The RAK ICC Confidentiality Undertaking Explained

What is the RAK ICC Confidentiality Undertaking?

The RAK ICC Confidentiality Undertaking is a legally binding non-disclosure agreement in which one party — the "Recipient" — commits to protect the confidential information that RAK ICC discloses to it during their business relationship. It is signed when RAK ICC needs to share sensitive information — systems, processes, client data, commercial arrangements — and wants a documented promise that the recipient will keep it confidential, use it only for the agreed purpose, and hand it back or destroy it when asked. If you have been asked to sign one, you are taking on a serious and long-lasting confidentiality obligation, and it is worth understanding exactly what it commits you to before you sign. Fastlane advises on documents like this as part of our UAE corporate and company services.

The document has a clear architecture. It opens with a recital explaining why it exists — RAK ICC will disclose confidential information to further the business relationship — and then sets out a series of numbered obligations. It defines what counts as "Confidential Information" in very wide terms, states that the duty of confidentiality is indefinite, carves out a short list of exceptions, and specifies what the Recipient must do if compelled to disclose. It then details the core protective obligations, the return-and-destroy mechanism, the consequences of breach, and finally the governing law and the courts that will hear any dispute. Every clause pulls in the same direction: protecting RAK ICC's information.

It is important to be clear about what this document is and is not. It is a confidentiality undertaking, not a services contract — it governs how you treat information, not what work you do. The actual scope of your permitted use is tied to a separate "Engagement Letter" referenced in the undertaking, so the two documents work together: the engagement letter defines the purpose, and the undertaking restricts you to using the confidential information only for that purpose. Understanding that link matters, because using RAK ICC's information for anything beyond the engagement's purpose is a breach even if you never disclose it to anyone else.

Is the undertaking one-way or mutual, and who signs it?

It is a one-way (unilateral) undertaking: RAK ICC is the disclosing party, and the Recipient is the receiving party who takes on all the confidentiality obligations. The obligations run in a single direction — the Recipient protects RAK ICC's information, but there is no reciprocal duty on RAK ICC to protect the Recipient's. It is signed by the Recipient, through a named individual, in favour of RAK ICC and its related entities.

This one-directional structure is worth pausing on, because it materially affects what you are agreeing to. In a mutual non-disclosure agreement, both parties disclose and both parties protect, so the obligations are balanced. In this unilateral undertaking, only RAK ICC's information is protected. If, in the course of the relationship, you share your own confidential information with RAK ICC, this document does not oblige RAK ICC to keep it secret. That is a normal and legitimate structure — it simply reflects that here RAK ICC is the one doing the disclosing — but you should be conscious that the protection flows one way.

The "Recipient" is defined as a party with an address in the UAE, and the undertaking extends to that party's "Representatives" — a term defined to include any director, officer, employee, advisor, consultant, agent or other representative. That definition matters enormously in practice, because it means your obligations do not stop with you: they reach everyone in your organisation and every adviser or contractor to whom you pass the information. You are, in effect, responsible for the confidentiality behaviour of your whole team and your advisers, which is why the undertaking imposes specific controls on how you may share the information internally.

What counts as “Confidential Information” under the undertaking?

Almost everything RAK ICC gives you. The definition of "Confidential Information" is drawn extremely widely: it covers any and all information, data or records of RAK ICC and its affiliates, in any form whatsoever — print, writing, oral, visual, electronic, or any other medium — and it applies whether or not the information is marked or designated as confidential. It even extends to information that, under the circumstances of disclosure, ought to be treated as confidential. In short, you cannot assume something is outside the definition simply because it was not stamped "confidential".

Two features of the definition deserve particular attention. First, it captures derived material — not just the information RAK ICC hands you, but any notes, analyses or documents you prepare that contain or are based upon that information. So a summary you write, a spreadsheet you build, or a memo analysing RAK ICC's data is itself Confidential Information subject to the same obligations. You cannot strip the protection off by re-expressing the information in your own words.

Second, the definition reaches information obtainable by examining, testing or analysing any hardware, component, software or material sample that RAK ICC provides or gives you access to. In other words, reverse-engineering is anticipated and covered: what you could learn by taking something apart is as confidential as what you were told directly. The breadth here is deliberate and typical of a well-drafted confidentiality undertaking — the drafting intent is to leave as little as possible outside the net, so the safe working assumption is that everything connected to RAK ICC's disclosure is confidential unless it clearly falls within one of the specific exceptions.

How long does the confidentiality obligation last?

