NDA Indemnification Clause: What Unlimited Liability Actually Means
Most freelancers read the confidentiality section of an NDA carefully and skim the indemnification clause entirely — it's usually shorter, denser, and buried near the boilerplate at the end. That's backwards. The confidentiality clause tells you what you can't say. The indemnification clause tells you what happens to your finances if you say it anyway, and in a badly drafted NDA, the answer is: everything you own, with no ceiling.
An indemnification clause with no liability cap is one of the most financially dangerous provisions a freelancer can sign, because it's the one clause where "worst case" isn't bounded by the size of the contract. A $3,000 project and a $300,000 project can carry the identical exposure if the indemnification language is unlimited. This post explains what the clause actually does, what "unlimited" means in real numbers, what market standard looks like, and the exact language to propose instead. For the broader signing decision, see Should I Sign This NDA?; for a full list of dangerous clause types, see NDA Red Flags.
What Indemnification Means in Plain English
Indemnification is a promise to cover someone else's losses. In an NDA, an indemnification clause says that if you breach the agreement — disclose confidential information, misuse it, or cause the other party a loss connected to the NDA — you agree to pay for the damages that result, including the other party's legal fees in pursuing the claim.
This is a different mechanism from a simple breach-of-contract remedy. Without an indemnification clause, a party who suffers a loss from your breach still has to sue you and prove damages under ordinary contract law, which has its own limits and defenses. An indemnification clause is a separate, standalone promise to pay — it can shift costs and burdens of proof in the other party's favor, and it often stacks on top of (rather than instead of) a straightforward damages claim.
The clause typically has three moving parts: what triggers it (a breach, a misrepresentation, negligence), what it covers (direct damages, third-party claims, legal fees, sometimes consequential or "special" damages), and whether there's any limit on the total amount. That third part — the cap, or absence of one — is where almost all the real risk lives.
One-Way vs Mutual Indemnification
Read the clause and ask a simple question: who indemnifies whom?
One-way indemnification — the pattern you'll see most often in client-drafted NDAs — obligates only you, the contractor, to indemnify the client. The client takes on no reciprocal obligation if their own conduct causes you a loss (for example, if they hand you information carelessly labeled, or misrepresent what you're permitted to do with it). This asymmetry means the entire financial risk of the relationship sits on your side of the table, even though confidentiality obligations in a well-drafted NDA typically run in both directions.
Mutual indemnification obligates both parties equally: each side agrees to cover the other's losses if their own breach causes them. This is the fairer structure, and it's increasingly the market standard for engagements where both sides are sharing sensitive information (which is most freelance and consulting relationships, even if the NDA is framed as one-directional).
If a "mutual NDA" — one that claims to protect both parties' confidential information — contains a one-way indemnification clause, that's a red flag on its own: the document's structure and its risk allocation don't match, and it's worth pointing out explicitly when you negotiate.
What "Unlimited" Liability Means in Practice
"Unlimited liability" isn't legal abstraction — it means there's no dollar figure anywhere in the clause capping what you could owe. Here's what that looks like as an actual scenario.
You're a freelance developer on a $15,000 contract building an internal tool. The NDA you sign has a standard-looking indemnification clause: no cap, no carve-out, covers "any and all losses, damages, costs, and expenses (including reasonable attorneys' fees) arising from or related to Contractor's breach of this Agreement." Eighteen months later, a piece of source code or a client roadmap detail you had access to ends up, through a chain of events only tangentially connected to you, in a competitor's hands. The client alleges breach, claims it lost a $500,000 deal because a competitor undercut them using the leaked information, and demands you indemnify them for the full amount plus the legal fees they spent building the case.
Whether that claim would actually succeed in court is a separate question — causation, actual damages, and your defenses all matter, and plenty of these claims settle for far less or get dropped. But the point of a liability cap is that you never have to find out. Without one, the $15,000 contract and the $500,000 exposure exist in the same document, and nothing in the NDA itself limits how far the second number can run. Freelancers and small contractors rarely carry insurance or personal assets that make an unlimited exposure survivable — which is exactly why this is the clause most worth fixing before you sign, not after a dispute starts.
Industry Standard: Mutual + Capped at Fees Paid
Across well-negotiated freelance and consulting NDAs, a clear market pattern exists:
- Mutual, not one-way. Both parties indemnify each other for their own breaches.
- Capped at fees paid — typically the total fees paid (or payable) to the contractor under the engagement, sometimes over a trailing 12-month period for longer relationships. This ties your maximum exposure to the actual size of the deal.
- Carve-outs for the cap are common and usually reasonable: caps typically don't apply to breaches involving willful misconduct, fraud, or gross negligence. This is a fair trade — a cap protects you from ordinary mistakes and disputes, not from deliberate bad acts.
- Excludes indirect and consequential damages — lost profits, lost business opportunities, and speculative future losses are excluded, leaving only direct, provable damages in scope.
If the NDA in front of you has no cap at all, it's an outlier relative to this standard, not the norm — and framing it that way to the client (rather than as an unreasonable demand on your part) tends to go over better.
