What actually counts as a trade secret — and why an NDA is only half of it

The three-part test

The definition is consistent across the Uniform Trade Secrets Act, adopted in most states, and the federal Defend Trade Secrets Act. Information qualifies as a trade secret where all three of the following hold at once.

• It derives independent economic value — actual or potential — from not being generally known.
• It is not readily ascertainable by proper means by people who could obtain value from it.
• The owner has taken reasonable measures to keep it secret.

The subject matter is deliberately wide: financial, business, scientific, technical, economic and engineering information all count in principle. Formulas, source code, manufacturing processes, customer data and pricing models are the standard examples. There is no category test to fail, which is why litigation concentrates almost entirely on the third element.

Reasonable measures is a test about your behaviour

This is the part people misread. The question is not how sensitive the information was, or how much it would hurt to lose it. It is what you actually did about it, in the period before anything went wrong.

The statute does not define what is sufficient, and the standard varies with the size of the business and the circumstances. The floor is reasonably clear: an owner must at minimum ensure the information is not disclosed, without protections, to someone in a position to make commercial use of it. Above that floor, courts look at the ordinary machinery — non-disclosure agreements with people who have access, confidentiality legends on documents, access limited to those with a need to know, and storage behind a lock, physical or digital.

You are not required to build an impenetrable fortress. You are required to have behaved like someone who thought the information was worth protecting. The gap between those two standards is where most defensible programmes sit.

1. 1

   Write down what the secrets are

   A short schedule, kept current: the specific formulas, models, datasets, processes and documents you are claiming. This is unglamorous and it is the single most useful artefact you can have. A claim that cannot identify its own subject matter with particularity tends not to survive an early motion.

2. 2

   Restrict access to the people who need it

   Then restrict it in the systems, not just the policy. Role-based permissions on the repository, the drive and the CRM. If everyone in the company can open it, the argument that it was kept secret is being made against your own access logs.

3. 3

   Mark the material

   Confidentiality legends on documents, headers on exports, watermarks on anything that leaves. Marking is weak evidence on its own and strong evidence in combination — it shows the designation existed before the dispute rather than being invented for it.

4. 4

   Paper the people, including the ones you forget

   Employees, contractors, interns, advisers, suppliers, the developer who set up the staging server. A confidentiality obligation in the employment contract covers staff; everyone else needs an NDA signed before, not after, the disclosure.

5. 5

   Run an exit process

   A departure interview that reminds the leaver of the obligation in writing, a certificate that company material has been returned or deleted, and access revoked the same day. Most misappropriation is not espionage — it is a departing employee taking the files they used every day, because nobody told them not to.

6. 6

   Review it on a schedule

   Once a year, against the schedule you wrote in step one. Information moves: a secret gets published in a pitch deck, a process ends up in a support article, a dataset is shared with a partner. Anything that has escaped is no longer a trade secret and should come off the list.

Secrecy or a patent — you cannot have both

The trade-off is genuinely two-sided, which is why the answer varies by industry rather than by principle. A manufacturing process inside your own factory can stay secret indefinitely. A mechanism inside a device you ship to customers is discoverable by anyone with a screwdriver, and secrecy protects it only until the first competitor buys one. Trademark, copyright or patent sets out how the four regimes divide up a single product.

What a trade secret does not stop

Misappropriation means acquiring the secret by improper means — theft, bribery, misrepresentation, breach of a duty to maintain secrecy, espionage — or using or disclosing it without authorisation. Two things are expressly outside that.

Is a customer list a trade secret?

Sometimes, and the distinction is worth understanding because this is the most frequently litigated category in the whole subject. Customer lists appear in the standard list of examples, so the category is available. Whether a particular list qualifies turns on the second element: is it readily ascertainable by proper means?

A list of the businesses in your sector within a region, assembled from a directory, is not. Anyone could rebuild it in an afternoon. A list carrying the buying cycle, the negotiated pricing, the decision-maker's history and the reason each account churned is a different asset, because the value is in the accumulated observation rather than the names — and that is not readily ascertainable by anyone.

The practical version of the question: if a competitor had to reconstruct this from public sources, how long would it take and would they end up with the same thing? Where the honest answer is "a week, and yes", the claim is weak whatever the CRM export is labelled.

The notice US contracts keep leaving out

This one is specific, mechanical and widely missed. Federal law gives individuals immunity for disclosing a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law, and for disclosure in a document filed under seal in a proceeding.

The consequence for employers is a drafting obligation. Any contract or agreement with an employee — and the requirement is read to reach contractors and consultants — that governs the use of trade secrets or other confidential information must contain notice of that immunity. It can be satisfied by cross-referencing a written reporting policy provided to the person rather than reciting the notice in full.

While you are there, check that the confidentiality clause does not purport to prevent lawful reporting to regulators. That is a separate problem, and a clause attempting it is void in many places and actively damaging to the rest of the agreement. Mutual vs one-way NDAs covers the six clauses that decide whether a confidentiality agreement is worth signing at all.

Where programmes break in practice

• The departing employee. Files copied to personal cloud storage in the last fortnight of employment, usually without any sense of wrongdoing. Access revocation on the day and a written reminder solve most of it.
• The demo. Showing the working system to a prospect who has not signed anything, because the deal felt close. Disclosure without protection to someone who could make commercial use of it is precisely the floor the standard sets.
• The supplier drawing. Specifications sent to a manufacturer with no confidentiality term, then quoted to the same manufacturer's other customers. Where real know-how is moving, a technology transfer agreement does the work an NDA alone cannot.
• The pitch deck. Numbers, unit economics and process detail circulated to a wide list, forwarded onward, and later described in a claim as a closely guarded secret.
• The tool nobody audited. A shared drive, a support desk, a project board where the permissions were set once in year one and never revisited.

None of these is exotic and none is fixed by better drafting. The pattern is the same in each case: the information left the perimeter through an ordinary commercial act nobody thought to route through the process. Which is the real reason to keep the written schedule current — not because a court will ask for it, but because maintaining it is the only routine that makes anyone look at where the material has got to.

The honest summary

Trade secrecy is cheap to hold and expensive to prove. Nothing about it is administrative in the way a registration is: there is no moment at which you have finished. The right is a description of your own conduct, assessed after the fact, and the difference between a claim that works and one that does not is usually a handful of unglamorous habits maintained for years before anybody needed them.