You should consider your stated purposes for processing the personal data. You can keep it as long as one of those purposes still applies, but you should not keep data indefinitely 'just in case', or if there is only a small possibility that you will use it.
NDAs should have a clear description of the purpose, parties, and duration they cover. Specifying time limits or periods that your employees are subject to confidentiality is particularly important to ensure your NDA is enforceable in California. The typical time period is one to five years.
Starting January 1, 2025, businesses settling disputes with consumers cannot condition any refund or other consideration on a consumer agreeing not to make statements about the business, regardless of the sentiment or accuracy of those statements. The text of the new Cal. Civ. Code § 1748.50 can be found here.
A confidentiality agreement should include the names and addresses of the parties to the contract. Consider also including: Reason for the agreement: Explain why you're sharing this information. The information disclosed: Be specific about the subject matter and what exactly is included in the agreement.
NDAs that prevent people from speaking about any of these acts usually do not hold up in court, even if they are otherwise valid. Similarly, California courts will not enforce an NDA if the information it seeks to protect is already known to the public or is illegal in nature.
Whether or not the overall agreement has a definite term, the parties' nondisclosure obligations can be stated to survive for a set period. Survival periods of one to five years are typical. The term often depends on the type of information involved and how quickly the information changes.
Typically, a legal professional writing the NDA will complete these steps: Step 1 - Describe the scope. Which information is considered confidential? ... Step 2 - Detail party obligations. Step 3 - Note potential exclusions. Step 4 - Set the term. Step 5 - Spell out consequences.