A non-disclosure agreement binds only those who entered into it; the recipient's adviser or subcontractor is not bound by it. A recipient who passes the information to someone outside the permitted circle breaches the NDA themselves. Where the recipient performs their obligations through another person, they are liable under Section 331 of the Commercial Code as if performing themselves; that rule will not, however, apply reliably to every type of adviser. The NDA should therefore deal expressly with the circle of third parties, how they are bound and the recipient's liability for them.
Before investing in a company, an investor needs its tax adviser and lawyer to see the figures. A software supplier wants to place part of the development with an external programmer. Both situations are ordinary and both mean that your confidential information reaches people with whom you have signed nothing. The question of who is liable for them is best resolved before the NDA is signed, not after a leak.
A third party is not bound by your NDA
A contract binds its parties. The recipient’s adviser or subcontractor therefore owes you nothing under the NDA itself, and you will not recover a contractual penalty from them. Your claim lies against the recipient, who breaches the NDA simply by passing the information to someone to whom the agreement did not allow it to be passed.
The harder situation is where the recipient was permitted to show the information to an adviser and the leak was caused by the adviser. The Commercial Code (Act No. 513/1991 Zb.) contains a general rule on performance through another person:
If a debtor performs their obligation with the assistance of another person, they are liable as if they had performed the obligation themselves, unless this Act provides otherwise.
— Section 331 of the Commercial Code (unofficial English translation)
With a subcontractor performing part of the agreed work for the recipient, this rule applies directly. With an adviser engaged by the recipient for the recipient’s own decision-making, whether this amounts to performing an obligation with the assistance of another person is a matter of interpretation. Czech law knows a comparable rule (Section 1935 of Act No. 89/2012 Sb.), so the question of whom it catches arises for NDAs governed by Czech law too. The reliable solution is contractual: the NDA should state expressly that the recipient is liable for breaches of confidentiality by the persons to whom they disclosed the information in the same way as for their own.
When a leak goes beyond the agreement
If the information meets the requirements of a trade secret under Section 17(1) of the Commercial Code, you have statutory protection alongside the contract. The statute expressly treats use or disclosure of a secret by a person acting in breach of a confidentiality agreement as unlawful (Section 51(3)(b)), and extends its reach to the next link in the chain as well:
Unlawful acquisition, use or disclosure of a trade secret also means the conduct of a person who, at the time of the acquisition, use or disclosure of the trade secret, knew or ought in the circumstances to have known that the trade secret was obtained directly or indirectly from a person who was unlawfully using or unlawfully disclosing the trade secret under subsection 3.
— Section 51(4) of the Commercial Code (unofficial English translation)
The owner is entitled to legal protection against infringement of the right to a trade secret (Section 20), and the statute classes such infringement among the forms of unfair competition (Section 44(2)(g)). That opens up claims for the infringer to refrain from the conduct and to remedy the unlawful state, as well as reasonable satisfaction, compensation for damage and surrender of unjust enrichment (Section 53). You must, however, prove that the information was a trade secret and that the third party knew or ought to have known where it came from. Both are easier to prove where the documents and the NDA clearly mark what is confidential.
What the NDA should say about third parties
- The circle of persons: only those who need the information for the agreed purpose may receive it, for instance named advisers or categories of employees.
- Binding them: before disclosure, the recipient binds them to confidentiality at least to the extent to which the recipient is bound; for advisers with their own statutory duty of confidentiality this needs to be taken into account.
- Consent: for subcontractors and other external persons you may require your prior written consent.
- Liability: the recipient is liable for their breaches as for its own, and the contractual penalty covers those cases too.
- Notification and return: the recipient informs you of a leak without delay, and the duty to return or destroy materials extends to copies held by third parties.
We prepare such a clause to measure through our non-disclosure agreement service. If the information has already reached a third party, we help you with your claims through unfair competition and reputation protection. The form of consent to an NDA is addressed in our answer Is a non-disclosure agreement confirmed by email or by a click enough?
This answer provides general information on the law as at 12 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
