NDA Confidentiality Scope: When 'Everything Is Confidential' Goes Too Far
NDA Confidentiality Scope: When "Everything" Is Too Much
Most NDA disputes don't start with a dramatic leak. They start with a definition. Specifically, the definition of "Confidential Information" — the clause that decides exactly what you're forbidden to repeat, reuse, or reference once you've signed. When that definition is drawn tightly, it protects the client's genuinely sensitive material and leaves you free to run your business. When it's drawn to cover "all information disclosed," it quietly converts an ordinary freelance engagement into a lifetime restriction on what you're allowed to say.
The scope of confidentiality is the single most consequential clause in most NDAs, and it's also the one freelancers skim past fastest. It reads like boilerplate. It uses familiar words. And because almost every NDA has a confidentiality clause, it's easy to assume they're all roughly the same. They are not. The difference between a market-standard scope and an overreaching one is a few sentences — and those sentences determine whether you can mention the client in your portfolio, describe the project type in a future proposal, or even acknowledge that the engagement happened.
This post explains what confidentiality scope actually means, why "all information shared" is a problem rather than a convenience, the four carve-outs that every reasonable NDA includes, and the specific counter-language you can use to bring an overbroad clause back to something fair.
What Confidentiality Scope Means
Confidentiality scope is the answer to one question: of everything the client shows or tells you, which parts are you legally bound to keep secret?
Every NDA contains a definition of "Confidential Information." That definition is the fence around your obligations. Anything inside the fence, you must protect — you can't disclose it, can't use it for your own purposes, and often can't even confirm it exists. Anything outside the fence, you're free to treat as ordinary knowledge. So the placement of that fence matters enormously. A narrow scope fences off the material that genuinely needs protecting: unreleased product designs, customer lists, financial models, source code, strategic plans. A broad scope fences off everything — including things you already knew, things that are public, and things you'll inevitably reference in the normal course of your work.
The clause usually has two parts. First, a definition of what counts as confidential. Second, a list of exclusions — the carve-outs that pull certain categories back out of the fence even if they'd otherwise fall inside it. Well-drafted NDAs have both. Overbroad NDAs have an expansive definition and either no exclusions or exclusions so weak they don't function. Reading the scope clause means reading both parts together: what's captured, and what's explicitly released.
The Problem With "All Information Shared"
Here's the language that should make you pause:
"'Confidential Information' means all information disclosed by the Disclosing Party to the Receiving Party, whether orally, in writing, electronically, or by any other means, whether or not marked as confidential."
On the surface it looks thorough — the kind of comprehensive drafting you'd expect a careful lawyer to produce. In practice, it's unworkable, and it's unworkable in three specific ways.
It captures information you can't possibly protect. "All information disclosed" includes things you already knew before the engagement, things the client has published publicly, and things that are common knowledge in your field. You can't un-know them. If the client tells you their company is headquartered in Austin — a fact anyone can find in ten seconds — that sentence is now, under this definition, Confidential Information you're contractually forbidden to repeat.
It has no natural limit, so the client defines the boundary in hindsight. When the scope covers everything, the question of what was actually confidential gets decided after a dispute arises, by the party claiming breach. There's no objective line. That's a structural disadvantage: you're agreeing to a restriction whose real shape you won't learn until someone accuses you of crossing it.
It makes ordinary professional activity risky. You will reference this work. You'll describe the type of project in a proposal to your next client. You might list the company in your portfolio, or mention on LinkedIn that you shipped a feature. Under an "all information" definition with no carve-outs, every one of those ordinary acts is a potential breach — not because you leaked anything sensitive, but because the fence was drawn around everything.
None of this means the client is acting in bad faith. Broad clauses usually come from legal teams drafting for maximum protection, not from a specific intent to trap you. But intent doesn't limit the clause — the words do. And these words don't limit anything.
Standard Exclusions That Must Always Be in an NDA
A reasonable confidentiality clause defines what's protected and then explicitly excludes four categories of information. These carve-outs are so standard that their absence is itself a red flag. If an NDA lacks them, that's the first thing to raise.
