Sign an NDA online: what makes the executed agreement defensible

In the EU, Regulation (EU) No 910/2014 article 25(1) bars denying legal effect or evidentiary admissibility to a signature solely because it is electronic or because it lacks a qualified form. An NDA is a standard commercial contract; no EU instrument demands paper, ink or a notary for the wrongdoing-types it covers. State law adds its own edges in practice — civil codes in some Member States have formalities for specific act types — but for the commercial NDAs businesses exchange daily, the rule is uniform: electronic works.

In the US, the ESIGN Act, 15 U.S.C. §7001(a), and state UETA law give electronic signatures and records the same legal standing as paper — the NDA is not on the excluded list (wills, family-law documents, certain government directions). No notarisation is required for a standard commercial NDA: what it needs is both parties' signatures from people with authority, an intent to sign, and consent to transact electronically — the common-law-style floors every UETA uniform text carries in §2 and the preservation rule in §12.

An English-law NDA stands on the same floor. The Electronic Communications Act 2000, section 7(1), makes an electronic signature — and any certification of it — admissible in evidence on questions of authenticity and integrity, and there is no general statutory formality for ordinary commercial contracts under English law. The trade-secret layer lands the same way: the Trade Secrets (Enforcement, etc.) Regulations 2018, regulation 2, conditions protection on information that 'has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret' — the UK transposition of the same Directive (EU) 2016/943 — so the signed-before-disclosure rule holds in the UK too.

An NDA is not an exotic contract, but it does protect something with its own legal regime. In the EU, Directive (EU) 2016/943 conditions trade-secret protection on the holder having taken 'reasonable steps' to keep the information secret — Article 3(1) — and a signed confidentiality agreement is one of the classic such steps. The Swedish Trade Secrets Act (2018:558), cited as a national example of transposition, works the same way. The conclusion is practical: the NDA that matters is the one signed before the disclosure, not after.

In the US, employee NDAs governing trade secrets must carry the whistleblower-immunity notice of the Defend Trade Secrets Act, 18 U.S.C. §1833(b)(3): omit it and the employer loses exposure to exemplary damages and attorney's fees in the trade-secrets action against that employee. This is a document-drafting rule, not a signing-rule — but any serious workflow check on an NDA envelope includes verifying the text carried the notice before the parties signed.

A unilateral NDA binds only the receiving party; a mutual one binds both sides — the form matters mainly for which disclosures each party's own information receives, and it is chosen long before signing. For a company, the signature must come from someone with authority to bind it — an owner, an officer, an employee explicitly authorised. The authority question is an audit-trail question: the executed record should name the person, their role and their email, so that the counterparty can later confirm the signature was from a person who could give it.

When an NDA is contested, nobody argues over whether electronic works — the floors in eIDAS article 25(1) and ESIGN §7001(a) settle that. The contested facts are the everyday ones. Identity: 'the other side says the person who signed had no authority', or claims the signature is forged. Integrity: 'that is not the version we discussed'. Time: 'the information was shared before any NDA existed'. An executed file answers all three only if it carries an identity record — who verified, through which channel, when; an integrity binding — typically a PAdES seal over the exact signed bytes; and a trusted time anchor — an RFC 3161 timestamp token showing when the signatures happened.

A scanned-and-emailed NDA reaches the same legal floors and fails those tests: no binding between signature and bytes, no independent time, identity resting on 'the email came from their address'. Where enforcement hinges on defending a trade-secret probation — the EU Directive's 'reasonable steps' — a file with all three records is the step; one without them is a hope. The comparison is made fully in the scanned-signature post.

The mechanics of doing it well: send the final text — a draft containing unresolved blanks outsources blame to your workflow; name the legal entities, not informal trade names; put the person with signing authority first or last by design, not by accident; and keep the ordering explicit when the NDA is mutual, so neither party is prompted to sign a version the other has not accepted. Recipients sign from a link in their browser — nothing installed, no account — and each identity event lands in the ceremony record: address or number the code went to, when it was issued, when it was confirmed.

The completed envelope returns a PAdES-sealed PDF covering the exact signed bytes, an RFC 3161 timestamp from the signing authority, and a hash-chained audit trail — SHA-256 over the previous hash plus each row's own content — so any later edit of the trail is visible in the chain. Both parties hold the same sealed file, and any counterparty can verify the pack by code on a public verification page — no account anywhere.