Protecting Trade Secrets and Handling a Departing Employee: A Practical Checklist

Intellectual Property > Trade Secrets and Restrictive Covenants | Published 26 March 2025 - Updated 19 July 2026 | UpLaw - uplaw.us

⚠ Preserve before you accuse, and image before you reissue. ⭐ A laptop wiped and handed to the next hire destroys the case, and a demand letter sent before the forensic review may have to be retracted.

Use with Trade Secrets and Restrictive Covenants: A Comprehensive Guide to Protection, Enforcement, and Defense and The Trade Secret and Restrictive Covenant Toolkit.

---

Phase 1 — Identify what actually qualifies

☐ ⚠ Do not designate everything confidential. ⭐ A company that claims everything has claimed nothing, and courts say so.

☐ List the information that genuinely meets both elements of 18 U.S.C. § 1839: reasonable measures to keep it secret, and independent economic value from not being generally known or readily ascertainable.

☐ Candidates: formulas and recipes · process parameters · source code and algorithms · model architectures and training data compilations · ⭐ negative know-how — what was tried and failed · customer lists with non-public detail · pricing, discount authority, and margins · supplier terms · business and expansion plans · designs and prototypes · financial models.

☐ Not candidates: ⚠ general skill and knowledge · public information · anything readily ascertainable by proper means · anything you published, presented, or demonstrated without restriction.

☐ For a customer list, ask the real question: ⭐ Does it hold non-public accumulated knowledge — purchase history, renewal dates, decision-maker preferences, pricing, margins — or just names anyone could compile?

☐ Document the value: development cost, competitive advantage, licensing history, what a competitor would need to replicate it.

---

Phase 2 — Build the reasonable measures

⭐ This phase decides most cases. Do it before anything happens.

☐ Classify — public · internal · confidential · restricted. ☐ Mark — confidentiality legends on documents, headers on files, classification tags in the document system. ☐ Restrict access by role. ⚠ "Everyone can open the shared drive" loses the case. ☐ Review permissions on every role change, and remove them promptly. ☐ Log access and downloads, and ⭐ retain the logs at least a year — ⚠ a ninety-day window destroys evidence in a matter discovered at month four. ☐ Secure physical spaces, control visitors, and adopt a clean-desk practice for restricted material. ☐ Encrypt devices and require multi-factor authentication. ☐ Train, and keep attendance records. ⭐ Training records are direct evidence of reasonable measures. ☐ Review before publication — any paper, conference talk, marketing description, or demo that touches a protected process. ⚠ Disclosure is permanent and irreversible. ☐ Request confidential treatment for regulatory submissions — Ruckelshaus v. Monsanto Co., 467 U.S. 986, confirms trade secrets are property, but the protection depends on the submission being made in reliance on confidentiality. ☐ Audit annually, and document the audit.

---

Phase 3 — The agreements

☐ Confidentiality agreement with everyone — employees, contractors, consultants, vendors, partners, and anyone shown anything in diligence.

☐ ⭐ Include the 18 U.S.C. § 1833 whistleblower immunity notice in every agreement governing trade secrets or confidential information.

• ☐ ⚠ Omitting it bars exemplary damages and attorney's fees against that person under 18 U.S.C. § 1836
• ☐ ⭐ "Employee" includes contractors and consultants
• ☐ The notice may cross-reference a policy document setting out reporting procedures

☐ Define confidential information by category, with carve-outs for public information, independent development, rightful third-party receipt, and legally compelled disclosure.

☐ ⚠ Carve out wages, hours, and working conditions. Overbroad confidentiality and non-disparagement terms can interfere with protected concerted activity under 29 U.S.C. § 157, and interference is an unfair labor practice under 29 U.S.C. § 158 — ⭐ for most non-supervisory employees, union or not.

☐ ⚠ Include nothing that could be read to bar reporting to a government agency.

☐ Invention assignment, with a prior-inventions schedule completed at hire, ⚠ subject to the state statutes excluding inventions developed entirely on the employee's own time and resources and unrelated to the business.

☐ Return-of-property and certification obligations on termination.

☐ Vendor and partner NDAs before disclosure, with marking, return, and destruction obligations.

---

Phase 4 — The covenants

☐ Understand what each instrument actually does:

Instrument	Enforceability
Confidentiality	⭐ Enforceable nearly everywhere; indefinite for true trade secrets
Customer non-solicitation	Generally enforceable if narrowly drawn
Employee non-solicitation	Generally enforceable; ⚠ increasing scrutiny
Non-compete	⚠ Void in several states; heavily restricted in many; disfavored everywhere
Garden leave	⭐ More enforceable — the employee is paid

☐ ⭐ Lead with confidentiality plus customer non-solicitation. The non-compete is the blunt instrument.

☐ Where a non-compete is used, confirm:

• ☐ The state permits employee non-competes at all
• ☐ Any wage or income threshold is met
• ☐ Any advance notice period before signing is honored — commonly ten to fourteen days
• ☐ It was delivered with the offer where the state requires it
• ☐ Consideration is sufficient — ⚠ continued at-will employment is not enough in many states for a mid-employment covenant
• ☐ Duration matches how long the information stays useful
• ☐ Geography matches where the employee actually worked
• ☐ Activity scope matches what the employee actually did
• ☐ There is a genuine protectable interest — ⚠ "we do not want her there" is not one
• ☐ No occupation-specific ban applies

☐ ⚠ Know the state's overbreadth rule, because it changes the drafting:

• ☐ ⭐ Reformation — the court rewrites to reasonable terms
• ☐ ⭐ Blue pencil — the court strikes words if the rest still reads; draft in severable clauses
• ☐ ⚠ Red pencil / all-or-nothing — the court voids the whole covenant; an overbroad covenant is no covenant

☐ ⚠ Do not use one national template across all three regimes.

