Blog
How an NDA Protects Your PCB Project and Design Files
In 2026, Tata Electronics, an Apple supplier, suffered a major data breach in which supplier information and internal testing materials related to components for the unreleased iPhone 18 Pro were reportedly uploaded to the dark web. Because the leaked information involved an unreleased Apple product and its supply chain, the incident quickly attracted widespread attention across the global technology and manufacturing industries.
Although this was not simply a leak of PCB design files, it still served as a warning to the wider electronics manufacturing sector:
Once product information enters an external manufacturing environment, risks may arise at several points.
Against this background, PCBCool will explain how NDAs apply to PCB and PCBA projects and how they can help customers protect project information throughout quotation, manufacturing, and assembly.
What Is an NDA
NDA stands for Non-Disclosure Agreement, is a legally binding confidentiality agreement that defines how the parties involved in a business relationship may receive, use, store, and disclose information that has not been made public.
The protected information may include technical materials such as product designs, drawings, software, and test data, as well as commercial information such as quotations, customer details, purchasing prices, supplier information, and product launch plans.
Under an NDA, the party providing confidential information is generally referred to as the Disclosing Party, while the party receiving it is known as the Receiving Party. Under a mutual NDA, either party may act as both a Disclosing Party and a Receiving Party.
The Receiving Party may use the information only for the purposes specified in the agreement. It may not disclose the information to unauthorized third parties or use it for unrelated projects or commercial activities.
The UK Intellectual Property Office defines an NDA as a legal contract that determines how information or ideas may be shared confidentially. The World Intellectual Property Organization also notes that NDAs and confidentiality clauses establish boundaries for the use of information and provide a contractual basis for taking action when trade secrets are misused or improperly disclosed.
Why Are NDAs Particularly Important in PCB Projects
PCB projects have one defining characteristic: a manufacturer must understand the design and production requirements before it can determine manufacturability and provide a reasonably accurate quotation and lead time.
As a project progresses from an initial inquiry to DFM analysis, component sourcing, and production, the customer will normally need to provide increasingly detailed technical and commercial information.
This means that the parties may begin exchanging non-public information before a formal business relationship has been established. Even when a manufacturer is not ultimately awarded the order, it may already have reviewed parts of the design, material strategy, or project plan.
The importance of an NDA in a PCB project is therefore clear. It allows the customer to establish boundaries for the use of project information in advance, including:
- Stipulating that the information may be used only for quotation, engineering evaluation, and production of the specified project;
- Limiting access to authorized internal employees and approved external parties;
- Defining how project information must be handled after an inquiry is closed or cooperation ends.
The objective is to protect the customer against financial and commercial losses caused by unauthorized disclosure without preventing the manufacturer from completing the quotation and necessary engineering work.
What Information Commonly Requires Protection in a PCB Project
Not every PCB inquiry requires an NDA, and signing one for every preliminary discussion is not always necessary. An NDA may offer limited practical value when the project involves an already published design, an educational project, a general-purpose adapter board, or an initial inquiry containing only the layer count, dimensions, and estimated quantity.
Similarly, including a file in an NDA does not automatically turn all of its contents into a trade secret. According to the World Intellectual Property Organization, information generally needs to meet three basic conditions before it may qualify as a trade secret:
- It has commercial value because it is not publicly known;
- It is known only to a limited group of people;
- The information holder has taken reasonable measures to maintain its confidentiality.
In PCB projects, the most sensitive information is often not a single isolated file, but a collection of materials.
For example, a Gerber file alone may not fully explain how a product works. When combined with the schematic, BOM, and firmware requirements, however, it may reveal much of the product’s design logic.
Information commonly identified in a PCB NDA includes:
- Manufacturing information: Gerber files, ODB++ data, drill files, PCB source files, schematics, stackups, impedance requirements, and special process instructions;
- Supply chain information: BOMs, package and reference designator data, approved alternatives, nominated suppliers, purchasing prices, and component sources;
- Software information: Firmware, program files, test software, communication protocols, test procedures, and acceptance criteria;
- Security-related information: Encryption keys, serial-number rules, server configurations, account information, and debugging interfaces;
- Commercial information: Customer identities, final product brands, order quantities, target costs, sales territories, and product launch plans.
One-Way NDA vs Mutual NDA
Depending on how information is exchanged between the parties, an NDA may be structured as either a one-way or a mutual agreement.
| Type | Appropriate Situation | Confidentiality Responsibility |
|---|---|---|
| One-way NDA | Confidential information is mainly provided by one party to another | The receiving party assumes the primary confidentiality obligations |
| Mutual NDA | Both parties provide confidential information to each other | Both parties may act as the Disclosing Party and the Receiving Party |
In most PCB and PCBA projects, a one-way NDA is sufficient. The customer provides design files to the manufacturer, while the manufacturer uses those files to prepare a quotation and complete production.
