Visitor NDA in India: are click-through and e-signed NDAs enforceable? (2026)

Is a visitor NDA enforceable in India?

Section 2(h) of the Indian Contract Act 1872 says “An agreement enforceable by law is a contract”, and section 10 makes an agreement a contract if it is “made by the free consent of parties competent to contract”, for a lawful consideration and object. A reception NDA usually meets this:

• Competent party: an adult of sound mind (section 11); minors are covered below.
• Free consent: the visitor knows what they agree to, so show plain-language text before the visit where you can.
• Consideration: in our reading, permission to enter and the information shared.
• Lawful object: protecting non-public information.

What you can and cannot enforce:

• Confidentiality: enforceable. A promise not to disclose or misuse what the visitor saw.
• Non-compete: void. Section 27 voids “every agreement by which any one is restrained from exercising a lawful profession, trade or business of any kind”, with one exception for the sale of goodwill. In Varun Tyagi v Daffodil Software (2025:DHC:5015), an employment case, the Delhi High Court held a post-employment bar on working elsewhere void, and said such covenants can be enforced only to protect confidential and proprietary information or to prevent solicitation (JSA).

If the visitor breaks it, section 73 gives compensation for loss caused by the breach. If you name a sum, section 74 treats it as a ceiling: the court awards reasonable compensation not exceeding that amount. Courts can also restrain a breach by injunction (Specific Relief Act 1963, sections 38 and 42). A claim for compensation must be brought within three years of the breach (Limitation Act 1963, Article 55).

Click-through, drawn or e-signed: which signature does a visitor NDA need?

The Contract Act does not require an NDA to be signed at all. Section 10A of the IT Act says that where proposals and acceptances are expressed electronically, “such contract shall not be deemed to be unenforceable solely on the ground that such electronic form or means was used”. In Trimex International v Vedanta Aluminium (22 January 2010), the Supreme Court held that a concluded contract could be inferred from an exchange of emails although no formal agreement was signed (S.S. Rana & Co.).

The phrase “electronic signature” is narrower. Section 2(1)(ta) defines it as authentication by a technique “specified in the Second Schedule”, including a digital signature, and section 3A sets reliability tests: the signing data is linked to the signatory and no one else, under their control when signing, and any later change to the signature or the document is detectable. Section 5 makes such a signature, affixed in the prescribed manner, satisfy any law that requires a signature.

So an “I agree” tick, a typed name or a finger-drawn signature can form a valid contract, but none of them is, by itself, an electronic signature as the Act defines it. Lakshmikumaran & Sridharan note that click-wrap agreements “are not given equal status with electronic signatures under the IT Act”, and King Stubb & Kasiva note that unconscionable terms in mass-market click-wrap contracts risk being unenforceable. The IT Act’s First Schedule excludes negotiable instruments other than cheques, powers of attorney, trusts, wills and immovable property sales; NDAs are not on it.

How do you prove a visitor agreed? Evidence under the Bharatiya Sakshya Adhiniyam

The Bharatiya Sakshya Adhiniyam 2023 (BSA) replaced the Indian Evidence Act. Section 63 treats computer output as a document if the device was used regularly and working properly, and section 63(4) requires a certificate, in the form set out in the Schedule, each time the record is tendered. Part A is completed by the party producing the record and Part B by an expert, and both give the record’s hash value. On 22 May 2026 a three-judge bench of the Supreme Court rejected a challenge to section 63(4) and the Schedule in Pune Bar Association v Union of India, saying a hash value “is synonymous with an electronic fingerprint”; it kept open the scope of expert certification under Part B (SCC Times; JSA).

Presumptions need an electronic signature under the IT Act. Section 85 presumes an electronic agreement bearing the parties’ electronic signatures was concluded by affixing them; section 86 presumes a secure electronic record is unaltered and a secure electronic signature was affixed with intent to sign. Without a secure electronic signature, section 66 requires you to prove the signature is the visitor’s. A click-through carries no electronic signature, so you prove assent like any other fact, from your audit trail.

