Demystifying the Non-Disclosure Agreement

In this episode of Bridging the Gap we are tackling a topic that sits at the very heart of successful collaborations but often feels wrapped in red tape: the Non-Disclosure Agreement, or NDA. If you work on sponsored research—whether it’s an industry partnership, a clinical trial, or a collaborative grant—you’ve likely taken on confidentiality obligations. These aren't just legal fine print; they follow you into every meeting, every manuscript, and every team conversation. 

Our goal on this podcast is to provide a quick orientation for UMN researchers and staff. By the end of this episode, you’ll know exactly what you’re required to do, what you should definitely avoid doing, and who to call when things get complicated. 

Hosted by University of Minnesota Corporate Research Partnerships Managers Leza Besemann and Jason Stockman, "Bridging the Gap" is a practical podcast series designed to help university faculty navigate the complexities of collaborating with the private sector. 

Transcript

Jason Stockman 0:08

Welcome back to Demystifying University and Industry Partnerships. I'm your host, Jason Stockman, a corporate research partnerships manager here at the University of Minnesota. Today we're tackling a topic that sits at the very heart of successful collaborations but often feels wrapped in red tape, the non-disclosure agreement, or NDA. If you work on a sponsored research project, whether it's an industry partnership, a clinical trial, or a collaborative grant, you've likely taken on confidentiality obligations. These aren't just legal fine print. They follow you into every meeting, every manuscript, and every team conversation. Our goal today is to provide a quick orientation for University of Minnesota researchers and staff. By the end of this episode, you'll know exactly what you're required to do, what you should definitely avoid doing, and who you could call when things get complicated. To help us navigate the ins and outs of confidentiality, I'm joined by two University of Minnesota experts who live and breathe these agreements. Please welcome Bridget Foss from our sponsored projects administration team, as well as Consulate Nijire from Technology Commercialization. Thank you for being here. Before we dive into the complex fun world of NDAs, let's take a minute to get to know the two of you a little bit better. Bridget, can we start with you? Why don't you tell us a little bit about your role and how you support the research community here at the university?

Bridget Foss 1:37

Hi, Jason. As you mentioned, I work in the Sponsored Projects Office where I'm a principal grant and contract officer for the business and industry team. The BI team is responsible for negotiating sponsored research agreements and clinical trial agreements with industry sponsors. The vast majority of those agreements include confidentiality obligations. So this is a very important topic for us, and I'm happy to be here to talk about it today.

Jason Stockman 2:03

We're happy to have you as well. Hey Consulate, how about you? What's your role here at the university?

Consolate Ndagire 2:08

Hi, Jason. Thanks for having me. I'm a senior contracts manager with the contracts team here at the Take Home Office of the Investor Minnesota. And my role entails walking on all sorts of agreements with a special focus on NDAs. So I'm happy to be here.

Jason Stockman 2:24

All right. So um, you know, how do I know if I'm uh, you know, even subject to an NDA in the first place? I think that's uh really a great place to spart and kind of start and lean into your guys' expertise.

Consolate Ndagire 2:39

Yeah, uh yeah, it's a vital starting point for sure. So you aren't legally bound by confidentiality just because a conversation feels private, there generally must be an agreement in place, um, either specific NLDA or a sponsored research agreement, which generally contains confidentiality provisions.

Jason Stockman 2:59

You know, since we know uh researchers should never sign these personally because the university is the legal party to protect them. You know, how does the average person in the lab know an agreement exists?

Bridget Foss 3:12

Uh it's a shared responsibility of notification. So usually a company is proactive and will state at the start of a meeting if the information is covered by an NDA or a sponsored research agreement. However, if you're a lead researcher, you have an obligation to notify the staff and students that are working on the project or anyone else that may receive that confidential information about the existence of the agreement and who it involves. For sponsored research agreements, a copy of the agreement is distributed to the PI and to the academic unit with the notice of grant award. So investigators should have a copy of the agreement on hand to share with their staff. Yeah.

Consolate Ndagire 3:56

Um, and in addition to what Bridget said, um, is the same with uh take-home. The lead researcher will receive a copy of the fully executed NBA and they're responsible for notifying the allowed members that this agreement is in place and ensuring everyone understands that they are bound by its confidentiality obligations.

Jason Stockman 4:16

Okay, so if this quote unquote legal fence is built and the team is notified, I guess the next big question for me is how do I know if something specific within that project is actually confidential?

