NDA Checklist for Sharing AI Training Data

Why the NDA comes before any sample

In a data partnership, the first thing that changes hands after the initial conversation is usually a sample: a slice of a repository, a set of tickets, a few documents. Even a small sample can contain sensitive information. The NDA is what defines how that sample may be handled, so it needs to be signed before anything is shared.

In Momentra's process, the NDA stage is where confidentiality, permitted use, retention and security are defined. Only after that is any sample reviewed. The later contract then governs the full scope, use, transfer and processing of data if you decide to proceed.

Many companies are offered a counterparty's standard NDA template. There is nothing wrong with starting from one, but templates are usually written for sharing business plans or pricing, not datasets. Use the checklist below to spot gaps, and do not hesitate to ask for changes. A reasonable partner will expect questions about use, retention and security.

Scope and definitions

Start by checking what the NDA actually covers. Vague definitions are the most common weakness.

• Does "confidential information" clearly include data samples, metadata, file names and anything derived from them?
• Does it cover information shared verbally in discussions, not just documents?
• Is it mutual where appropriate, so that both sides' information is protected?
• Are the standard exclusions reasonable, such as information already public or independently developed?

Permitted use

This is where a data NDA differs most from a typical commercial NDA. The agreement should say exactly what the recipient may do with the sample, and by implication, what they may not do. For an evaluation stage, permitted use is usually limited to assessing the data's quality and suitability for a potential partnership.

Watch for wording that quietly widens this, such as permission to use samples for "internal research", "product improvement" or "benchmarking". Each of these could allow the sample to be used in ways you did not intend. If the recipient needs any use beyond evaluation, it should be named specifically and agreed openly, not hidden in a general clause.

• Is use limited to evaluation, with training explicitly excluded until a full contract is signed?
• Is onward sharing with third parties prohibited or tightly controlled?
• Are attempts to re-identify individuals expressly prohibited?
• Is it clear that no ownership or licence is granted by the NDA itself?

Retention, return and deletion

Decide how long the recipient may keep the sample and what happens if the partnership does not go ahead. The NDA should give a clear answer, not leave it to good faith.

• Is there a maximum retention period for samples?
• Must the sample be deleted or returned if discussions end?
• Can you request written confirmation of deletion?
• How are backups and copies handled?

Security and access

The NDA should set minimum expectations for how the sample is stored and who can see it. You do not need to dictate every technical control, but the basics should be written down.

• Who may access the sample, and on what need-to-know basis?
• How will the sample be transferred, and is the channel encrypted?
• Where will it be stored, including which country?
• What happens in the event of a breach, and how quickly must you be told?

Personal data and the sample itself

If the sample may contain personal information, the NDA should address it directly rather than relying on general confidentiality wording. Ideally, the sample is chosen or cleaned so that it contains as little personal information as possible. Where some remains, the recipient's obligations should be at least as strict as your own obligations under the data protection laws that apply to you, such as GDPR or India's Digital Personal Data Protection Act 2023.

It also helps to agree on the size and nature of the sample in advance. A sample only needs to be large enough to show structure, completeness and quality. Agreeing on this up front avoids pressure to share more than necessary at the evaluation stage.

• Is the sample limited to what is needed to assess quality?
• Are obligations for any personal data in the sample clearly stated?
• Is the recipient required to tell you if it finds unexpected sensitive information?
• Can you withdraw the sample at any time during evaluation?

Duration, remedies and governing law

Check how long confidentiality obligations last. For data, obligations that end a year or two after signing may be too short; many parties agree that obligations survive for longer or, for certain information, indefinitely. Check what remedies are available, including the right to seek an injunction. And note the governing law and jurisdiction, especially when the parties are in different countries.

Finally, remember that you decide what is in scope. If you are not comfortable sharing a particular type of data even under an NDA, you can leave it out of the sample. A smaller, less sensitive sample is often enough to assess value.

This checklist is general information, not legal advice. Every situation is different, and you should have a qualified lawyer review any NDA before you sign it.