Counter-Language to Add a Liability Cap
The goal isn't to eliminate indemnification — clients have a legitimate interest in recourse if you genuinely breach the agreement. The goal is to make the exposure proportional to the engagement.
Counter-language to propose:
"Each party's total liability to the other arising out of or related to this Agreement, whether in contract, tort, or otherwise, including under this indemnification section, shall not exceed the total fees paid or payable to Contractor under this Agreement in the twelve (12) months preceding the claim. This limitation shall not apply to breaches arising from a party's willful misconduct, fraud, or gross negligence. Neither party shall be liable to the other for any indirect, incidental, consequential, special, or punitive damages, including lost profits or lost business opportunities, even if advised of the possibility of such damages."
When you send this, frame it plainly: "The indemnification section as drafted has no cap, which means my exposure isn't tied to the size of this engagement. I've proposed language that caps liability at fees paid, with standard carve-outs for willful misconduct — this is fairly standard for contractor agreements at this scale and shouldn't affect how the clause works for ordinary breaches." Most clients, especially smaller companies without in-house counsel, adopt language like this without much friction once they see it framed as a size-appropriate limit rather than an attempt to avoid accountability.
If the client pushes back, the fallback position is a cap set higher than fees paid (say, 2x or 3x fees) rather than no cap at all — a compromise that still bounds your worst case to a defined number.
When Indemnification Is Actually Reasonable
Not every indemnification clause is a problem, and it's worth being able to tell the difference so you don't spend negotiating capital on the wrong fight.
A capped, mutual indemnification clause tied to actual breach of the agreement is standard and shouldn't concern you. It's also reasonable for a client to exclude the cap for willful misconduct, fraud, or intentional disclosure — you shouldn't be protected from your own deliberate bad acts, and asking for that protection undermines your credibility on the parts of the clause that do need fixing. Similarly, a clause that requires you to indemnify the client specifically for third-party IP infringement claims arising from work you personally created (as opposed to information the client gave you) is a normal allocation of risk in a services agreement, separate from the NDA-specific confidentiality risk this post focuses on.
The clause becomes a genuine problem only when one or more of these are true: no cap exists at all, the obligation runs one-way in what's framed as a mutual agreement, the trigger is broad enough to capture ordinary business disputes rather than actual confidentiality breaches, or consequential and speculative damages (lost profits, lost deals) are explicitly included rather than excluded.
FAQ
Does every NDA need an indemnification clause?
No. Many well-drafted NDAs, especially shorter mutual NDAs between two sophisticated parties, rely on ordinary breach-of-contract remedies and don't include a separate indemnification section at all. If a client's NDA has no indemnification clause, that's not automatically something you need to add — the absence isn't a red flag on its own, and adding an indemnification obligation where none exists usually only increases your risk.
Can I just cross out the indemnification clause instead of capping it?
You can propose it, but expect resistance — clients are often more attached to keeping some indemnification language than to keeping it uncapped, since it signals that breaches have consequences. A capped, mutual version is usually an easier sell than an outright removal, and it gets you most of the protection you actually need.
What's the difference between an indemnification cap and a general limitation of liability clause?
They're related but not identical. A limitation of liability clause is often broader, covering all claims under the agreement, while an indemnification clause specifically covers third-party claims and losses tied to a breach. The counter-language above addresses both by capping "total liability... including under this indemnification section" in one place — but always check whether the NDA has a separate limitation of liability section elsewhere that needs the same fix, as described in NDA Red Flags.
Does an indemnification clause matter if I'm working through an LLC?
It matters less, but not as little as people assume. An LLC generally shields your personal assets from claims against the business, but that protection has limits — courts can pierce the corporate veil in cases involving personal wrongdoing, and if the claim alleges willful misconduct or fraud (the usual carve-out from any cap), personal liability becomes more likely regardless of your business structure. An LLC is good practice, but it's not a substitute for capping the clause itself.
Is an uncapped indemnification clause a dealbreaker on its own?
Not automatically, but it should trigger the same cost-benefit analysis as any major red flag: what's the size of the engagement, what's your realistic exposure, and how likely is a dispute given the nature of the work. For a low-stakes, short-term project with a client you trust, an uncapped clause is a negotiation point, not necessarily a reason to walk. For a large, long-term engagement involving sensitive client data or IP, it's worth holding firm on a cap before signing — the downside asymmetry is too large to accept on good faith alone.
Cap the Exposure Before You Sign
An indemnification clause without a cap turns every NDA into a document with unlimited downside, regardless of what the contract is actually worth. That's rarely the client's intent — it's usually just what the template says. Proposing a cap tied to fees paid, with reasonable carve-outs for bad-faith conduct, is a standard ask that most clients accept without much back-and-forth.
NDA Guard flags uncapped indemnification clauses automatically, scores the risk, and drafts the counter-language for you in plain English — no need to parse the legalese yourself. For the full negotiation process beyond this one clause, read How to Negotiate an NDA as a Freelancer, or start with Should I Sign This NDA? if you're still weighing whether to sign at all.
Read the clause. Find the cap — or the absence of one. Fix it before you sign.