Can we sign an NDA before discussing detailed software requirements?
Yes. When the discussion involves an unreleased product, algorithm, supply chain, commercial terms, or client information, Wavesteam can sign a one-way or mutual NDA before detailed discovery. Before signature, the parties still need a minimal non-sensitive description to verify their legal identities, signing authority, and general project type. After signature, disclosure should remain staged rather than transferring every dataset at once.
Article 501 of China's Civil Code imposes duties concerning trade secrets and other confidential information learned during contract negotiation even if no contract is ultimately formed. A separate NDA remains useful because it can define the protected material, permitted project purpose, authorized recipients, term, return or destruction, and dispute handling more specifically.
| Approach | Appropriate situation | Define carefully | Limitation |
|---|---|---|---|
| One-way NDA | Only the client discloses sensitive material | Information, purpose, permitted recipients | Does not protect later supplier solution or component disclosures |
| Mutual NDA | Both parties disclose product, technology, or commercial information | Duties for both sides and background IP | Must distinguish pre-existing and independently developed work |
| NDA plus controlled data room | Sensitive records, many participants, extended due diligence | Roles, download, watermark, logging, revocation, destruction | More administration but stronger evidence |
| Redacted samples before the project contract | Early feasibility can be tested without live data | How samples were created, no re-identification, expiry | Poor redaction may still expose people or commercial facts |
No one template fits every engagement. An overbroad definition can improperly capture public knowledge, prior knowledge, or independent development; a narrow one can miss oral demonstrations and derived analysis. Common exceptions include publicly available information, lawful prior possession, authorized third-party receipt, independent development, and legally compelled disclosure, with a notification process where permitted.
When establishing communication, decisions, and change control, also compare Can we run a small pilot before committing to the full software project? and What should we prepare for the first project conversation?; the linked guidance adds context that should be considered in the same decision.
What an NDA does not authorize
An NDA does not create a lawful basis to process any data the client sends. Customer lists, employee records, health information, or real-user logs may require a separate purpose, minimum fields, access, storage location, and deletion arrangement. Ownership and licensing of source, designs, training data, and project output belong in the development agreement or SOW. State secrets, export-controlled material, or data the client has no right to share do not become transferable because an NDA exists.
China's current Anti-Unfair Competition Law describes trade secrets as non-public technical or business information with commercial value for which the rights holder has taken corresponding confidentiality measures. An NDA can be one measure, but controlled download, need-to-know access, classification, and access/destruction evidence also matter. Sending files through an uncontrolled personal chat weakens actual protection.
Wavesteam recommends the sequence: exchange a non-sensitive summary and verify the parties; sign an appropriate NDA; open a redacted sample; provide restricted interfaces or screenshots after capability fit; and manage full project data under the service contract, data-processing terms, and client-controlled workspace. Oral disclosures can be confirmed in writing under a defined procedure.
We accept a client template or can propose one, but do not promise an arbitrary signature time. The parties should verify legal names, authority, scope, use, recipients, duration, exceptions, return/destruction, liability, and dispute forum. This is general delivery guidance, not legal advice; cross-border disclosure, major trade secrets, or material liability terms should be reviewed by counsel.