Examples of confidential information fall into a handful of recognizable categories: trade secrets and proprietary business data, technical formulas and source code, employee personal and medical records, customer and client data, internal communications, and sensitive information a business shares with government agencies. Federal law defines a trade secret as information that derives economic value from not being generally known and that the owner takes reasonable steps to keep secret,1United States Patent and Trademark Office. Trade Secret Policy and that broad definition is wide enough to reach a pricing spreadsheet on one end and an employee’s medical file on the other. Each category comes with its own legal protections and its own consequences when the information leaks.
Trade Secrets and Proprietary Business Data
The largest category is proprietary business data: profit margins, internal cost structures, corporate debt terms, unreleased marketing plans, supplier contracts, and customer lists. A competitor holding your pricing tiers or discount schedules can undercut every bid you make, and courts take that reality seriously.
Nearly every state has adopted the Uniform Trade Secrets Act, which sets the legal framework for protecting these assets.2Legal Information Institute. Trade Secret The federal Defend Trade Secrets Act adds a second layer, letting a business file a misappropriation claim in federal court when the stolen information touches interstate commerce. Under both statutes, a company can seek an injunction to stop the disclosure and recover damages for actual losses or for the profit the thief gained. When the theft was willful, courts can double the damages and shift attorney fees to the losing side.3Office of the Law Revision Counsel. 18 US Code 1836 – Civil Proceedings
Trade secret theft can also be a federal crime. An individual convicted under the Economic Espionage Act faces up to 10 years in prison, and an organization can be fined the greater of $5 million or three times the value of the stolen secret.4Office of the Law Revision Counsel. 18 US Code 1832 – Theft of Trade Secrets Federal prosecutors bring these cases regularly, especially when a departing employee walks out with pricing databases or vendor lists.
Technical Data, Formulas, and Source Code
Software source code, proprietary algorithms, chemical formulas, manufacturing processes, and architectural designs are all confidential technical information. What sets this category apart is that the value sits in the specifics of how something works. A leaked customer list hurts you commercially. A leaked formula lets a competitor build your product.
Technical “know-how” is the hardest slice to protect because it lives in an engineer’s head rather than in a manual. A patent trades secrecy for a time-limited public monopoly, but many companies choose trade secret protection instead because it lasts indefinitely as long as the information stays hidden.
When a key employee moves to a direct competitor, some courts apply the “inevitable disclosure” doctrine, reasoning that a role so similar to the old one cannot be performed without drawing on the former employer’s secrets. The Defend Trade Secrets Act limits how far a court can go with this: it cannot block someone from taking a new job, though it can restrict the type of work performed or the clients contacted.3Office of the Law Revision Counsel. 18 US Code 1836 – Civil Proceedings Outcomes turn on the facts.
Employee Personal and Medical Records
Employers collect a lot of sensitive information about the people who work for them: Social Security numbers, home addresses, direct-deposit bank details, compensation figures, performance evaluations, and disciplinary records. All of it is confidential, both as a matter of company policy and under federal requirements.
Medical information gets the strictest treatment. The Americans with Disabilities Act requires employers to keep medical data on separate forms and in separate files from the general personnel folder, and to treat it as a confidential medical record. Access is limited to a narrow group: supervisors who need to know about work restrictions or accommodations, safety personnel who might respond to a medical emergency, and government investigators checking compliance.5Office of the Law Revision Counsel. 42 US Code 12112 – Discrimination Storing medical records in the same cabinet as general HR files is a federal violation, and the EEOC enforces it.
These records also carry retention obligations. Federal rules require employers to keep general personnel records for at least one year (or one year after termination in involuntary separations), payroll records for three years, and benefit plan documentation for the life of the plan plus one year after it ends. Once an EEOC charge is filed, every relevant record must be preserved until the matter is fully resolved, appeals included.6U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
Customer and Client Data
Client lists, contact databases, purchase histories, payment card numbers, and bank account details are confidential because they represent years of relationship-building and because their exposure can cause direct financial harm. A leaked client list lets a competitor poach accounts. A leaked credit card number exposes the customer to fraud and the business to liability.
Regulated industries face higher stakes. Law firms hold privileged case files. Healthcare providers hold patient records protected by HIPAA. Financial institutions hold account data subject to the Gramm-Leach-Bliley Act. Broader privacy frameworks such as the California Consumer Privacy Act and the European Union’s General Data Protection Regulation define personal data widely enough to cover anything identifying an individual, and both impose substantial penalties. Under GDPR, fines can reach €20 million or 4% of a company’s worldwide annual revenue, whichever is higher.