1. Public domain information. Anything that is already public, or becomes public later through no fault of yours, must be excluded. You cannot be liable for discussing something the client announced in a press release, published on their website, or disclosed in a public filing. Without this carve-out, you're theoretically bound to keep secret information the whole world can already read.
2. Independently developed information. If you created something on your own — without using the client's confidential materials — it's yours. This matters most for freelancers who work across multiple similar clients. A developer who builds a common authentication pattern, or a designer who arrives at a layout approach independently, shouldn't be accused of misusing confidential information simply because the client also happens to use something similar.
3. Information received from a third party. If someone else, with no obligation of confidence to the client, tells you something, you're not bound by this NDA with respect to that information. You learned it through a legitimate independent channel. The client's NDA can't reach information that reached you from an unrelated source who was free to share it.
4. Information required to be disclosed by law. If a court order, subpoena, or regulator compels you to disclose something, you must be able to comply without breaching the NDA. Good versions of this carve-out also require you to notify the client promptly (where legally permitted) so they can seek a protective order — but the point is that a legal obligation overrides the contractual one.
These four exclusions — public domain, independent development, third-party receipt, and legal compulsion — are the baseline. A confidentiality clause without all four isn't "stricter." It's defective.
Real Example: Overly Broad vs Market Standard
The difference is easiest to see side by side. Here's what an overreaching scope clause looks like:
Overly broad: "'Confidential Information' means all information disclosed by the Disclosing Party, in any form and by any means, whether or not designated as confidential, including but not limited to the existence and subject matter of this Agreement and the fact that the parties are in discussions. The Receiving Party shall not disclose any such information to any person for any purpose."
Notice what this does: it captures everything, includes the very existence of the relationship, provides no exclusions, and sets no time limit. Under this clause you can't confirm you worked with the client at all.
Now the same clause drawn to market standard:
Market standard: "'Confidential Information' means non-public information disclosed by the Disclosing Party that is either marked confidential or would reasonably be understood to be confidential given its nature and the circumstances of disclosure. Confidential Information does not include information that: (a) is or becomes publicly available through no breach by the Receiving Party; (b) was known to the Receiving Party prior to disclosure; (c) is independently developed without use of the Disclosing Party's Confidential Information; or (d) is rightfully received from a third party without restriction. The Receiving Party may disclose Confidential Information to the extent required by law, provided it gives prompt notice where permitted."
The second version protects genuinely sensitive material — it still covers the client's real secrets — while leaving you free to operate normally. That's the target. Not "no confidentiality," but confidentiality with a defined edge.
Not sure whether your NDA's confidentiality clause is fair or overreaching? NDA Guard scans the scope definition, flags missing carve-outs, and gives you counter-language ready to paste. Try your first review free →
Specific Risks for Freelancers
For freelancers specifically, an overbroad confidentiality scope isn't an abstract legal risk — it collides with the everyday mechanics of running a solo business.
Portfolio mentions. Your portfolio is your marketing. If the scope clause captures "the existence of this Agreement" or "the fact that the parties are in discussions," you may be barred from even naming the client — let alone showing the work. Some clients genuinely require this, but many broad clauses sweep it in without anyone intending to prevent a case study. Always check whether you can attribute the work, and negotiate for at least a logo-and-project-type mention if you can.
LinkedIn and social updates. "Excited to have shipped a new checkout flow this quarter" is the kind of routine professional post freelancers use to stay visible. Under an all-encompassing scope with no public-domain carve-out, describing what you built — even in general terms — can technically breach the agreement. You want scope narrow enough that describing your own type of work isn't captured, only the client's specific confidential material.
Discussing project types in proposals. Your next proposal will inevitably draw on what you've done before: "I've built subscription billing systems for SaaS companies." That's how freelancers demonstrate relevant experience. An overbroad clause that treats the general category of work as confidential undermines your ability to describe your own expertise. The carve-outs — especially independent development and public domain — are what preserve your right to talk about the kind of work you do without exposing any specific client's secrets.
The pattern across all three: a reasonable NDA protects the client's information, not the general facts of your professional life. When the scope starts fencing off your ability to describe your own work, it has gone too far.
