Standard commercial NDA templates are not adequate for pharmaceutical development. Drug development involves confidential information categories that are unique to the industry and that standard NDA boilerplate does not adequately address: compound synthesis routes, preclinical pharmacology and toxicology data, clinical trial protocols and results, regulatory filing strategies, manufacturing process data, and patient safety signals. A poorly drafted pharma confidentiality agreement can expose years of drug development work to exploitation by the receiving party, sometimes through legal mechanisms the disclosing party never anticipated.

At Lopes Law LLC, we advise biotech and pharma clients on confidentiality agreements across all stages of drug development. This guide covers the pharma-specific categories of confidential information that need explicit protection, the difference between NDAs, CDAs, MTAs, and CRADAs, the residuals clause risk that is specific to pharma contexts, and how pharma confidentiality agreements must address data governance requirements including GDPR.

What Pharma-Specific Confidential Information Categories Need Explicit Protection?

Pharmaceutical confidentiality agreements must go beyond the generic definition of confidential information used in standard commercial agreements. Each of the following categories represents a distinct type of information with distinct risks if disclosed without adequate protection. The agreement should list these categories specifically in the definition of “Confidential Information.”

Compound and Synthesis Data

Compound structures (chemical name, structural formula, CAS registry number), synthesis routes, structure-activity relationship (SAR) data, and lead compound series information are among the most sensitive categories in drug development. This information is the direct output of years of medicinal chemistry research and can enable a receiving party to develop a competing compound or file a blocking patent if not adequately protected.

Preclinical Data

Preclinical data includes: in vitro pharmacology results (receptor binding, cellular activity assays), in vivo efficacy and safety studies in animal models, ADME (absorption, distribution, metabolism, excretion) studies, pharmacokinetic and pharmacodynamic parameters, and safety pharmacology data. This data package informs the design of human clinical trials and is highly valuable to potential licensees and competitors.

Clinical Trial Protocols and Results

Clinical protocols define the patient population, treatment regimen, efficacy endpoints, and safety monitoring plan for each phase of clinical development. Clinical study reports containing Phase 1, 2, and 3 results represent the primary evidence base for regulatory approval. Interim clinical data, including partial safety and efficacy results that have not yet been publicly disclosed, is particularly sensitive because it can influence investment decisions and competitive strategy.

Regulatory Filing Strategies

Regulatory strategy information includes: the company’s IND strategy, FDA meeting minutes and agency feedback, plans for Breakthrough Therapy Designation or Fast Track applications, NDA or BLA filing timelines, and strategies for pediatric labeling or post-marketing commitments. This information reveals the company’s regulatory path to approval and can be exploited by competitors to anticipate and prepare for regulatory decisions.

Safety Signals and Pharmacovigilance Data

Adverse event data, pharmacovigilance reports, and emerging safety signals represent highly sensitive information that, if disclosed prematurely, can affect clinical trial enrollment, investor confidence, and regulatory relationships. Safety signal data should be specifically listed as a protected category in the agreement, separate from the general clinical data provisions.

Manufacturing Process Data

Manufacturing process know-how, including synthesis procedures, formulation technology, process chemistry, and scale-up data, is often protected as a trade secret rather than a patent. This means the trade secret term (indefinite, as long as the information remains confidential) rather than the standard NDA term applies. The confidentiality agreement must specifically address that manufacturing know-how obligations survive the expiration of the agreement’s stated term.

What Is the Difference Between an NDA, CDA, MTA, and CRADA?

The pharmaceutical industry uses several different types of agreements to protect confidential information, and the distinctions between them matter for both legal obligations and practical scope.

NDA (Non-Disclosure Agreement) and CDA (Confidential Disclosure Agreement)

In the pharmaceutical industry, NDA and CDA are substantively the same document. Both are confidentiality contracts that protect disclosed information. The only difference is the label. Many pharma companies prefer CDA because “NDA” is also used to refer to a New Drug Application, which is the FDA regulatory filing for a new pharmaceutical product. Using “CDA” avoids potential confusion in communications that reference both legal and regulatory documents.

