Protection of trade secrets: Why this is important

In the modern economic context, information is key to competitiveness of businesses. Providing efficient protection of information that constitutes a trade secret is one of the major factors of business success. Trade secrets include various information of high commercial value, such as technological solutions, financial data, marketing strategies, and customer bases. Leakage of this data can cause significant damage to a company; therefore protection of trade secrets becomes a priority for any business.

Below, we will explore the issues of legal protection of trade secrets in Russia and other parts of the world, as well as practical methods to safeguard them and ways to minimize the information loss and disclosure risk.

Trade secret is a set of information that is significantly valuable for a business and is not subject to public disclosure. It may include know-hows, marketing strategies, financial data, customer bases, product solutions, and other data that determine the company’s competitive advantages.

The main characteristics of a trade secret are:

• Sensitivity. This is the key characteristic of a trade secret, meaning that information must not be made publicly available or easily available to third parties. Sensitive data is not subject to disclosure both within and outside the company.  Protection measures may be legal, technical and organizational. The owner of such information should take active steps to ensure it is kept in confidence, otherwise it can lose the trade secret status.
• Valuable nature. Information considered a trade secret must have a real or potential economic value. It may help the company to gain advantages in the market, reduce costs, improve its products or services, or develop new technologies. Another important aspect is that this information must benefit its owner only, and not be publicly available and generally accepted in the industry.  Only in this case, measures to protect business information and trade secrets will be relevant.
• Identification. In order for information to be considered a trade secret, its owner must clearly identify it as such. This involves documentation along with the development and implementation of internal regulations and procedures for its protection. Without a clear definition and identification of a trade secret, such data may be lost or misused. The owners must proactively manage its protection, including monitoring and access control.

Trade secret protection arrangements are relevant for the following kinds of information:

1. Know-hows: Technological processes, formulations and production methods that determine the company’s advantages in the market.
2. Marketing strategies: Marketing campaign plans, market analyses, and target audience data based on which competitors can have an idea of the company’s strategy.
3. Financial data: Income and expense reports, budgeting plants, and sales forecasts that can be used for economic analysis of the company.
4. Customer bases: Lists of customers, their preferences, contracts and other information that helps retain existing customers and acquire new ones.
5. Product development projects: Drawings, prototypes, plans for the creation of new products and services that are under development and are not subject to public disclosure.

Thus, a trade secret is a wide range of information that has an economic value and needs to be proactively protected by the owner. Protection of trade secret rights is one of the major aspects in the creation of fair competition in various industries.

In Russia, the legal framework to govern the protection of documents and other trade secret items includes the following legal acts: 

• The Civil Code of the Russian Federation which contains the general provisions on trade secrets.
• Federal Law “On Trade Secrets” (No. 98-FZ dated July 29, 2004) which defines a trade secret, establishes the rights and duties of the parties, and information protection measures.

According to the Russia laws, information shall be treated as a trade secret if it has a real or potential commercial value due to being unknown to third parties, if there is no free legal access to it, and the owner of the information takes measures to safeguard its confidentiality. 

In international practices, the system of trade secret protection is governed by the following basic documents: 

• TRIPS (the Agreement on Trade-Related Aspects of Intellectual Property Rights) which establishes the standards of trade secret protection to be observed by the WTO member states.
• Directive (EU) 2016/943 of the European Parliament and of the Council designed to unify the legislation in the EU countries in terms of trade secret protection measures.

The majority of developed countries, such as the United States, the United Kingdom, and Germany, have their own national laws that provide for secure trade secret protection technologies and impose significant penalties for unlawful disclosure. Experts at SEVEN SENSES help owners of international companies and those intending to open branches or divisions in other jurisdictions to take into account the legal intricacies of data protection.

In order to meet trade secret protection challenges in the most efficient way, comprehensive measures, including legal support of trade secrets, as well as organizational and technical arrangements, need to be taken to prevent unauthorized access to and leakage of sensitive data.