When a breach happens, every state plus the District of Columbia now requires businesses to notify the people affected. The specifics vary — timing, method of notice, what triggers the duty — but the core obligation is universal: if personally identifiable information such as Social Security or financial account data is compromised, affected individuals have a legal right to know. Failing to notify can pile regulatory penalties on top of whatever damage the breach itself caused.
Internal Communications and Operations
Executive memos, board meeting minutes, internal strategy sessions, and operational manuals are confidential because they reveal decisions and methods that were never meant to leave the building. A merger discussion transcript can move stock prices. An operations manual can let a competitor replicate the workflow behind your efficiency. Companies typically label these documents “confidential” or “internal only,” and courts weigh those markings when deciding whether the company took reasonable steps to guard the information.
Sharing an internal manual with a competitor is a straightforward breach of contract that can lead to termination and a lawsuit. Some internal communications carry additional protection. When in-house lawyers are involved, certain communications may qualify for attorney-client privilege, shielding them from opposing parties in litigation as well as from competitors. Only communications made for the purpose of providing legal advice qualify. If in-house counsel was acting in a business role rather than a legal one, the privilege does not attach. Companies that want to preserve the protection label the relevant documents clearly and limit distribution to those who genuinely need to see them.
Confidential Information Shared With the Government
Businesses regularly submit sensitive data to federal agencies as part of regulatory compliance, contracting, and licensing. That data does not automatically become public. The Freedom of Information Act contains a specific exemption, known as Exemption 4, for trade secrets and confidential commercial or financial information obtained from a person.7Office of the Law Revision Counsel. 5 US Code 552 – Public Information; Agency Rules, Opinions, Orders, Records, and Proceedings When a competitor files a FOIA request seeking your pricing data or proprietary technical specifications, this exemption is what keeps the agency from handing it over.
The protection is not automatic. Businesses should designate the confidential portions of a submission at the time of filing, using clear markings. If an agency decides to release information despite a confidentiality designation, the submitter can file a “reverse FOIA” lawsuit to block the disclosure. For companies that deal with government contracts regularly, the designation process is routine paperwork rather than an afterthought; an unmarked submission is much harder to protect after the fact.
When Confidentiality Rules Do Not Apply
Confidentiality agreements have limits, and the biggest one is for whistleblowers.
The Defend Trade Secrets Act provides explicit immunity for anyone who discloses a trade secret to a government official or an attorney solely to report a suspected violation of law. The same immunity covers disclosures made in sealed court filings as part of a lawsuit. Employers are required to include a notice of this immunity in any employment contract or confidentiality agreement that governs trade secret use. Skipping the notice costs the employer the ability to recover enhanced damages or attorney fees in a later misappropriation suit against that employee.8Office of the Law Revision Counsel. 18 US Code 1833 – Exceptions to Prohibitions The notice requirement applies to employees, contractors, and consultants alike.
Beyond trade secrets, the SEC prohibits employers from enforcing confidentiality agreements in ways that would prevent employees from reporting possible securities violations directly to the Commission. The Department of Justice and OSHA have taken a similar position on antitrust crimes, warning that NDAs designed to deter reporting can themselves trigger criminal liability and hurt a company’s standing in enforcement proceedings.9United States Department of Justice. Justice Department and OSHA Issue Statement on Non-Disclosure Agreements That Deter Reporting of Antitrust Crimes No NDA can legally stop someone from cooperating with a government investigation.
What Makes Information Legally Confidential
Calling something “confidential” does not make it so in court. To qualify for trade secret protection under state or federal law, a company must show it took reasonable steps to maintain secrecy. Courts look at concrete measures: whether the company required nondisclosure agreements, whether access was limited to people with a genuine need to know, whether documents were labeled confidential or proprietary, and whether data was stored behind appropriate physical and digital safeguards such as locked cabinets, encrypted drives, or restricted network access.1United States Patent and Trademark Office. Trade Secret Policy
This is where most trade secret claims come apart. A company that shares pricing data freely during sales calls, leaves sensitive documents on an open shared drive, or never bothers with NDAs will struggle to convince a judge that the information deserved protection. The standard is not perfection. Courts do not expect Fort Knox. They do expect a reasonable, consistent effort. If an employee walks out with a client list the company never marked confidential, never restricted access to, and never told employees was sensitive, the legal claim is on shaky ground before it starts.