MTA (Material Transfer Agreement)

An MTA governs the transfer of physical materials: biological samples, cell lines, research compounds, animal models, or other tangible research materials. An MTA combines confidentiality provisions with material use restrictions that are absent from an NDA or CDA. The MTA will specify: (1) the specific materials being transferred; (2) the permitted use of the materials (usually limited to a specific research purpose); (3) restrictions on further transfer to third parties; (4) IP ownership of results generated using the materials; and (5) return or destruction obligations when the permitted use concludes.

A biotech that receives a biological sample or cell line from another organization under an MTA must comply with both the confidentiality and the material use restrictions. Using the materials for purposes beyond the stated permitted use is an MTA breach regardless of whether any confidential information was also misused.

CRADA (Cooperative Research and Development Agreement)

A CRADA governs collaborative research between a private entity and a US government agency or laboratory. CRADAs are authorized under 15 U.S.C. Section 3710a and have specific statutory requirements that differ from standard commercial confidentiality agreements. CRADAs often arise when a pharma company collaborates with NIH, the FDA itself, or a National Laboratory on research activities related to drug development. The government retains certain rights under a CRADA that do not apply to purely private agreements.

What “Residuals” Clause Risk Exists in Pharma Agreements?

The residuals clause is the single most dangerous provision in pharmaceutical confidentiality agreements, and it is also one of the most frequently overlooked by parties who are accustomed to commercial NDAs where it is relatively benign.

How Residuals Clauses Work

A residuals clause typically reads: “Nothing in this Agreement shall restrict the Receiving Party’s use of information retained in the unaided human memory of its employees who had access to Disclosing Party’s Confidential Information, provided such employees are not specifically directed to memorize such information.” In a technology context, this means a software engineer who worked on a project retains general programming knowledge. That is a reasonable concession.

In a pharma context, the same provision has a very different effect. A medicinal chemist who reviewed your compound synthesis route retains detailed knowledge of the chemistry. A clinical scientist who reviewed your Phase 2 study results retains specific efficacy and safety data. A regulatory affairs professional who reviewed your IND strategy retains knowledge of your regulatory filing approach. The residuals clause permits the use of all this information without restriction after the permitted purpose ends.

How to Address Residuals Clauses in Pharma Agreements

The most protective approach is to negotiate deletion of the residuals clause entirely. Many large pharma companies and CROs include residuals clauses as standard but will accept deletion upon request from a counterparty with sufficient leverage or sufficient compound-specific information to share.

If deletion is not achievable, negotiate explicit carve-outs that exclude the following categories from the residuals exemption: compound structures and synthesis routes, biological sequences, formulation details, manufacturing process know-how, and clinical study results at a patient-data level. These carve-outs protect the highest-value categories while permitting the receiving party to retain general scientific knowledge that is genuinely independent of your specific compound program.

How Should Pharma Confidentiality Agreements Address Data Governance?

Modern pharmaceutical development involves data flows that raise regulatory compliance questions beyond the scope of a standard confidentiality agreement. The confidentiality agreement must address data governance to ensure that regulatory obligations are met alongside the contractual confidentiality obligations.

Data Access Controls

The agreement should specify which personnel within the receiving organization may access the confidential information: typically limited to specific functions (due diligence team, legal counsel, designated scientific reviewers) and specific individuals where practical. Blanket access by all employees of the receiving organization provides inadequate protection for compound-level data.

Electronic Data and Backup Copies

Destruction and return provisions must specifically address electronic data: email attachments, cloud storage copies, backup server copies, and local drive copies. A receiving party that deletes visible copies but retains backup server copies in a standard archiving cycle may be in technical compliance with the return/destruction obligation as drafted but retains the confidential information indefinitely. The agreement should require destruction of backup copies on a specified schedule or upon the disclosing party’s request.

