Adding fields to the checkout process can be tricky. Considering that the customer will be checking that he agrees to the non-disclosure, wouldn't the name he gives when creating an account, and the date/time stamp on the order be good enough ?