Customer lists can qualify as trade secrets, but only some of them do. The list has to contain information a competitor couldn’t easily gather on their own, and the business has to actually treat it like a secret. A plain roster of client names pulled from public sources usually won’t qualify. A detailed database with purchasing histories, negotiated pricing, renewal dates, and decision-maker preferences often will, provided the company has locked it down with the kinds of security measures courts expect to see.
The Two-Part Test
Federal and state trade secret law use nearly identical definitions. Under the federal Defend Trade Secrets Act, a trade secret is business, financial, technical, or scientific information, including compilations, that meets two conditions: the owner has taken reasonable steps to keep it secret, and the information has independent economic value because others don’t know it and can’t readily figure it out.1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions The word “compilations” is what puts customer lists in the picture. Congress wrote the statute to cover assembled information, not just formulas and inventions.
Forty-eight states plus the District of Columbia have adopted a version of the Uniform Trade Secrets Act, which uses the same two-part test.2Legal Information Institute. Trade Secret The DTSA doesn’t displace state law, so a business can pursue claims under both.
What Makes a Customer List Qualify
The test is short, but courts apply it case by case, and the outcome turns on what your list actually contains. Several factors tend to drive the analysis:
- Depth of information. Lists that go beyond names and addresses, with pricing terms, purchase frequency, buying patterns, and individual contacts, are far more likely to qualify. The richer the data, the harder it is for a competitor to reconstruct.
- Cost and effort to compile. If assembling the list took significant time, money, or industry-specific knowledge, that investment is evidence of economic value.
- Public availability. This is where most claims are won or lost. If a competitor could build the same list from directories, trade show attendees, or LinkedIn, the information isn’t secret enough.
- Competitive advantage. The list has to give its owner a real edge. A curated list of the 200 best prospects for a niche product does that. Every business in a zip code does not.
When Public and Private Data Are Mixed
The hard cases involve lists that combine publicly available information with proprietary detail. In a 2023 decision, the First Circuit held that spreadsheets mixing public and non-public customer information could still qualify as trade secrets because they would be “difficult, if not impossible” to recreate from public sources alone. The company had also protected the spreadsheets with agency agreements, passwords, and other precautions. The takeaway is that individual data points being public doesn’t automatically defeat trade secret status, as long as the compilation adds proprietary context and the company has actually protected it.
When a List Won’t Qualify
A customer list generally fails the test when competitors could identify the same customers through ordinary business channels, when the list contains nothing beyond what’s in a public directory, or when the company let access spread widely enough that the information stopped being secret. Courts have consistently rejected claims where the business couldn’t point to meaningful proprietary value on top of public information.
What “Reasonable Efforts” Looks Like
Calling your list a secret isn’t enough. Courts want evidence you treated it as one, and businesses that skip these steps often lose before the merits are even reached.
- Confidentiality agreements. Every employee, contractor, and vendor with access should sign an agreement that specifically identifies customer data as confidential. Vague agreements that don’t name what’s protected have failed in court.
- Access restrictions. Not everyone in the company needs the full customer database. Role-based permissions show a court you were serious.
- Technical safeguards. Password protection, encryption, and secure storage are the baseline. An unprotected shared drive undercuts the claim.
- Document labeling. Mark files “Confidential” or “Proprietary.” The absence of labeling has been cited by courts as evidence a company didn’t treat information as secret.
- Exit procedures. Conduct exit interviews, remind departing employees of their confidentiality obligations, retrieve devices, and revoke access immediately. A key salesperson leaving is the most common trigger for customer list theft.
- Written policy. Maintain a written trade secret policy that identifies protected information and the security procedures employees must follow. A policy that exists only on paper won’t help.
No single measure is decisive. Together they build the record that survives judicial scrutiny.
What Counts as Misappropriation
Under the DTSA, misappropriation means acquiring a trade secret through improper means while knowing (or having reason to know) those means were improper, or disclosing or using a trade secret without consent when the person knew or should have known it was obtained improperly or under a duty of secrecy.3Legal Information Institute. 18 U.S. Code 1839(5) – Definition of Misappropriation Improper means covers theft, bribery, hacking, and breaching a confidentiality obligation.
The classic customer list scenario is a departing employee who downloads the list, joins a competitor, and starts calling the same customers. That’s the textbook case. Misappropriation can also involve a business partner accessing your CRM beyond the scope of your agreement, or a contractor copying your database before the engagement ends.
There’s an important boundary. If a former employee remembers a handful of client names from years of personal relationships and reaches out on that basis, courts generally treat that as use of general knowledge and skill, not misappropriation. Trade secret law protects compiled proprietary information, not a person’s memory of people they worked with.2Legal Information Institute. Trade Secret
What You Can Recover
The DTSA provides a full menu of remedies, and most state statutes mirror it.
- Injunctions. A court can order the misappropriator to stop using or disclosing the trade secret. An injunction cannot bar someone from taking a new job outright; conditions on employment must rest on actual evidence of threatened misappropriation, not just knowledge of confidential information.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings
- Actual damages. Compensation for the owner’s losses, plus any unjust enrichment not already captured in the loss calculation.
- Reasonable royalty. A court can impose a royalty for the unauthorized use as an alternative to traditional damage calculations.
- Exemplary damages. If the misappropriation was willful and malicious, the court can award up to double the compensatory damages.
- Attorney’s fees. The prevailing party can recover reasonable fees if the claim was brought in bad faith or the misappropriation was willful and malicious.
The Three-Year Clock
Under both the DTSA and the UTSA, you have three years to file a misappropriation claim. The clock starts when you discover the misappropriation, or when you should have discovered it through reasonable diligence.4Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings Ongoing misappropriation counts as a single claim, so the window runs from discovery of the initial act, not each subsequent use.
Three years sounds generous, but misappropriation often goes undetected for a long time. A former employee quietly using your list at a competitor may not surface until you notice a pattern of lost accounts, and by then a year or more can be gone. Watching customer retention after key departures is how you preserve your ability to sue.
Backup Protections When Trade Secret Status Is Thin
Trade secret law isn’t the only tool. If your list falls short of the legal threshold, other mechanisms can still cover you.
Confidentiality clauses in employment and vendor contracts create binding obligations regardless of whether the information qualifies as a trade secret. The obligation exists because the parties agreed to it, so you don’t have to prove the compilation meets the statutory test. Non-solicitation agreements, which restrict a former employee from contacting specific customers for a defined period, work similarly and tend to be more enforceable than broad non-competes because they target a narrower harm.
Non-competes themselves remain governed by state law, with widely varying enforceability. The FTC issued a rule in 2024 that would have banned most non-competes, but a federal district court blocked it from taking effect in August 2024, and the rule is not currently enforceable.5Federal Trade Commission. Noncompete Rule
Copyright can protect the creative selection and arrangement of a list, but not the underlying facts. Alphabetical or zip-code order doesn’t involve enough creative choice to qualify.6U.S. Copyright Office. Circular 6 Copyright Registration for Automated Databases Copyright also won’t stop someone from using the individual facts in your list, only from copying your specific compilation. For most businesses it’s a thin layer at best, not a substitute for real trade secret safeguards and contractual restrictions.