A record that stands up should capture:

• Which text: the exact NDA version, with its hash.
• Who: name, organisation, host, and a mobile number confirmed by a one-time code.
• What they did: the unticked box they ticked and the button wording.
• When and where: a server timestamp in IST, the site, and the device or browser.
• A copy: sent to the visitor’s phone or email at once.
• Integrity: stored so it cannot be edited, with every view logged.
• Who signs the certificate: a named role who can complete Part A, and a vendor contract that obliges your provider to export the record and its hash.

Stamp duty on a visitor NDA: does it apply, and how much?

Stamp duty is set by each state. Maharashtra’s definition of “instrument” covers electronic records (section 2(l)), so an e-signed or click-through NDA can be chargeable.

• Rate. Article 5(h)(B) of Schedule I charges agreements “if not otherwise provided for”. An ordinance of 14 October 2024 raised it from ₹100 to ₹500, the rate Khaitan & Co. gives in July 2026. In John Cockerill India v Sanjay Kamalakar Navare (2023), the Bombay High Court placed an employee non-disclosure agreement under 5(h)(B) (SCC Times).
• A trap. Article 5(h)(A)(iv) charges duty as a percentage of value on agreements that create an obligation, right or interest with a monetary value. If your NDA names a large liquidated-damages figure, ask counsel whether that gives it a monetary value.
• Unstamped is not void. On 13 December 2023 a seven-judge bench of the Supreme Court (In re Interplay between Arbitration Agreements and the Indian Stamp Act, overruling N.N. Global) held that unstamped agreements are inadmissible in evidence but “not rendered void or void ab initio or unenforceable”, and that the defect is curable. Under section 34 of the Maharashtra Act, an unstamped instrument can be admitted on paying the shortfall plus a penalty of 2% of it for every month or part of a month, capped at four times the shortfall.
• Other states. Rates, articles and penalties differ, so check the Act of the state where the NDA is signed.

Who should sign a visitor NDA, and who should not?

ISO/IEC 27001:2022 Annex A 6.6, “Confidentiality or non-disclosure agreements”, asks organisations to identify where confidentiality agreements are needed, document them and review them regularly (TCSA). Applied to a lobby:

Minors at reception: a child cannot sign a visitor NDA

Section 11 of the Contract Act makes competence depend on the age of majority, and in Mohori Bibee v Dharmodas Ghose (1903) the Privy Council held an agreement with a minor void from the start. A 16-year-old intern cannot be bound by your NDA, however it is signed.

Separately, the DPDP Act treats anyone under 18 as a child (section 2(f)). Section 9(1) requires verifiable consent of the parent or lawful guardian before processing a child’s personal data, and Rule 10 requires due diligence that the person giving it is an identifiable adult.

• Keep children out of confidential areas and escort them throughout.
• Ask the parent or guardian to sign a short undertaking. It binds the adult only.
• Get consent for the child’s check-in data from a parent or lawful guardian, after the Rule 10 check.

Contractors: one NDA with the firm, one acknowledgement at the gate

Scenario: 7:30 am, a data centre in Hyderabad. Fourteen AMC technicians arrive for a chiller overhaul. Their employer signed a master NDA last month; each technician accepted a short acknowledgement and the induction on their phone the evening before.

• Firm level. The firm signs the master NDA with a Second Schedule electronic signature, promises its workers are bound by equivalent terms, and is liable for their breaches. Stamp it.
• Worker level. Each worker accepts a short acknowledgement before first entry, linked to the induction record and the pass.
• No restraints. Do not ask workers to promise not to work for your competitors (section 27).

See also contractor management under the OSH Code and visitor management for factories.

The visitor NDA and the DPDP Act: keep them separate

The NDA flow collects personal data, so the DPDP Act applies. Most duties apply from 13 May 2027 (Rule 1(4)); some firms, including Cyril Amarchand Mangaldas, give 14 May 2027. A proposal to shorten the timeline (Business Standard, January 2026) had not been notified as of 12 October 2026 (S.S. Rana & Co.).