Indefinitely. The undertaking states expressly that the obligation to maintain the confidentiality of Confidential Information continues to apply for an indefinite term — there is no fixed end date and no automatic expiry after a set number of years. Unless information falls within one of the specific exceptions, your duty to keep it confidential does not lapse when the engagement ends, when the relationship concludes, or after any period of time.

This is a significant and often-overlooked feature. Many commercial non-disclosure agreements run for a defined term — three years, five years, sometimes longer — after which the confidentiality obligation falls away. This undertaking does not work that way. The obligation persists for as long as the information remains confidential, which for genuine trade secrets and sensitive commercial data can be effectively forever. Signing it is therefore a long-term commitment, and one that survives the end of whatever project or engagement prompted it.

The practical implication is that your systems and habits for handling RAK ICC's information need to be durable, not just adequate for the life of a single project. Information you receive today may still be subject to confidentiality obligations years after you have finished working with RAK ICC, so your record-keeping, your access controls, and your eventual return-or-destruction of the material all need to account for an obligation that does not switch itself off. This is one of several reasons it pays to have proper document-management discipline in place, which our corporate record-keeping and administration support can help maintain.

What are the exceptions to the confidentiality obligation?

There are five, and they are narrow. The indefinite confidentiality duty does not apply to information that is: generally available to third parties (unless it became so through a breach of this undertaking); lawfully in your possession beforehand and not acquired from RAK ICC (as shown by your written records); required to be disclosed by law or a regulator; already known to you before RAK ICC provided it, or independently developed by you without reference to the confidential information; or disclosed with RAK ICC's prior written consent.

Notice how each exception is hedged. The public-availability exception does not apply if the information reached the public domain because of a breach — you cannot leak information and then claim it is now public. The prior-possession and prior-knowledge exceptions depend on your being able to prove, from written records, that you genuinely held or knew the information beforehand and did not get it from RAK ICC — which is why contemporaneous documentation matters so much. And "independently developed without reference to the Confidential Information" is a demanding standard: it is not enough that you could have developed it independently; you must actually have done so without drawing on what RAK ICC disclosed.

The consent exception is the cleanest route where you genuinely need to disclose or use information beyond the undertaking's limits: obtain RAK ICC's prior written consent. That converts a would-be breach into a permitted act. The lesson across all five exceptions is that they are real but tightly drawn, and none of them should be relied on casually — if you think an exception applies, make sure you can evidence it, and where there is any doubt, seek written consent rather than assuming.

What must you do if you are legally compelled to disclose?

Follow a specific notice-and-minimise procedure. If proceedings are commenced or action taken that could compel you to disclose Confidential Information, the undertaking requires you — to the extent you are lawfully able — to immediately notify RAK ICC in writing, take all available steps to resist or avoid the disclosure (including steps RAK ICC reasonably requests), and keep RAK ICC fully and promptly informed. If you are ultimately obliged to disclose, you must disclose only the minimum necessary, give prior written notice of what you propose to disclose with a copy, and give RAK ICC an opportunity to discuss it first.

This is one of the most practically important clauses, because being compelled to disclose — by a court order, a regulator, or a legal obligation — is a genuine possibility that even the most careful recipient cannot always prevent. The undertaking does not pretend you can defy a valid legal order; instead it channels the disclosure so that RAK ICC's interests are protected as far as possible. The sequence is worth committing to memory: notify immediately, resist where you lawfully can, disclose only the minimum, and give RAK ICC advance sight and a chance to be heard.

The reason this procedure exists is that it preserves RAK ICC's ability to protect its own information — for example by seeking a protective order or narrowing the scope of what must be produced — even in a situation you did not create and cannot fully control. Skipping the notice step, or disclosing more than the minimum, converts a lawful compelled disclosure into a breach of the undertaking. So even when the law is forcing your hand, the undertaking still governs how you respond, and following the sequence is what keeps you compliant.

What are your core obligations under the confidentiality undertaking?

Clause 6 sets out the heart of the undertaking — nine detailed, cumulative obligations governing how you must handle RAK ICC's information. In summary: hold it in strict confidence on a need-to-know basis; treat it with the same care you give your own most secret information; use it only for the engagement's purpose; never use it in a way detrimental to RAK ICC; do not copy or retain it; notify RAK ICC before releasing it to any Representative; do not disclose it to anyone without prior written consent; use best endeavours to protect it; and notify RAK ICC immediately of any breach.