In a smaller number of cases, the manufacturer may also need to disclose proprietary processes, internal technical solutions, or confidential supply chain information. In such situations, the manufacturer may also request that the customer accept confidentiality obligations, making a mutual NDA more appropriate.
A mutual NDA is not automatically more comprehensive or more professional than a one-way NDA. When confidential information flows primarily in one direction, there is little value in imposing obligations that the other party does not genuinely need to assume. The structure of the agreement should reflect how information will actually be exchanged.
Core Clauses to Include in a PCB Project NDA
1. Parties to the Agreement and Project Purpose
The NDA should first identify the full legal names, registered addresses, and contracting entities of both parties. A website name, brand name, or salesperson’s name is not sufficient.
If external production resources will be involved during the project, the agreement should also clarify whether those facilities or service providers are covered by its terms.
The agreement must then define the permitted use of the information. For example:
The confidential information may be used solely for quotation, DFM analysis, PCB manufacturing, component sourcing, assembly, testing, and delivery of the specified project.
If the defined purpose is too narrow, the manufacturer may be unable to complete legitimate engineering or procurement work. If it is too broad, the wording may allow the information to be used beyond the intended project.
The objective is to limit use to the project being evaluated or performed by the parties.
2. Scope of Confidential Information and Exclusions
The NDA should define which information is considered confidential. Some common categories have already been discussed above, and the precise scope should be based on the requirements of the actual project.
Confidential information does not necessarily need to be marked “Confidential” in every instance before it receives protection. The agreement may cover both:
- Information expressly identified as confidential;
- Information that should reasonably be understood as confidential because of its content or the circumstances in which it was disclosed.
The agreement should also include standard exclusions, such as information that:
- Has already been lawfully made public;
- Was lawfully known to the Receiving Party before disclosure;
- Was lawfully obtained from a third party with no confidentiality obligation;
- Was independently developed by the Receiving Party.
3. Restrictions on Use
The Receiving Party should be permitted to use the information only for the project specified in the NDA. It should not use the materials for other customers, other products, or its own commercial activities.
For PCB projects, the agreement may specifically prohibit the Receiving Party from:
- Using customer files to reproduce or sell the same product;
- Applying the design to another customer’s project;
- Publishing photographs of the PCB or finished product without permission;
- Using project information in advertising, case studies, exhibitions, or internal promotional materials;
- Adding customer files to a public database;
- Using the information to file patent applications or claim other intellectual property rights without authorization.
Allowing a manufacturer to review and use production files does not transfer ownership of patents, copyrights, trademarks, or designs. Where intellectual property ownership requires specific treatment, it should be addressed separately in the NDA or the relevant development agreement.
4. People and Organizations Permitted to Access the Information
A PCB project normally involves personnel from sales, engineering, CAM, procurement, production, and quality control. It is therefore impractical for an NDA to state that no employee may view the information.
A more appropriate approach is to apply the need-to-know principle. Only personnel who genuinely need the information to perform project-related work should be granted access, and those individuals should be subject to appropriate confidentiality obligations.
If the manufacturer needs to share information with an affiliated factory, component supplier, distributor, agent, or subcontractor, the NDA should clarify:
- Which organizations may access the information;
- Whether prior customer approval is required;
- How much information may be disclosed;
- Whether the third party must accept equivalent confidentiality obligations;
- Who will be responsible if the third party causes a breach.
5. Technical and Organizational Safeguards
An NDA should not merely state that information must not be disclosed. It should also require the Receiving Party to take reasonable measures to protect the information.
Depending on the risk level of the PCB project, the agreement may address:
- Which channels may be used to transfer files;
- Whether personal email accounts and personal devices are restricted;
- Which files must be encrypted;
- Whether file access and download activity must be logged;
- Whether information may be uploaded to third-party cloud platforms;
- How backup files will be managed;
- Whether Gerber files, BOMs, or schematics may be submitted to public AI tools;
- How access rights will be removed when an employee changes roles or the project ends.
When a project involves personal data, the parties may also need separate data-processing or privacy provisions under the applicable data protection laws. An NDA primarily protects technical and commercial information and does not replace all data protection obligations.
6. Return, Deletion, and Necessary Retention of Information
When an inquiry is closed, the manufacturer is not selected, or cooperation ends, the NDA should specify how the project information will be handled.
The customer may require the manufacturer to return or delete project files after receiving written notice. However, the realities of a manufacturing environment must also be considered.
Some information may remain in system backups, while other records may need to be retained for quality traceability, financial audits, regulatory compliance, or legal requirements.
A PCB NDA should therefore not simply require the manufacturer to “delete all information immediately when the project ends.” It should distinguish between:
- Ordinary working files;
- Production and quality traceability records;
- System backups;
- Records that must be retained by law or company policy.
Any retained copies should remain subject to the confidentiality obligations in the agreement.
7. Confidentiality Period and Termination
The agreement should distinguish between:
- The term of the NDA itself;
- The period during which confidentiality obligations apply to information already disclosed.
Even after cooperation ends, information obtained while the NDA was in effect may continue to require protection.
