Is an NDA part of an MSA?

It can be, but it does not have to be. Many master service agreements include a confidentiality section that functions like a built-in NDA, which removes the need for a separate document. Other companies sign a standalone NDA first, often before the MSA exists, so they can share information during early talks. If your MSA already has strong confidentiality language, a separate NDA is usually redundant for that relationship.

Which do I sign first, an MSA or an NDA?

Almost always the NDA. It protects information during the conversation that decides whether a deal happens at all, so it needs to be in place before you trade pricing, roadmaps, or customer data. The MSA comes later, once both sides agree to work together and need to set the legal terms of that work.

Can one document do the job of both?

Yes. A well-drafted MSA with a thorough confidentiality clause covers most of what a mutual NDA would, because the working relationship is the context the confidential information lives in. The main reason to keep them separate is timing: you often need confidentiality protection weeks or months before anyone is ready to sign a full services agreement.

Do I need an NDA if I already have a contract?

If the contract already includes a confidentiality clause that covers your sensitive information for a long enough period, a separate NDA adds little. If the contract is silent on confidentiality, or only protects information disclosed after signing, a standalone NDA fills the gap for anything shared earlier or outside the contract scope.

What happens if there is a conflict between an MSA and an NDA?

Whichever document is signed later usually controls, unless one explicitly says it governs. To avoid the fight entirely, add a clause stating which agreement takes priority on confidentiality. A common approach is to have the MSA supersede the earlier NDA once it is signed, so the two do not contradict each other on term length or permitted disclosures.

MSA vs. NDA: What's the Difference?

A master service agreement governs the work; an NDA protects information. Learn what each covers, when to use them, and how they fit together.

People mix up the master service agreement (MSA) and the non-disclosure agreement (NDA) constantly, usually because both show up at the start of a new business relationship and both arrive as a PDF you are asked to sign. They are not interchangeable. One governs the work; the other protects information. Sign the wrong one at the wrong time and you either share secrets with no protection or commit to a project with no rules.

This guide breaks down what each contract actually does, where they overlap, which to sign first, and how to decide whether you need one, the other, or both.

The short answer

An NDA is a confidentiality contract. It keeps information private. It says: if I show you something sensitive, you cannot use it or pass it along.

An MSA is a relationship contract. It sets the ground rules for ongoing work between two companies, covering payment, liability, ownership, and dispute handling, so that each new project runs off a single set of agreed terms instead of a fresh negotiation every time.

The NDA answers can I trust you with what I tell you? The MSA answers how are we going to work together? Those are different questions, which is why a lot of relationships end up needing both.

What an NDA does

A non-disclosure agreement creates a legal duty to keep certain information confidential. The party sharing the information is the disclosing party; the party receiving it is the receiving party. An NDA can run one direction (a unilateral NDA, where only one side shares) or both (a mutual NDA, where each side protects the other).

A typical NDA covers:

A definition of confidential information: what counts as protected, and what is carved out (anything already public, independently developed, or received lawfully from a third party)
Obligations of the receiving party: not to use or disclose the information outside the stated purpose
A term: how long the duty lasts, often two to five years
Permitted disclosures: carve-outs for court orders and legal requirements
Remedies: what happens on a breach, usually including the right to an injunction

NDAs are cheap, fast, and narrow. They do one thing well: they protect information during a window when you have to share it but have not yet committed to anything. For a deeper walkthrough of the clauses, see our NDA contract template guide.

What an NDA does not do: it says nothing about who gets paid, who owns the work product, who is liable if something goes wrong, or how a dispute gets resolved. An NDA protects the conversation, not the project.

What an MSA does

A master service agreement is the umbrella contract for an ongoing working relationship. Instead of writing a full contract for every project, two companies negotiate the legal terms once in the MSA, then attach a short statement of work (SOW) for each individual engagement. The SOW handles the specifics like deliverables, timeline, and price, while the MSA handles everything that stays constant.

A standard MSA covers:

Scope and structure: how work gets ordered, usually through SOWs that reference the MSA
Payment terms: rates, invoicing schedule, late fees, expenses
Intellectual property: who owns the work product and any pre-existing materials
Confidentiality: yes, MSAs almost always include their own confidentiality section
Liability and indemnification: caps on damages and who covers third-party claims
Warranties: what each side promises about the quality of the work
Term and termination: how long the relationship runs and how either side exits
Dispute resolution and governing law: arbitration or court, and which state's law applies

The point of an MSA is efficiency. Once it exists, starting a new project is a one-page SOW instead of a multi-week contract negotiation. For the full structure, see our master service agreement template guide.

Where they overlap: confidentiality

Here is the part that causes most of the confusion. An MSA almost always contains a confidentiality clause, a section that does roughly what a mutual NDA does. So if you sign an MSA with solid confidentiality language, you may not need a separate NDA for that relationship at all.

That clause typically defines confidential information, sets obligations to protect it, lists exclusions, and gives it a survival period after the contract ends. In practice, the confidentiality section of a well-drafted MSA is a built-in NDA.

So why do separate NDAs still exist? Timing. You usually need confidentiality protection long before an MSA is ready. Picture a vendor pitching an enterprise buyer: the buyer wants to see the product roadmap, the vendor wants to see internal requirements, and both are exchanged in the first call, weeks before anyone drafts an MSA. The NDA covers that gap. By the time the MSA is signed, its confidentiality clause takes over.