Two of these obligations are easy to underestimate. Clause 6.4 states that any use or exploitation of the information for any purpose other than your own internal and non-commercial use will be deemed detrimental to RAK ICC. That is a powerful piece of drafting: it means you do not get to argue about whether a particular commercial use actually harmed RAK ICC — commercial use is automatically treated as harmful. And clause 6.6 requires you, before releasing information even to your own Representative who needs it, to give RAK ICC advance written notification stating that Representative's name, address, telephone number and relationship to you, and to notify the Representative that the disclosure is in confidence and subject to the undertaking.

Consider a common scenario. You receive RAK ICC's confidential system documentation and need your external IT consultant to review it. Under clause 6.6 you cannot simply forward it: you must first notify RAK ICC in writing with the consultant's details, and make clear to the consultant that the material is confidential and bound by the undertaking. Under clause 6.7, disclosure to a genuine third party requires RAK ICC's prior written consent and that the third party signs a confidentiality agreement acceptable to RAK ICC. These "flow-down" controls are what make the undertaking effective — the obligations follow the information to everyone who touches it. Building these habits into how your firm handles sensitive material is exactly the kind of governance discipline our compliance advisory helps put in place.

When and how must you return or destroy the information?

Immediately upon a written demand from RAK ICC. On receiving such a demand, the undertaking requires you to return all Confidential Information and any copies; erase it from any computer or device and from all documents, disks and files, and confirm the erasure; destroy all notes, analyses and memoranda containing it, and confirm the destruction; and use all reasonable endeavours to ensure anyone you supplied it to also destroys or permanently erases it — subject to narrow carve-outs where retention is legally required.

The return-and-destroy obligation is comprehensive, and the requirement to confirm erasure and destruction is easy to miss. It is not enough to quietly delete the material; the undertaking requires you to provide notice that you have done so. That means you need a process: when a demand arrives, you locate every instance of the information — originals, copies, derived documents, backups, and material held by your Representatives — deal with each, and then confirm back to RAK ICC. A scattered, undocumented approach makes it very hard to demonstrate that you complied, which is why knowing where the information lives from the outset is so valuable.

The carve-outs are limited and sensible. You are not required to force a downstream recipient to destroy information where that recipient is legally required to retain it — by applicable law, or by a competent judicial, governmental, supervisory or regulatory body or a bona fide stock exchange — or where the information was properly disclosed under the undertaking. But these are exceptions to be relied on only where they genuinely apply, not a general excuse to keep copies. The default position is complete return or destruction on demand, with confirmation, and everything else is a narrow qualification of that default.

What happens if you breach the undertaking?

The consequences are deliberately serious. The undertaking records that the Recipient accepts the terms are reasonable and necessary to protect RAK ICC's business, reputation and goodwill, and that a breach would cause grave loss. It then makes the Recipient liable to pay RAK ICC all direct, indirect and consequential damages arising from a breach, acknowledges that monetary compensation may be insufficient, and preserves RAK ICC's right to injunctive and equitable relief — plus recovery of losses, costs and fees, including attorneys' and arbitration fees.

Three exposures stack up here. First, damages: the Recipient agrees to compensate RAK ICC for direct, indirect and consequential losses — a broad category that can reach well beyond the obvious. Second, injunctive relief: because the undertaking acknowledges that money may not be an adequate remedy, RAK ICC can seek a court order to stop further disclosure or use, which can be obtained quickly and is often more consequential than damages. Third, an indemnity: under a separate clause, the Recipient agrees to indemnify and hold RAK ICC and its directors, officers, shareholders, employees and agents harmless from third-party claims arising out of the Recipient's unauthorised use or disclosure — so if a leak triggers a claim against RAK ICC by someone else, the Recipient bears it.

The combined effect is that a confidentiality breach under this undertaking is not a contained, easily-quantified risk — it can produce an injunction, an open-ended damages claim, a costs award, and an indemnity liability all at once. That is precisely why the sensible approach is prevention: robust need-to-know controls, disciplined handling, careful flow-down to Representatives, and prompt notification if anything goes wrong. The clauses are drafted to make breach expensive; the rational response is to make breach unlikely.

Does signing give you any rights over the information or guarantee a deal?

No, on both counts. The undertaking is explicit that nothing in it grants the Recipient any right, title or interest in RAK ICC's Confidential Information, or in any invention, trade secret or intellectual property based on it. And a separate clause confirms that RAK ICC providing confidential information creates no obligation on RAK ICC to enter into any transaction or agreement with the Recipient. Receiving the information buys you access for the agreed purpose — nothing more.

