International Confidentiality Agreement

An international (cross-border) confidentiality agreement is a non-disclosure agreement in which at least one party, or the physical location of the disclosure, sits outside the disclosing party’s home jurisdiction. The core structure — defining what counts as confidential information, who may see it, what they can and cannot do with it, and for how long — is the same as any domestic NDA (see Confidentiality Agreement (NDA) and the CASRAI worked NDA example). What changes are three additional considerations that a single-jurisdiction NDA does not need to address: whether the disclosure itself is regulated as an export, which country’s law and courts will actually govern a dispute, and — when the confidential information includes personal data — what safeguards are needed to move that data across a border lawfully.

Export-Control Screening: Deemed Exports and the Fundamental Research Exemption

Before a US institution discloses technical information to a foreign person — whether that person is physically abroad or a foreign national sitting in a US lab — research administrators typically screen the disclosure against US export-control regulations: the International Traffic in Arms Regulations (ITAR, 22 CFR Parts 120-130, administered by the State Department’s Directorate of Defense Trade Controls) and the Export Administration Regulations (EAR, 15 CFR Parts 730-774, administered by Commerce’s Bureau of Industry and Security). Releasing controlled technology or technical data to a foreign national can be treated as an export to that person’s home country even when no physical border is crossed — this is a deemed export, and it can trigger a licensing requirement independent of what the confidentiality agreement itself says. Basic and applied research at accredited institutions that is ordinarily published and shared openly is generally covered by the fundamental research exemption, which removes much of this friction — but a confidentiality agreement that restricts publication or excludes foreign nationals from the work can itself forfeit that exemption for the project. This interplay is why sponsored-programs and export-control offices review the categories of information a proposed cross-border NDA will cover, not just its confidentiality clauses, before anyone signs. CASRAI’s Export Control (EAR/ITAR) and International Research Collaboration guide covers this screening process in depth.

Governing Law, Jurisdiction, and Dispute Resolution

A domestic NDA can default to the state or national law of whichever institution drafted it without much negotiation. A cross-border agreement cannot: each party has a legitimate interest in a legal system and court (or arbitral forum) it can actually access and enforce a judgment in, and a governing-law clause that looks routine to one side can be a genuine sticking point to the other — particularly for a public university that may be legally constrained in which jurisdiction’s law it can agree to. Negotiators typically address this explicitly rather than leaving it to a template default: naming a specific governing law, a specific court or arbitral institution, and, for institutions in a multi-country consortium, sometimes a neutral third jurisdiction acceptable to all parties. Because a domestic court judgment is not automatically enforceable abroad, some cross-border agreements also specify an arbitration clause (for example under ICC or UNCITRAL rules) precisely because arbitral awards are more readily enforceable across borders under the New York Convention than a foreign court judgment would be.

When the Confidential Information Includes Personal Data: GDPR Transfer Requirements

If the information covered by the agreement includes personal data — named research participants, contact details of named investigators, or similar — and either party is subject to the EU General Data Protection Regulation, the confidentiality agreement’s cross-border sharing can also trigger GDPR’s separate international-transfer regime under Chapter V. Article 44 sets the general rule that personal data may only be transferred to a third country if the rest of Chapter V’s conditions are met. Article 45 covers transfers to countries the European Commission has found to offer an adequate level of protection (no further safeguard needed). Where no adequacy decision applies, Article 46 requires an appropriate safeguard — most commonly the European Commission’s Standard Contractual Clauses (SCCs) — and Article 49 provides narrow derogations (such as explicit consent) for cases where neither an adequacy decision nor Article 46 safeguards are in place; there is no standalone research-specific derogation in Article 49’s text. Following the Court of Justice’s 2020 Schrems II decision, which invalidated the EU-US Privacy Shield adequacy finding while upholding SCCs subject to a transfer impact assessment, transfers to the US now more commonly rely on the successor EU-US Data Privacy Framework adequacy decision. In practice, this is usually handled as a separate schedule or companion document rather than folded into the confidentiality agreement’s own text — see Data Transfer Agreement (DTA) and CASRAI’s GDPR Article 44 (international data transfers) entry for the transfer-mechanism details.

Related Cross-Border Agreement Types

Two related instruments are easy to confuse with a general international confidentiality agreement. An NNN Agreement adds non-use and non-circumvention clauses to a confidentiality structure and is used specifically when disclosing technical information to a prospective foreign manufacturing or licensing partner — most commonly a China-based manufacturer — where a standalone confidentiality clause is often difficult to enforce. A Data Transfer Agreement is narrower still: it governs the mechanics of moving a specific dataset (authorized senders/recipients, transmission method, destruction terms) rather than the broader confidentiality relationship. See also CASRAI’s NDAs in Research and Technology Transfer guide for how these agreements typically fit into a technology-transfer relationship’s timeline.

Frequently Asked Questions

Does a confidentiality agreement need an export-control review if both parties are universities?

Yes, if either party is disclosing controlled technical information to a foreign national — institutional affiliation as a university does not itself exempt a disclosure from deemed-export analysis, though the fundamental research exemption often applies to open, publishable academic work.

Can a US public university agree to be governed by foreign law?

Often not without an exception or specific institutional approval — many public universities are legally constrained in which jurisdiction’s law and courts they can accept, which is a common reason governing-law negotiations take longer on cross-border agreements than on domestic ones.

Does GDPR apply just because a confidentiality agreement is signed with a European partner?

GDPR’s transfer rules apply based on whether personal data is involved and who is subject to GDPR, not merely on where a counterparty is located — a cross-border agreement that only covers non-personal technical information does not trigger Chapter V, while one that includes named individuals’ data does, regardless of whether the counterparty itself is European.