Counter-Language to Narrow the Scope
If you've read a confidentiality clause and it's too broad, you don't need to reject the NDA — you need to propose a tighter definition. Here's language you can offer:
Counter-language (definition): "'Confidential Information' means non-public information that the Disclosing Party marks as confidential, or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure."
This replaces "all information disclosed" with a standard that requires the information to actually be non-public and reasonably identifiable as sensitive.
Counter-language (exclusions): "Confidential Information does not include information that: (a) is or becomes publicly available other than through the Receiving Party's breach; (b) was in the Receiving Party's possession prior to disclosure; (c) is independently developed by the Receiving Party without use of the Disclosing Party's Confidential Information; or (d) is rightfully received from a third party without restriction."
If the four standard exclusions are missing, this is the single most important addition you can make.
Counter-language (attribution carve-out for freelancers): "Notwithstanding the foregoing, the Receiving Party may identify the Disclosing Party as a client and describe the general nature and category of services provided, provided no specific Confidential Information is disclosed."
That last one preserves your ability to build a portfolio and describe your experience — the practical protection freelancers most often lose to an overbroad scope.
When you propose these, frame it as making the agreement workable rather than as a challenge. Most clients accept standard carve-outs without argument, because their own lawyers would tell them the same clauses are normal.
FAQ
What does "confidentiality scope" mean in an NDA?
It's the definition of exactly which information you're required to keep secret. The scope is set by the NDA's definition of "Confidential Information" plus its list of exclusions. A narrow scope covers only genuinely sensitive material and lets you operate normally; a broad scope covers "all information disclosed" and can restrict things you already knew or that are publicly available. The scope clause is usually the most consequential part of the whole agreement.
Is it normal for an NDA to say everything is confidential?
It's common, but it's not reasonable — and common doesn't mean you have to accept it. Legal teams often draft the broadest possible definition as a starting position. A well-drafted NDA limits confidentiality to non-public, genuinely sensitive information and includes standard carve-outs for public domain, independently developed, third-party, and legally compelled information. If an NDA lacks those exclusions, that's worth raising before you sign. For a broader tour of what to watch for, see the 8 NDA red flags every freelancer should know.
Can I discuss publicly available information covered by an NDA?
Under a properly drafted NDA, yes — the public-domain carve-out explicitly excludes information that is or becomes public through no fault of yours. But if the NDA has no such carve-out and defines confidentiality as "all information disclosed," then technically you could be held liable even for public facts. That's precisely why the exclusions matter, and why you should confirm they're present before signing.
What are the standard exclusions every NDA should have?
Four: (1) information already in or entering the public domain through no breach of yours; (2) information you independently developed without using the client's confidential materials; (3) information you rightfully received from a third party without restriction; and (4) information you're legally required to disclose. These four are the baseline. An NDA missing any of them isn't stricter — it's incomplete, and the gap works against you.
How long should confidentiality obligations last?
Scope and duration are separate questions, and both matter. Even a well-scoped clause becomes a problem if it never expires. Confidentiality obligations should survive termination for a defined period — typically two to five years for general business information — rather than continuing forever. An indefinite obligation combined with an overbroad scope is the worst of both, restricting too much for too long. See why indefinite NDA clauses are a problem for how to put a sunset on the obligation.
Scope Is the Clause That Decides Everything Else
Confidentiality is not the enemy. Clients have real secrets that deserve protection, and agreeing to keep them is part of being a professional. The problem is scope drawn without limits — the "all information disclosed" definition that captures public facts, things you already knew, and your own right to describe your work.
The fix is rarely to refuse the NDA. It's to narrow the definition to genuinely non-public, sensitive information and to insist on the four standard exclusions. That's the difference between an agreement that protects the client and one that also quietly constrains your ability to run your business for years afterward.
Reading the scope clause takes five minutes. Knowing what belongs inside the fence — and what must be carved back out — is what turns a signature into an informed decision instead of a hopeful one. If you'd rather not check it clause by clause yourself, NDA Guard reviews the full confidentiality scope automatically, flags every missing carve-out, and hands you counter-language ready to paste into your reply.