Is the confidentiality in an MSA as good as a standalone NDA?

Usually, but not always, and the difference is worth checking before you skip the separate NDA. A standalone NDA exists for one purpose, so its drafting tends to be thorough: a careful definition of confidential information, a clear list of exclusions, a survival period that outlasts the relationship, and remedies written for a confidentiality breach specifically.

The confidentiality section buried inside an MSA is sometimes an afterthought. It might define confidential information narrowly, tie protection only to information "disclosed under this Agreement" (which leaves out anything you shared before signing), or set a survival period of a year or two that ends well before your trade secrets stop being valuable. None of that shows up until you actually read the clause.

Three things to check in any MSA confidentiality section:

The reach back in time. Does it cover information shared during the pitch and negotiation, or only after the MSA was signed? If it is the latter, your earlier disclosures are unprotected unless an NDA covered them.
The survival period. Confidentiality should outlive the contract. A clause that expires the day the MSA terminates protects nothing once the relationship ends, which is exactly when leaks tend to happen.
The definition and carve-outs. A definition that is too narrow protects little; one with no exclusions for public or independently developed information is hard to enforce. The same rules that govern a good NDA apply here.

If the MSA clause is strong on all three, a separate NDA is redundant. If it is weak on any of them, keep the NDA in force and add language clarifying that the stronger terms control.

Which comes first?

In most deals, the order is:

NDA: signed early, often before serious talks begin, so both sides can share sensitive information while they figure out whether a deal makes sense
MSA: signed once both sides decide to work together, setting the terms of the relationship
SOW: attached to the MSA for each project, with deliverables and pricing

The NDA is the gatekeeper for the conversation, and the MSA is the framework for the work that follows. Skipping the NDA means you share secrets unprotected; skipping the MSA means you negotiate every project from scratch.

Do you need one, the other, or both?

Use this to decide.

You need an NDA on its own when:

You are in early talks and need to share information before any deal is certain
The relationship is a one-time exchange of information with no ongoing work (an investor pitch, a due-diligence review)
You want protection in place fast and a full services agreement is weeks away

You need an MSA on its own when:

You have committed to ongoing work and the MSA's confidentiality clause already covers your sensitive information
The relationship is purely about delivering services and there was no sensitive pre-deal disclosure

You need both when:

You shared confidential information early (under an NDA) and the relationship matured into ongoing work (under an MSA)
Your industry routinely separates the two, which is common in software, consulting, and manufacturing

For most B2B relationships that start with a pitch and grow into recurring work, the answer is both: an NDA up front, an MSA once the relationship is real.

Common mistakes

Treating an NDA as a full contract. An NDA protects information and nothing else. If you start a project under an NDA alone, you have no agreement on payment, ownership, or liability. When a dispute hits, there is nothing to point to.

Signing an MSA without reading the confidentiality clause. Because the MSA usually contains its own confidentiality terms, that section can quietly weaken protection you thought your NDA gave you, whether through a shorter survival period or a narrower definition. Read it.

Letting the NDA and MSA contradict each other. If your NDA says confidentiality lasts five years and the later MSA says two, you have a conflict. Add a clause stating which document controls, so a court does not have to guess.

Using a perpetual NDA for routine information. Courts increasingly reject indefinite confidentiality obligations for ordinary business data. Match the term to the sensitivity of the information.

Forgetting the mutual-versus-one-way distinction. A one-way NDA only protects the disclosing party. If both sides are sharing, which is normal once an MSA is in play, you want a mutual NDA. The difference matters enough that we cover the NDA vs. mutual NDA distinction in its own guide.

How the two fit together: a walkthrough

Say a software agency is courting a fintech client.

Step 1, the NDA. Before the first deep-dive call, both sign a mutual NDA. The fintech shares its product roadmap; the agency shares its architecture approach. Neither can use or leak the other's information.

Step 2, the MSA. Talks go well. They sign a master service agreement covering payment terms, IP ownership of the code, liability caps, and a confidentiality clause that supersedes the earlier NDA once active.

Step 3, the SOW. They attach a statement of work for the first project: a payments dashboard, eight-week timeline, fixed fee. When a second project comes up later, they write a new SOW under the same MSA, with no renegotiation.

Step 4, service levels (optional). If the work includes ongoing support, they may add a service level agreement defining uptime and response times.

Each document has a job. The NDA protected the courtship, the MSA framed the relationship, the SOW scoped the work, and the SLA set the support standard. None of them duplicates another.

Quick reference

NDA: protects information; signed first; narrow and fast
MSA: governs ongoing work; signed once both commit; broad
SOW: scopes each project; attached to the MSA
The MSA usually contains its own confidentiality clause, which can replace a separate NDA once signed
Most maturing B2B relationships use both: NDA early, MSA when the work begins

Related guides

Generate Your MSA or NDA with Contractable

Knowing which contract you need is half the work; getting the clauses right is the other half. Contractable generates customized master service agreements and NDAs in seconds, with the right confidentiality terms, ownership language, and term lengths for your situation. Start with an NDA for early talks, then build the MSA when the relationship is ready. No lawyers or legal background required.