10 Pointers to Protect Trade Secrets: Practice Points

Accept that only a court decides what counts as a trade secret. Patents, copyrights, and trademarks get defined up front when someone registers them. Trade secrets never do. Maria explained that the question only got answered in litigation or arbitration, when a trier of fact applied the statutory elements. Clients often disliked that answer, and it was still the correct one.

Treat confidential information and trade secrets as related but separate. Confidential information was defined by contract, and trade secrets were defined by statute. Two parties could agree that information was confidential, and that agreement alone never made it a trade secret. Maria noted that most plaintiffs asserted breach of contract alongside misappropriation, so a solid confidentiality clause gave you a strong fallback. Plaintiffs liked the trade secret claim mostly for its more flexible damages, including unjust enrichment.

Point to the statute instead of writing your own trade secret definition. Laura's practice was never to define trade secret in the contract and to reference applicable law instead. A homemade definition just created a second standard that differed from the statute. Maria added that courts gave no weight to boilerplate labeling information as trade secret information. Agreeing that everything is a trade secret was, in her words, the worst possible outcome.

Give your crown jewels their own spot in the confidential information definition. Laura's drafting strategy for something like product technical specifications was to name it expressly as confidential information. That removed any argument about whether it fit a long definition full of exclusions and exceptions. Maria agreed, since you had to sit inside the confidential information circle before you had any shot at the trade secret circle. Whatever a court later decides, the contract protection is already in place.

Aim for measures that are reasonable for your business. Judge Posner's opinion in Rockwell Graphic Systems set the tone. Measures had to be cost-efficient and still let the business do business, so nobody needed to lock every drawing in a vault. The Vendavo court put it memorably when it said a company need not monitor its employees like a police state. Laura said this idea helped her stop worrying that one slip meant losing trade secret status forever.

Make your protection efforts consistent and deliberate. Maria said courts wanted to see a culture of protection that was intentional and sustained over time. Confidentiality stamps, email legends, and badge access alone looked like box checking. In Yellowfin, the company limited access and used passwords, and it still encouraged an employee to work on personal devices and never pushed him to sign the confidentiality agreement he refused. The court found those gaps undercut everything else.

Scale your measures to the secret and to the company. Courts looked at the nature of the secret and the sophistication of the company. A Coca-Cola-style formula called for far more protection than a marketing plan. Maria said courts expected more of Apple than of a startup, and she expected reasonable measures to be the key issue in the pending Apple dispute involving OpenAI. Tech companies protecting source code should expect scrutiny of download controls, monitoring, and remote wipe capability.

Expect the same analysis for AI products. Maria's students often asked whether AI changed everything, and her short answer was no. In Neural Magic, Facebook let two departing engineers stay on its systems for months without asking for laptops back or for anything to be scrubbed, and the court found its measures fell short. Juries AI came out the other way because it asked its departing co-founder for an NDA, deletion, and a forensic exam, and he refused all of it. The court saw the co-founder as the unreasonable one.

Put real effort into offboarding. Exit conversations came up again and again in these cases. Sophisticated companies were expected to talk with departing employees about their confidentiality obligations, ask for information back, and get some confirmation that it was deleted. Smaller companies faced lower expectations, and a simple reminder letter was still good practice. Remote workforces made this step even more important.

Involve the whole company in building the fort. Maria's four buckets were technology, physical security, training and culture, and administrative or HR measures. Training and culture got overlooked most and mattered most. Salespeople who left pricing decks with every prospect made it very hard to claim later that prices were a secret. Legal guided the effort, and IT, HR, sales, and engineering all had to help design a system that fit the business.