standard set covers information that was already public, became public through no fault of the recipient, was already in the recipient's possession, was developed independently, or arrived from a third party without confidentiality obligations. ### Who may receive confidential information on my project? People with a need to know for the project who are bound by equal or stronger obligations, which can include co-investigators, staff, students, core facilities, and approved public contributors. ### Who should review the agreement before I sign? Your institution's technology transfer, sponsored programs, or contracts office, plus data protection and research integrity offices when personal data, publication terms, or integrity procedures are involved. ## Sources 1. [Researchers' perspectives on the use of material transfer agreements in biobanking research; a case of Uganda.](https://pubmed.ncbi.nlm.nih.gov/42169079/) 2. ["Always read the small print": a case study of commercial research funding, disclosure and agreements with Coca-Cola.](https://pubmed.ncbi.nlm.nih.gov/31065042/) 3. [How reliable are ICER's results published in current pharmacoeconomic literature? The controversial issue of price confidentiality.](https://pubmed.ncbi.nlm.nih.gov/36628320/) 4. [Enhancing Partnerships of Institutions and Journals to Address Concerns About Research Misconduct: Recommendations From a Working Group of Institutional Research Integrity Officers and Journal Editors and Publishers.](https://pubmed.ncbi.nlm.nih.gov/37378978/) 5. [Patient and public involvement in health and social care doctoral research: recommendations co-produced by doctoral researchers, public contributors, and a public involvement coordinator.](https://pubmed.ncbi.nlm.nih.gov/42316242/) 6. [Best Practice Methods for Living Evidence Synthesis in Health Care: An International Modified Delphi Survey.](https://pubmed.ncbi.nlm.nih.gov/42956975/)