Consolate Ndagire 4:31

Um the clearest case is when it's labeled. Um it's either marked with uh that it's confidential, it's proprietary, or it's a trade secret, but labels aren't always there.

Jason Stockman 4:43

So in those cases, what do you do if the label's not there?

Consolate Ndagire 4:47

Um, you apply a resort and bodies test. So would a reasonable person understand this information to be confidential given that, given what it is and how it's shared. Uh proprietary compounds and published trial data, sponsor business strategies and the like, those may be determined to be confidential whether or not someone remembered to stamp the document.

Jason Stockman 5:12

Okay, that makes sense. Um, does this also include verbal conversations? How does that work?

Consolate Ndagire 5:19

They definitely do. So if a sponsor shares something in a meeting or a site visit, it carries the same legal weight as a written disclosure. And most agreements require the disclosing party um to confirm verbal disclosures in writing within 15 to um 30 days. So it's important to check your specific agreement for the window.

Jason Stockman 5:42

Okay, so I guess in short, when in doubt, just treat it as confidential and check with the team.

Bridget Foss 5:49

Exactly. And it's worth noting that this isn't just about documents the sponsor sends to us. It can also cover the study data that we generate here at the university.

Jason Stockman 6:00

Is that even if we're the team producing it?

Bridget Foss 6:04

Yes. Um, in many clinical trial agreements, the raw data is classified as sponsor confidential. But there is an important nuance to that. It's usually confidential up until the point of formal publication.

Jason Stockman 6:18

Okay, so there's a specific window where we have to keep things kind of under wraps then.

Bridget Foss 6:24

Right. There's most, uh there's almost always a carve out that allows the PI to publish their findings, provided that they give the sponsor a chance to review the materials first. That review period is normally between 30 to 60 days.

Jason Stockman 6:40

So that actually benefits the PI too, then, right?

Consolate Ndagire 6:44

Absolutely. Um, PIs have a huge stake in keeping those results confidential until the paper is ready. Um, if the data leaks out prematurely, whether through a carrier conversation or an unsecure server, it can scoop the formal publication or disqualify the study from the top-tier journals that require results to be original and previously unpublished.

Jason Stockman 7:11

So I guess keeping the data secure isn't just a contract checkbox, then, right? It's really about protecting the PI's ability to get their work recognized and published.

Consolate Ndagire 7:22

Precisely. Um, whether it's to comply with the sponsors' rules or to protect your own academic career, the data has to remain protected by keeping it in those university airport systems until it's officially cleared for the public.

Bridget Foss 7:39

Exactly. Once you know something is confidential, your core obligations are straightforward. Store it securely, limit who can see it, use it only for the purposes in your agreement, and don't share it without authorization.

Jason Stockman 7:54

So you'll have to help me out here. Uh, what does secure storage look like in practice?

Consolate Ndagire 8:00

It's um university approved systems only. That means university managed Google Drive with appropriate shared settings, university servers, or a system that's also specifically approved. Personal laptops, personal cloud accounts like Dropbox or iCloud, USB drives, those are not approved locations.

Jason Stockman 8:22

So another question I have. Um, you know, I know researchers are constantly using AI tools now. How does uh how do AI tools unpack this?

Bridget Foss 8:32

So this is a big one. You should never upload confidential sponsor information or unreleased study data to public-facing AI platforms like ChatGPT or Claude. Those uh tools generally train on your data using uh, so that means you lose control of it the second that you hit enter.

Jason Stockman 8:53

Okay, that makes sense. Um, you know, I know the university has an enterprise version of Gemini that's private. Um, can we use that?

Bridget Foss 9:02

Um that's complicated. Uh while the university Gemini uh has strong data protections, uh, meaning that Google doesn't train on your inputs, that doesn't mean you're automatically cleared to use it for every project.

Jason Stockman 9:18

Um so if the system is secure though, what what's the risk in doing that?

Bridget Foss 9:24

The risk is really the contract itself. Many sponsors are now including specific clauses that strictly prohibit their confidential information from being entered into any generative AI tool, regardless of whether it's an enterprise version or not.

Jason Stockman 9:39

So it sounds like the contract overrules our internal tools then.

Bridget Foss 9:44

Exactly. Um there's a couple scenarios just to think through. You have a protocol from a sponsor, you want to paste the sponsor's protocol into Gemini to generate a checklist or a schedule for your staff. Um, another scenario might be that you are drafting a manuscript and you upload raw confidential study results to help draft the discussion section of your paper. Both of these scenarios could be prohibited by the terms of the sponsored research agreement.

