Information as a trade secret: protecting the most valuable asset of an IT company

1. Why legal classification matters

Source code, architecture, datasets, pricing, roadmaps, customer information and internal methods may constitute trade secrets only if they are secret, commercially valuable because of that secrecy and subject to reasonable protective steps.

2. Identify and classify information

An organisation cannot protect “everything” effectively. Create categories, owners, permitted uses, storage locations, access levels and retention periods. Marking supports evidence but does not replace actual control.

3. Contractual protection

Employment, contractor, supplier, client and investment documents should define confidential information, permitted disclosure, security obligations, return or deletion, ownership of work product and remedies. An NDA must fit the relationship rather than operate as a generic form.

4. Technical and organisational measures

Use role-based access, multi-factor authentication, logging, encryption, repository controls, secure development practices, segmentation and tested offboarding. Legal and technical measures must describe the same information flows.

5. Employees and contractors

Onboarding should explain duties and access; role changes should trigger review; departure should result in prompt revocation, asset return, declarations and preservation of relevant logs.

6. Transactions and due diligence

Fundraising, partnerships and M&A require staged disclosure, controlled data rooms, recipient restrictions and a documented disclosure trail. Do not reveal the core secret merely to prove that it exists.

7. Incident response and enforcement

Prepare an escalation route before an incident. Preserve evidence, contain access, assess notification duties, send targeted demands and consider interim court relief. Delay can destroy both evidence and commercial value.

8. A living protection programme

Review the information map, contracts, permissions and response plan when products, staff, infrastructure or partnerships change. Reasonable measures must be demonstrable at the time protection is needed.