The no-rights point is important for anyone who might be tempted to think that being given access to RAK ICC's know-how, systems or ideas confers some entitlement to use or build on them. It does not. By disclosing the information, RAK ICC grants no express or implied licence, and the Recipient and its Representatives acquire no title to anything — including any intellectual property derived from the material. The information remains entirely RAK ICC's, and your permission to use it is bounded strictly by the engagement's purpose and ends when the undertaking requires you to return or destroy it.

The no-deal point protects RAK ICC's commercial freedom. Sharing confidential information during discussions does not commit RAK ICC to proceed with any transaction — discussions can end with no deal, and the Recipient cannot argue that the disclosure created an obligation to contract. Two further housekeeping clauses round this out: a non-waiver provision, meaning RAK ICC's failure to enforce a term on one occasion does not waive its right to enforce it later; and the point that these protections operate regardless of whether the wider relationship results in any agreement. Together they ensure the undertaking protects RAK ICC's information without tying RAK ICC's hands commercially.

Which law governs the undertaking and where are disputes heard?

The undertaking is governed by and construed in accordance with the laws of the UAE as applicable in Ras Al Khaimah, and any dispute arising out of or in connection with it is to be referred exclusively to the local courts of Ras Al Khaimah. This is a clear, single-forum arrangement: UAE law applies, and the RAK courts have exclusive jurisdiction.

The governing-law and jurisdiction clause matters more than it might appear. It means that if a dispute arises — over whether information was confidential, whether a disclosure was permitted, or whether a breach occurred — it will be resolved under UAE law and in the Ras Al Khaimah courts, not in the Recipient's home jurisdiction or anywhere else. For a Recipient based outside the UAE, or used to a different legal system, this is a meaningful commitment: you are agreeing in advance to litigate any confidentiality dispute in RAK, under UAE law.

This is a common and reasonable structure for a document protecting a UAE entity's information, but it is one of the clauses most worth understanding before signing. It affects where and how you would defend a claim, what law governs the interpretation of every other clause, and the practical cost and complexity of any dispute. If your organisation is not familiar with UAE law or the RAK courts, it is exactly the kind of provision on which to take local advice — and it reinforces the general point that a confidentiality undertaking, though short, is a serious legal instrument. Our team works within this framework daily as part of our UAE corporate services, alongside related obligations such as corporate tax compliance for RAK ICC and other UAE entities.

How do you complete and sign the Confidentiality Undertaking safely?

You complete it by inserting the Recipient's name and address and RAK ICC's details, reading and understanding each clause, satisfying yourself that you can meet the obligations, and signing through a named individual with authority. Because it is a binding legal document, the signature should follow a genuine review — ideally with legal advice — rather than being treated as a formality.

1. Complete the party details — insert the Recipient’s name and UAE address, and RAK ICC’s details, in the opening section.
2. Read the definition of Confidential Information — understand how broad it is, including unmarked information and anything you derive from it, so you know what you are agreeing to protect.
3. Check the purpose against the Engagement Letter — confirm the permitted purpose (clause 6.3) matches the engagement, since use beyond that purpose is a breach.
4. Assess whether you can meet the obligations — need-to-know access, no copying or retention, flow-down to Representatives, return-and-destroy on demand, and indefinite confidentiality.
5. Take legal advice on the key clauses — particularly the indefinite term, the damages and indemnity provisions, and the UAE-law / RAK-courts jurisdiction clause.
6. Sign through an authorised individual and keep a copy — the document is signed by a named person; retain a copy and build the handling controls the undertaking requires.

The single most valuable step is the second-to-last one. A confidentiality undertaking commits you to protect information indefinitely, exposes you to damages, an indemnity and injunctive relief for breach, and submits you to UAE law and the RAK courts — and none of that should be agreed without understanding it. Taking advice before signing is not excessive caution; it is the proportionate response to a document with these consequences. If you are being asked to sign one in connection with a RAK ICC relationship, our corporate and compliance team can help you understand what you are taking on and put the right handling controls in place.

One closing thought. A confidentiality undertaking can look like standard paperwork, but this one imposes broad, indefinite and seriously enforceable obligations, and it is governed by UAE law in the RAK courts. Understood properly and handled with discipline, it is entirely manageable — the vast majority of recipients honour these undertakings without incident. The risk lies almost entirely in signing without reading, or in sloppy handling of the information afterwards. Read it, understand it, put the right controls in place, and it becomes exactly what it is meant to be: a clear framework for a trusted exchange of information.