Jason Stockman 10:13

Okay, so even if you're using a safe uh UMN tool, if the contract says no AI, those examples would be a breach?

Bridget Foss 10:22

Precisely. You'd be violating the specific terms of your agreement with the sponsor. This is why you really must check with SPA first before you use the AI on your sponsored um projects. They can look or we can look into this specific agreement to see if there's an AI restriction before you ever paste anything uh into the system.

Jason Stockman 10:44

Okay, and and for access, who should be able to see the material then?

Consolate Ndagire 10:49

Uh so confidential information or material needs to be shared on a need-to-know basis only. So only the people who genuinely need it for their specific role in the project uh should be able to view the material. And uh you should be able to maintain a simple access log when someone leaves their project or the university involve access and collect any physical material or copies they might have.

Jason Stockman 11:16

Okay. Well, thanks for all that information. Uh, I'd like to switch gears a little bit and talk about the agreements themselves because this seems to be one place where researchers can get into trouble.

Consolate Ndagire 11:30

Yeah, so the rule is simple: never sign an NBA personally. If a company sends you an agreement before an initial meeting, want it to start or take home immediately. Don't attend a meeting and don't accept any confidential information until a university executed agreement is in place.

Jason Stockman 11:48

Uh that's clear for a PDF sent via email, but but what about in the real world? You know, often when you visit a company site, uh you're asked to sign a kind of a click-through NDA just to get through the security gate. Um, if a university leader says it's okay to click accept because of you know the institutional agreement is already in place, um, is that safe?

Consolate Ndagire 12:12

That's a very common job. Um, if any a senior leader gives you the thumbs up, you should still be cautious. A click-through agreement is still a legal contract. If that digital form doesn't explicitly reference the existing NDA or the sponsored research agreement, you might accidentally be signing a new personal contract that overrides those institutional protections. That's why we encourage you to reach out to Aither Sparta Take Home ahead of time so that we can confirm if an NDA or SRA is in place. And if not, we would either review the external party's NDA or draft one.

Jason Stockman 12:49

So even if you have verbal assurance from a higher up or a vice president that rule doesn't change?

Bridget Foss 12:56

The rule is the same. Try to get a copy of the text beforehand. If if you're standing at a kiosk and have to sign to enter, uh take a photo of the terms and send them to SPA afterwards, uh, we can confirm that they align with the institutional agreement. Never assume a verbal it's okay from a colleague, no matter how senior, negates your need for a university vetted document.

Jason Stockman 13:21

That makes sense. I guess I'm curious though, why does it matter who signs?

Consolate Ndagire 13:27

Because when you sign in your personal capacity or individual capacity, you not the university become the party with legal obligations under that agreement. Basically, you are personally reliable if things go wrong. Uh power take home is the office with signing authority. That's not a technicality, that's the university protecting you.

Jason Stockman 13:48

What if someone says it's just routine though, and not really uh a formal, it's just kind of a formality forward it.

Consolate Ndagire 13:56

Routine is not a legal category, category. Um, SPA can review it quickly. Um, let us know the context and the deadline, and we can get that um reviewed through you, even if it is a tight deadline.

Jason Stockman 14:10

Okay. You know, one of the most common sources of unintentional disclosure is researchers preparing, you know, papers or conference presentations without checking for confidential sponsor information. Is that something you see?

Bridget Foss 14:25

Yes. Uh people often forget that a conference abstract submitted months before the event is a public communication.

Jason Stockman 14:34

Hmm. So even abstracts, huh?

Bridget Foss 14:38

Especially abstracts. Um, just to restate it, a conference abstract submitted months before the event is a public communication.

Jason Stockman 14:47

What about a full manuscript? If I submit a paper for peer review, that's a confidential process. The reviewers can't go sharing my work. Does that mean I can include sponsor data there?

Bridget Foss 15:00

No, and that's a critical distinction. Even though peer review is a private process, you are still disclosing information to a third party, in this case the journal or the reviewers. Uh if that information is protected by an NDA or a research agreement, you're likely in breach of your contract the moment that you hit submit, regardless of whether the public ever sees it.

Jason Stockman 15:23

So the issue isn't just the final publication, then it's the act of sharing it with the journal in the first place.