For example, oneNDA provides that terminating an agreement does not immediately remove confidentiality obligations that have already arisen. The Receiving Party must continue protecting the information for the agreed confidentiality period.
8. Breach Notification and Remedies
The NDA should specify what the Receiving Party must do if confidential information is mistakenly sent, lost, stolen, or accessed without authorization.
Common requirements include:
- Promptly notifying the Disclosing Party;
- Immediately stopping any further disclosure;
- Preserving access logs and other relevant evidence;
- Cooperating with an investigation into the scope of the incident;
- Taking reasonable measures to reduce further damage;
- Returning, isolating, or deleting the affected information as required.
If the breach causes losses, the Disclosing Party may seek compensation under the agreement and the applicable law. Where a disclosure is continuing or likely to spread further, the Disclosing Party may also seek an injunction or other legal remedy to prevent continued use or distribution.
9. Governing Law and Dispute Resolution
For cross-border PCB projects, the NDA should identify:
- The governing law;
- The relevant court or arbitration institution;
- The place of dispute resolution;
- The language of the agreement;
- The method for delivering formal notices.
If the NDA is prepared in English, Chinese, or multiple languages, it should state which version will prevail if the versions conflict.
Where several production facilities are involved, the agreement should also consider the relationship between the signing entity, the party that actually receives the information, and the location where production is performed.
File Management After Signing an NDA
Customers should also take reasonable measures to protect their project information rather than placing the entire responsibility on the manufacturer.
- Classify the Information
Project information may be divided into categories such as:
- General information;
- Internal information;
- Confidential information;
- Highly sensitive information.
Basic parameters such as board thickness and estimated quantity do not require the same level of protection as firmware encryption keys.
- Create a File Register
- Maintain a record of the files provided to the supplier, including:
- File name;
- Version;
- Date sent;
- Recipient;
- Transfer method;
- File hash;
- Whether the file must later be returned or deleted.
- Mark Important Files
Add appropriate confidentiality notices to drawings, BOMs, schematics, and compressed file packages. For example:
Confidential — Provided solely for quotation and manufacturing evaluation.
Avoid marking every email and file as highly confidential without distinction. Excessive classification makes the system harder to manage and reduces the visibility of genuinely sensitive information.
- Use Controlled Transfer Channels
Sensitive information may be transferred using:
- Encrypted file-transfer systems;
- Permission-controlled project platforms;
- Download links with limited validity;
- Two-factor authentication;
- Passwords sent through a separate channel;
- Access logs;
- File watermarks.
Encryption keys, passwords, and sensitive customer information should not be placed directly in email subject lines or file names.
- Limit the Information Provided
If firmware is not required during the quotation stage, it should not be submitted in advance. If complete source code is unnecessary for PCB manufacturing, the customer should not provide it.
An NDA does not guarantee absolute security, nor does it justify sharing all available information without distinction.
- Close Access When the Project Ends
If a supplier is not selected or the project ends, the customer should:
- Disable download links;
- Cancel external accounts;
- Request the deletion of unnecessary files;
- Arrange the return or disposal of samples and surplus materials;
- Retain appropriate confirmation records.
Final Thoughts
The value of a PCB NDA is not that it adds another signature to the project process. Its purpose is to establish clear rules before design information leaves the customer’s internal systems: who may access it, why it may be used, who may receive it, how long it may be retained, and what must happen when the cooperation ends.
For customers concerned about the confidentiality of a PCB or PCBA project, PCBCool can review NDA and file-management requirements before detailed design files are submitted and the next stage of cooperation begins.
FAQs
A: No. Public designs, educational boards, and standard products containing no sensitive information do not normally require a separate NDA.
A: Basic project parameters may be used to screen potential suppliers first. Complete Gerber files, BOMs, schematics, and firmware should generally be submitted only after the NDA has taken effect.
A: Yes, but it should be reviewed clause by clause. A supplier’s template may focus more heavily on protecting its quotations and manufacturing processes than on fully protecting the customer’s design information.
A: A mature template may be sufficient for a simple, low-risk project. High-value, cross-border projects or those involving complex intellectual property are more appropriately reviewed by a qualified legal professional.
A: The validity of an electronic signature depends on the applicable law, the signing method, and the preservation of evidence. For cross-border projects, both parties should confirm that they accept the chosen signing platform and execution method.
A: There is no universal period. The duration should be agreed by the parties according to the nature and lifecycle of the information.
A: Only if the agreement permits it.
A: An NDA can prohibit a manufacturer from using the customer’s information to copy a product. However, it generally cannot prevent the manufacturer from producing independently developed products for other customers merely because those products have similar general functions.
A: No. An NDA is a confidentiality agreement. The NDAA is the United States National Defense Authorization Act. They address entirely different issues.
Loki has worked in international trade and PCB since 2021, with experience in PCB fabrication, assembly, and customer communication. At PCBCool, he supports technical content publishing and helps connect customer inquiries with the right account manager for efficient project follow-up.