The fundamental legal protections for trade secrets include:

1. Non-disclosure agreements (NDAs). Entering into Non-Disclosure Agreements (NDA) is one of the key legal measures to protect trade secrets. These agreements are made with employees, business partners, contractors and other persons who may have access to sensitive information. NDAs stipulate non-disclosure obligations and liability for failure to comply.
2. Access regulation. The company’s internal regulations should have clear procedures for access to sensitive data. These may include access levels for different staff categories, procedures for gaining access to confidential information, penalties for non-compliance with regulations, and patent protection. Patent is often included in the legal framework for the protection of trade secrets as it protects the invention legally and grants the owner exclusive rights to use it, thereby preventing competitors from unauthorized using or replicating technology solutions.

Organizational protections for trade secrets may be as follows:

1. Staff training. Regular skills workshops for employees and briefings on protection of sensitive data play an important role in the protection of trade secrets. Training must cover the fundamentals of information safety, sensitive data treatment rules, measures to prevent data leaks and breaches, and liability for failure to comply with the privacy policy.
2. Information classification. Development of a system for data classification by privacy level helps to structure information and determine what data require enhanced protection. This may involve defining information categories and establishing category-specific rules, including restrictions on copying, transfer, and storage of data.
3. Information security policy. The development and implementation of an information security policy should be part of the basic arrangements for the protection of trade secrets and cover the definition and rules of protection of sensitive data, access control procedures, and action plans for data breach incidents. This organizational measure for the protection of trade secrets is better entrusted to professionals. The SEVEN SENSES team will help you put it in place as part of our Comprehensive Corporate Security Development and Implementation service. Contact us and tell us about your business, and we will help you determine which protection measures are most suitable to you.

Technical protection of trade secrets involves:

1. Data encryption. Using modern encryption methods to protect electronic data is an effective way to prevent unauthorized access to it. Encryption should be used when transmitting data over a network or storing them on devices.
2. Access control systems. The deployment of user authentication and authorization systems ensures that only authorized persons have access to sensitive data. These systems may include multi-factor authentication, as well as role and access rights management. 
3. Monitoring and audits. Regular monitoring and audits of information systems for data security and protection help identify and address vulnerabilities, as well as monitor compliance with the applicable rules. These may include analysis of logs and security events, as well as internal and external audits. 
4. Pentesting to find potential threats. This service is also available at SEVEN SENSES — you can order it for an expert analysis of all weaknesses of your security system.
5. Physical infrastructure protection. Physical protection of facilities and devices that store sensitive data is also important. This involves using safes and locked cabinets for storing paper documents, access control to offices, and installation of CCTV and security systems.

In general, the procedure for trade secret protection must be comprehensive, as only in this case it will be as secure as possible. This requires that efforts are coordinated between the company’s different divisions and security procedures are improved on a continuous basis and adapted to new threats. A comprehensive approach helps minimize the risk of data leaks and breaches and maintain competitive advantages of your company.

In business, trade secret protection measures can involve the following practices:

• Security policy. This involves the development and implementation of an information security policy including procedures for sensitive data treatment, rules for the usage of corporate resources, and non-compliance penalties. As was mentioned earlier, we are always ready to help you with this.
• Access restriction. This involves setting up an access mediation system on the basis of the least privilege principle where an employee only has access to information that he or she needs for the fulfillment of their job duties.
• Use of modern technology. This involves the deployment of up-to-date information security tools, such as virtual private networks (VPN) for secure remote access to corporate resources by employees or data loss prevention (DLP) systems to monitor transmission and use of sensitive data. 
• Document protection. This may be both physical (using safes, locked cabinets and other means for storing paper documents) and electronic (passwords, digital certificates and other means for protecting electronic documents).
• Risk management. It is very important to analyze risks and vulnerabilities on a regular basis, develop and update incident response plans for confidentiality breaches. 
• Relationship management. This includes entering into detailed non-disclosure agreements with business partners and vendors, providing for compliance with trade secret protection principles and liability for disclosure.

Thus, legal, organizational and technical measures for the protection of trade secrets are an important aspect of successful business and require a comprehensive approach. They help reduce the risk of data leaks and breaches to the minimum and maintain competitive advantages of the business.

Apart from the actual implementation of trade secret protection methods on-site, it is essential to build a corporate culture where every employee is aware of the significance of sensitive data and their role in keeping it in confidence.  This involves regular training, awareness raising, and developing clear policies for information security.

In the end, a comprehensive and multi-level approach to the protection of trade secrets not only protects valuable data from competitors, but also strengthens the company’s position in the market in general, contributing to its sustainable development and growth.