Bridget Foss 15:30

Exactly. Uh most sponsored research agreements include a publication review clause that gives the sponsor 30 to 60 days to review manuscripts and um presentations as well before you submit. You have to build that window into your project calendar from the start.

Jason Stockman 15:49

And even if the sponsor reads the draft and asks you to delete something before you send it to the journal?

Bridget Foss 15:55

Yep. In that case, talk to SPA. Some requests are valid to protect sponsor trade secrets, but others might go beyond what the agreement actually authorizes. SPA can help you navigate that balance between your academic freedom and the sponsor's rights.

Jason Stockman 16:11

Okay, so I guess that handles the sponsor's data. Uh, but what about you know the researchers' own results? If that manuscript contains findings that are patentable, does sharing them create a different problem for us?

Consolate Ndagire 16:26

It definitely can. Um, publicly sharing your results before a patent application is filed can impact the value and reach of that patent. That's just a very topic we're going to get into another podcast with a guest from Take Home. But that pre-submission review window is a great time to make sure those protections are in place.

Jason Stockman 16:47

Okay, well, this has all been really helpful, um, really, to see how both SPA and TechCom, your two offices, work together. One ensuring compliance with our contractual commitments, and the other protecting the value of the discovery itself. So TechCom helps protect the university's discoveries, and SPA ensures that we protect the sponsor's contract. It sounds like a solid plan A for handling data correctly, but you know, let's be real. Even with the best intentions, we know mistakes can happen. What if there's been an accidental disclosure of the sponsor's confidential information?

Consolate Ndagire 17:22

And that test you have to report it to SPA or the Office of General Counsel immediately. Uh, don't try to resolve it on your own. Uh document exactly what happened, what specific sponsor data was disclosed, who saw it, and when and preserve every record related to that sleep up.

Jason Stockman 17:41

Okay, um, I I think I know the answer to this, but why is the speed of reporting so critical when the sponsor's data is at stake?

Bridget Foss 17:51

Many agreements require that the university notify the sponsor within a very short window after a disclosure, sometimes as little as five to ten business days. So early reporting gives the university a chance to maintain the relationship or to well, maintain and manage the relationship and mitigate the damage. Self-reporting is a massive sign of good faith to our industry partners. So get that good get in touch with Spa right away.

Jason Stockman 18:18

Sounds good. Um so what about when the study ends? Um, is that kind of the finish line for these rules?

Consolate Ndagire 18:26

Uh not at all. That's a common misconception. Speaking of timelines, Brigitte made a great point that these obligations don't just punish when the study is over.

Jason Stockman 18:35

So you're saying they kind of stick around for a period of time?

Bridget Foss 18:39

They do. Uh most agreements have what we call a survival clause. The confidentiality obligations generally extend five to ten years beyond the end of the study.

Jason Stockman 18:51

So even if the lab has moved on inevitably to another new project, that data, that old data is still protected?

Bridget Foss 18:58

Precisely. You have to maintain the security and silence until the contractually defined period expires. It's if something goes wrong and there's a leak, even years later, um, you should report that to SPA right away.

Jason Stockman 19:12

And when in doubt?

Bridget Foss 19:14

Assume it's confidential. Keep it secure and call SPA.

Jason Stockman 19:18

Okay. Okay. Um what are the things to carry out of this conversation in your mind?

Consolate Ndagire 19:27

So a few things. If you're not sure whether something is confidential, treat it as though it is. Store materials on the university approach systems. Never sign an agreement personally, rotate to SPAR or take home. Check your agreement for publication review clause before you submit anything publicly. And if something goes wrong, report it right away.

Jason Stockman 19:51

And when in doubt.

Bridget Foss 19:54

Contact SPA. We're the first point of contact for questions about NDAs, sponsor research agreements, clinical trial agreements, third-party sharing, and accidental disclosures. That's what we're here for.

Jason Stockman 20:07

Bridget, Consulate, I can't thank you enough for joining us today. This was incredibly helpful and useful information. Um, and again, I think it's just a small token uh for us to be able to provide this information to our researchers just so we can you know really remember the most qu most important question of all here is is this information ours to share? Um we really ask all of you to pause on that question before you hit send on your next email. So again, thanks everyone for joining us today on Demystifying University and Industry Research Partnerships. Uh, we really hope you found this information really helpful. Um you're listening to Bridging the Gap, where we help build the bridge one partnership at a time.