GDPR Compliance for Clinical Data

If the pharma confidentiality agreement involves the sharing of clinical trial data that includes information about EU-based trial participants, GDPR applies. Under GDPR Article 9, health data is “special category” personal data that receives heightened protection. Sharing health data under a confidentiality agreement requires a legal basis for processing, appropriate technical and organizational security measures, and (for EU-to-US transfers) Standard Contractual Clauses or other approved transfer mechanisms under GDPR Chapter V.

The pharma confidentiality agreement should address: which party is the data controller, which party is the data processor, the basis for processing health data, security standards, breach notification obligations, and data subject rights. A pharma confidentiality agreement that addresses trade secret protection but ignores GDPR compliance creates significant regulatory exposure.

FDA Inspection Considerations

Certain clinical trial data shared with clinical sites or CROs under a pharma confidentiality agreement may be subject to FDA inspection at those sites. The agreement should acknowledge that the receiving party’s obligations under FDA regulations take precedence over the confidentiality provisions and that FDA-required disclosures are a permitted disclosure under the agreement.

Client Scenario: The Residuals Clause and the Competing Patent

A biotech company in late preclinical development shared its Phase 1-ready compound data with a potential licensing partner under a CDA. The CDA used the large pharma’s standard form, which included a residuals clause without any carve-outs for compound-specific information. The licensing discussions lasted 6 months before the large pharma declined to proceed.

Eighteen months after the discussions concluded, the large pharma filed a patent application for a related compound formulation that used a manufacturing process meaningfully similar to the one disclosed by the biotech in the CDA discussions. The biotech’s patent counsel reviewed the application and concluded that the formulation approach was only enabled by knowledge of the synthesis route the biotech had shared. The residuals clause had permitted the large pharma’s formulators to use that knowledge without restriction.

The resulting dispute required analysis of laboratory notebooks, email correspondence, and expert witnesses on both sides. The process took nearly two years and consumed a significant portion of the biotech’s legal budget. At Lopes Law LLC, we routinely negotiate the deletion of residuals clauses or the addition of explicit carve-outs before our biotech clients share any study data with potential partners, regardless of the apparent size or reputation of the potential partner.

What Provisions Are Frequently Missing from Pharma Confidentiality Agreements?

After reviewing pharma confidentiality agreements across a range of transaction types and company sizes, several provisions are consistently absent from agreements that were drafted without pharma-specific legal review.

Patent Filing Exception

Without an explicit exception, the disclosing party’s filing of a patent application based on its own disclosed information could technically be a breach of the confidentiality agreement. The agreement should include a provision confirming that the disclosing party retains the right to file patent applications based on its own proprietary information, and that the receiving party may not file patent applications based on any information disclosed under the agreement.

Sublicensing to Development Partners

Pharma companies routinely need to share confidential information with their own development partners: CROs, CDMOs, regulatory consultants, and clinical sites. If the confidentiality agreement prohibits all third-party sharing without the disclosing party’s prior consent, every engagement with a development partner requires separate consent. The agreement should include a defined list of permitted third-party recipients (or categories of permitted recipients) with appropriate confidentiality obligations flowing down to those recipients.

Indefinite Protection for Trade Secrets

Pharma confidentiality agreements often have stated terms of 5 to 10 years after which all confidentiality obligations expire. For trade secret categories, including manufacturing processes and synthesis routes, the confidentiality obligation should survive the stated term as long as the information remains a trade secret. A fixed expiration on trade secret protection effectively converts your trade secrets into public domain information at the end of the NDA term.

For a detailed guide to pharmaceutical NDAs specifically, see our post on Pharmaceutical NDAs: What Biotech and Pharma Companies Need to Know. For clinical trial agreements and the confidentiality provisions within them, see Clinical Trial Research Agreements: Key Legal Provisions. For cross-border NDA considerations, see our guide on Cross-Border NDA and CDA Agreements.

Reach out, we are friendly. Call now for a free consultation at (267) 777-9117 or schedule your free 20-minute consultation online.