• Notice first. Section 5(1) requires a notice before or with any request for consent, and section 5(3) gives the visitor the option of English or any Eighth Schedule language. Rule 3(a) requires the notice to be “understandable independently of any other information”, so do not bury it in the NDA.
• No bundled consent. Section 6(1) requires consent that is “free, specific, informed, unconditional and unambiguous”, and section 6(2) makes any part that infringes the Act invalid. A clause in which the visitor “consents to all processing” is unlikely to count as valid consent.
• Separate retention clocks. Rule 8(3) requires personal data, traffic data and processing logs to be kept for at least one year for the purposes in the Seventh Schedule; Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as binding every data fiduciary. The signed NDA has a different purpose: you may need it until claims are time-barred.

Visitor NDA template (India)

A one-way confidentiality undertaking for a reception or pre-arrival flow. Its structure is adapted from General Legal’s public domain (CC0) one-way NDA and rewritten for Indian law. Replace placeholders in [brackets] and have counsel review it before use.

1. Who this is between. [Company name], [registered address] (“we”), and the visitor named below (“you”), visiting on behalf of [visitor’s organisation, or “yourself”].
2. Purpose. You are visiting [site] on [date] to [purpose of visit]. This undertaking also covers follow-up visits for the same purpose within [30] days.
3. Confidential information. Anything not public that you see, hear or receive during the visit: products, designs, screens, whiteboards, documents, conversations, secure areas, security arrangements and personal data of our staff and customers.
4. What you agree to do. Use confidential information only for the purpose; not disclose it to anyone outside your organisation who does not need it for the purpose; take no photographs, video or recordings without your host’s written permission; make no copies; not enter it into any public or third-party AI tool; and tell your host at once if you think it has been disclosed.
5. What is not confidential. Information that is or becomes public through no fault of yours, that you already had without a duty of confidence, that you receive lawfully from someone else, or that you develop independently.
6. Disclosure required by law. You may disclose what a law, court or regulator requires; where lawful, tell us first and disclose only what is required. Nothing here stops you reporting a possible offence or wrongdoing to the police, a regulator or a court.
7. Returning material. Return or delete any material we gave you when the visit ends or when we ask.
8. How long it lasts. [Three] years from your last visit under this undertaking, and for trade secrets as long as they remain secret.
9. No other restriction. This undertaking does not stop you working for anyone or carrying on any trade or business.
10. Your organisation’s NDA. If [visitor’s organisation] has signed an NDA with us, both apply; if they conflict, that agreement prevails.
11. If this is breached. We may claim compensation and ask a court to restrain the breach.
12. Your personal data. We handle your personal data as described in our separate visitor privacy notice. Nothing here limits your rights under the Digital Personal Data Protection Act 2023.
13. Law and courts. The laws of India apply, and the courts at [city] have jurisdiction.
14. How you accept. You accept by ticking the box and tapping [I agree], or by signing below. We accept by admitting you. A copy is sent to your phone or email.

Visitor NDA rollout checklist

1. List the visitor types who will see non-public information (Annex A 6.6).
2. Limit the NDA to confidentiality: no non-compete, no data processing consent.
3. Show the privacy notice separately, before the first question.
4. Send the NDA before arrival so it is read at home.
5. Record version and hash, identity, action, timestamp and copy for every acceptance.
6. Name who completes Part A of a section 63 certificate; make your vendor contract cover exports.
7. Decide stamp duty with counsel and record the advice; stamp master NDAs with contractor firms.
8. Exclude children; use escorts and a parent’s or guardian’s undertaking.
9. Set three retention clocks: photos and mobile numbers, visit records, signed NDAs.

Where Orb fits

Orb, our visitor management system, puts the NDA in the right place in the visit.

Questions buyers ask