NDAs in Estonia: how confidentiality agreements work

What should an NDA define as confidential information?

List what is actually at stake: source code, pricing, customer lists, product plans, financial data. If oral disclosures count, require a short written summary within a set time, such as 10 working days, so there is evidence of what was said.

Limit use as well as disclosure. State the permitted purpose (for example, “evaluating a possible partnership”) and who may receive the information: employees, advisers and group companies with a need to know. Make the recipient responsible for them.

Deal with the end of the relationship: return or destruction on request, with an exception for copies that must be kept by law or that sit in automatic back-ups.

Which exceptions should an NDA contain?

These exceptions follow the EU Trade Secrets Directive, which Estonia has implemented. Independent discovery and reverse engineering of a lawfully obtained product are lawful ways to acquire information (Directive (EU) 2016/943, Article 3(1)). A trade-secret claim also fails where the disclosure was made, for example, to reveal misconduct or illegal activity in the public interest (Article 5).

Without a legal-compulsion exception, the NDA can collide with a duty to disclose to an authority or a court. Add a duty to tell the disclosing party first, where that is lawful, so it can ask for protection.

Check these clauses in your own contract – free summary →

How long should an NDA last in Estonia?

The law gives a useful benchmark. Under a contract for services, the provider must keep secret the facts the client has a legitimate interest in protecting, and the duty continues after the contract ends as far as needed to protect that interest (VÕS § 625). An obligation that goes well beyond any legitimate interest can be challenged as unreasonable, especially in standard terms (VÕS § 42(1)).

A split term works well in practice. Protect ordinary confidential information for a fixed number of years after disclosure or after the relationship ends. Protect trade secrets, such as source code or formulas, for as long as they meet the legal definition. Say expressly which obligations survive the end of the main agreement.

Is a contractual penalty (leppetrahv) in an NDA enforceable?

To decide whether a penalty is excessive, the court looks at how far the obligation was performed, the creditor’s legitimate interest and the parties’ economic situation (§ 162(1)). It will not reduce a penalty on its own initiative, and a penalty that has already been paid cannot be reduced (§ 162(3)).

Three more rules matter in practice. A penalty cannot be claimed for an excusable breach, such as one caused by force majeure, unless the contract says otherwise (§ 160). The creditor must say within a reasonable time after discovering the breach that it claims the penalty, or it loses the claim (§ 159(2)). Damages above the penalty can be claimed, but the penalty is credited against them (§ 161(2)).

In standard terms, an unreasonably high penalty is on the statutory list of unfair terms (§ 42(3) point 5) and is presumed unfair between businesses (§ 44). A flat “€50,000 for each breach” in a low-value evaluation NDA is worth negotiating. Link the amount to the value of the deal, cap the total and define what counts as a single breach.

Does Estonian law protect business secrets without an NDA?

The Act implements the EU Trade Secrets Directive and defines a business secret in § 5(2). Following the Directive, information qualifies only if it is not generally known or readily accessible, has commercial value because it is secret, and has been subject to reasonable steps to keep it secret (Directive (EU) 2016/943, Article 2(1)). Signing NDAs is one of those steps.

Specific statutory duties also exist. Employees must keep the employer’s business secrets (TLS § 22), management board members must keep the company’s business secrets (ÄS § 186), and a service provider has the confidentiality duty in VÕS § 625. These duties are general, so an NDA that defines the information, term and consequences still adds a great deal.

Mutual or one-way NDA, and what about employees?

A one-way NDA drafted by the discloser tends to have uneven terms. If you will share information too, ask for mutual obligations instead of signing a one-sided form.

An NDA does not stop an employee from joining a competitor. That needs a separate non-compete, which binds after the employment ends only if it is in writing, lasts no more than one year, and comes with reasonable monthly compensation from the employer (TLS § 24). The EU trade-secret rules also do not restrict employees from using experience and skills honestly acquired in their normal work (Directive (EU) 2016/943, Article 1(3)). Aim an employee NDA at specific information, not general know-how.