To protect a trade secret, you have to do two things at once: keep the information genuinely secret through documented security measures, and lock in confidentiality through contracts with everyone who touches it. Both federal law and nearly every state require proof that you took “reasonable measures” to maintain secrecy, and the protection only holds up in court if you can show what you did and when you did it.
What the Information Itself Has to Be
The federal Defend Trade Secrets Act covers financial, business, scientific, technical, and engineering information in any form: formulas, processes, customer lists, software code, marketing strategies, manufacturing techniques, whether stored on paper, in a database, or in someone’s head. Two things must be true for it to qualify. The information has to derive independent economic value from not being generally known to people who could profit from learning it, and the owner has to have taken reasonable measures to keep it secret.1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions Nearly every state has adopted the Uniform Trade Secrets Act, which uses essentially the same test.
Some things cannot be trade secrets no matter what you do. Information that is publicly available, easily discoverable, or widely used in an industry does not qualify. If a competitor can figure out your process through legitimate reverse engineering or independent research, that information lacks the secrecy element. The DTSA explicitly excludes reverse engineering and independent discovery from its definition of “improper means.”1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions Information that was once valuable but has become obsolete also falls outside protection.
One practical fork worth flagging before you go further. Trade secret protection lasts as long as the secret stays secret, but a patent, which lasts 20 years from filing, may protect you better if your innovation is easy to reverse engineer once it hits the market.2Office of the Law Revision Counsel. 35 U.S. Code 154 – Contents and Term of Patent; Provisional Rights Trade secret protection is the right choice when the information is an internal process or formula that competitors would struggle to replicate on their own.
Security Measures Courts Actually Look For
“Reasonable measures” is where most trade secret claims succeed or fail. Courts do not require perfect security, but they expect more than lip service. The general expectation is at least two of three foundational elements: confidentiality agreements, written policies that inform employees about trade secrets, and restricted access to the information.
Documenting what you do matters as much as doing it. If you ever need to enforce your rights in court, you will need to show your policies, your access controls, and when each was put in place. A policy that lives only in someone’s memory is nearly as useless as none at all.
Digital Security
Access controls are the backbone. Sensitive files and systems should be restricted on a need-to-know basis, so employees can only reach information required for their specific roles. Strong password requirements, multi-factor authentication, and encryption for stored and transmitted data are standard measures. Digital access logs matter twice over: they deter casual snooping, and they create a trail showing exactly who viewed or transferred information if a breach occurs.
Physical Security
Digital measures alone are not enough when tangible materials exist. Common physical safeguards include:
- Locked cabinets or rooms for sensitive documents
- Keycards or biometric scanners limiting entry to areas where trade secrets are used or stored
- Sign-in logs and escort requirements for visitors
- Shredding documents and wiping hard drives rather than simply discarding them
Contracts With the People Who Touch It
Security addresses the environment. Contracts extend your protection to the people. Courts want to see both.
Non-Disclosure Agreements
The non-disclosure agreement is the standard tool. For third parties like vendors, investors, or potential business partners, the NDA should be signed before any sensitive information changes hands. For employees, confidentiality provisions can be built into the employment agreement itself.
An effective NDA does three things: it defines what information is confidential with enough specificity that both parties understand the boundaries, it states that the recipient can only use the information for a defined purpose, and it sets a duration for the obligation. For true trade secrets, that duration should extend indefinitely, or at least until the information genuinely becomes public through no fault of the recipient.
What a Contract Cannot Do
An employee’s general knowledge and professional skills are never protectable as trade secrets, regardless of what a contract says. Courts consistently hold that people have the right to use the expertise they developed on the job when they move to a new employer. The line between “our proprietary process” and “skills this person learned while working here” can be blurry, and the more precisely you define and document your trade secrets, the easier it becomes to distinguish them from an employee’s general professional competence.
The Whistleblower Notice You Must Include
The DTSA requires that any contract or agreement with an employee governing trade secrets or confidential information must include a notice about whistleblower immunity. The statute protects individuals who disclose trade secrets in confidence to a government official or attorney for the purpose of reporting a suspected legal violation, or who file the information under seal in a lawsuit.3Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibitions
The penalty for skipping the notice is targeted rather than global. Your contract does not become unenforceable. But if you later sue that employee for trade secret misappropriation under the DTSA, you lose the ability to recover exemplary damages or attorney fees.3Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibitions Those remedies can double your recovery and shift legal costs to the other side, so forfeiting them over a missing paragraph is a costly oversight.
The notice does not need to be lengthy. You can satisfy the requirement by cross-referencing a company policy document that covers reporting procedures for suspected legal violations, as long as the employee actually receives that document. The requirement applies to employees, contractors, and consultants alike, and to any agreement entered into or updated since the DTSA’s enactment in 2016.
Off-Boarding Departing Employees
The moment an employee gives notice is one of the highest-risk periods for trade secret loss. A structured off-boarding process protects you far better than an NDA signed years earlier.
Start with the practical steps. Revoke system access, collect all company-owned devices, and verify that no files have been transferred to personal accounts or cloud storage. Check access logs and email history for unusual download patterns or file transfers in the days and weeks before the resignation. This is where the digital security measures pay off.
Use the exit interview to remind the departing employee of their ongoing confidentiality obligations and have them acknowledge those obligations in writing. This is not about intimidation. It is about creating a clear record. If a dispute arises later, a signed acknowledgment eliminates any argument that the employee forgot or misunderstood their duties.
If You Suspect a Breach
Speed matters. Delay weakens both your legal position and your ability to limit the damage.
Stop further access first. Revoke the suspected individual’s credentials, disable remote connections, and physically secure any documents or prototypes they had access to. At the same time, preserve every piece of potential evidence without altering it. Emails, access logs, security camera footage, and file transfer records all need to be locked down. A forensic analysis of the relevant systems may be necessary to understand the full scope of what was taken. Deleting or modifying data during this phase, even with good intentions, can undermine a future legal case.
Contact an attorney experienced in trade secret litigation as early as possible. The initial response often involves a formal cease-and-desist letter demanding that the other party stop using and return the information. When that is not enough, the most common judicial remedy is an injunction to prevent ongoing or threatened misappropriation. The DTSA authorizes courts to issue injunctions on whatever terms are reasonable, though the law specifically prohibits orders that prevent someone from taking a new job based solely on what they know, rather than evidence of an actual threat.4Office of the Law Revision Counsel. 18 U.S. Code 1836 – Civil Proceedings
If misappropriation is proven, the DTSA allows recovery of actual losses, any additional profits the misappropriator gained, or, when those figures are hard to pin down, a reasonable royalty. When the conduct was willful and malicious, courts can award exemplary damages up to twice the base amount, along with attorney fees, provided your employee agreements carried the whistleblower notice.4Office of the Law Revision Counsel. 18 U.S. Code 1836 – Civil Proceedings
Watch the clock. You have three years from the date you discovered the misappropriation, or should have discovered it through reasonable diligence, to file a civil claim under the DTSA. A continuing misappropriation counts as a single claim, so the clock runs from when you learn of it rather than from each individual act.4Office of the Law Revision Counsel. 18 U.S. Code 1836 – Civil Proceedings State statutes of limitations vary but are typically in the same range. Waiting too long after discovering a problem does not just weaken your evidence; it can eliminate your ability to sue entirely.