☐ Draft choice of law and forum knowing they may not hold — ⚠ employee-protective states increasingly void out-of-state forum selection.

☐ ⚠ NEVER agree with another employer not to solicit or hire each other's employees. ⭐ That is an antitrust exposure, potentially criminal — categorically different from an employee's own non-solicit.

☐ Review existing covenants against current law — ⭐ this area has moved repeatedly, including under the federal competition authorities at 15 U.S.C. § 45 and 15 U.S.C. § 57a.

---

Phase 5 — Onboarding

☐ Instruct every new hire in writing: bring nothing from a prior employer, use nothing, and return anything discovered. ☐ Obtain a signed acknowledgment. ☐ Ask about existing restrictions and get copies of the agreements. ☐ Have counsel review them under the governing state's law. ☐ ⚠ Never ask a new hire or candidate for a former employer's information — not the pricing, not the client list, not the operational detail. ⭐ An interviewer's curiosity becomes the plaintiff's best exhibit. ☐ Structure the role to avoid covered accounts, products, or territory for any enforceable restricted period. ☐ Complete the prior-inventions schedule. ☐ Deliver training and record attendance.

---

Phase 6 — The first seventy-two hours after a resignation

Hour one — preserve ☐ ⭐ Forensically image the laptop, phone, and every company device BEFORE reissuing. ☐ Suspend the mailbox; do not delete it. ☐ Preserve VPN, badge, email, file access, and print logs before retention policies rotate them. ☐ Issue a litigation hold — see Issuing a Litigation Hold and Preserving ESI: A Practical Checklist.

Day one — close access ☐ Email, VPN, cloud storage, repositories, CRM, ticketing, badge, and any shared vendor accounts ☐ Change shared credentials the employee knew ☐ Remove from distribution lists and internal directories ☐ Check for personal cloud sync installed on company devices

Day two — gather ☐ Pull ninety days of access and download logs ☐ Device and property inventory, signed ☐ Exit interview, documented:

• ☐ Review each agreement clause by clause
• ☐ Ask what company information is retained anywhere, including personal devices, personal email, and cloud accounts
• ☐ Ask where the person is going and in what role
• ☐ ⭐ Obtain a written certification that all company information has been returned or destroyed ☐ Reminder letter enclosing the agreements and stating the surviving obligations

Day three — investigate ☐ Forensic review of the images and logs, looking for:

• ☐ ⭐ Download or copy volume spikes in the final weeks
• ☐ USB device connections and what was written
• ☐ ⚠ Email forwarding to personal addresses
• ☐ Personal cloud sync activation
• ☐ Print volume spikes
• ☐ Repository cloning
• ☐ Access to files outside ordinary work
• ☐ ⚠ Deletion or wiping immediately before departure
• ☐ Access after the resignation was tendered
• ☐ Communications with the new employer during employment ☐ ⚠ Consider innocent explanations honestly — a routine backup, a synced folder, a legitimate archive. Volume alone is not the answer; pattern, content, and timing are. ☐ ⚠ Do not accuse anyone before this review is complete.

---

Phase 7 — Deciding what to do

☐ ⭐ Answer the question clients skip: what outcome do you actually want?

• ☐ The information returned and deleted, with certification
• ☐ A limited restriction on specific accounts or a specific product area
• ☐ A promise not to solicit named customers
• ☐ Deterrence — a clear signal to the rest of the workforce
• ☐ Money

⚠ This single question determines whether the matter costs five thousand dollars or five hundred thousand.

☐ Grade the evidence honestly: strong forensic proof of taking · circumstantial timing only · nothing but suspicion.

☐ Assess the covenants under the governing state's law before threatening anything.

☐ Consider notifying the new employer — ⚠ carefully. ⭐ A measured letter usually causes the new employer to impose its own guardrails. An overreaching one is tortious interference.

☐ Send a proportionate demand letter: identify the agreements, identify the specific evidence, state what you want, give a reasonable deadline, and ⚠ include a preservation demand.

☐ Consider a negotiated protocol instead of litigation: forensic imaging by a neutral examiner · deletion and certification · a limited restriction for a defined period · a modest payment. ⭐ This achieves more in six weeks than litigation achieves in two years, and it does not publicize the secret.

☐ If seeking an injunction:

• ☐ ⚠ Remember 18 U.S.C. § 1836 bars an order prohibiting employment — conditions must rest on evidence of threatened misappropriation, not on what the person knows
• ☐ Ask for what a court will grant: return, forensic imaging, deletion and certification, and a restriction on specific accounts or products
• ☐ Consider the reasonable royalty alternative the statute permits in exceptional circumstances
• ☐ ⚠ Ex parte seizure is available only in extraordinary circumstances, and a wrongful seizure carries its own damages action

☐ ⚠ Watch the limitations period — commonly three years from discovery, with continuing misappropriation treated as one claim.

☐ ⚠ Remember fees run both ways. A claim brought in bad faith supports a fee award against you.

---

Phase 8 — Litigating without destroying the secret

☐ Identify the asserted secrets with particularity — ⭐ in a sealed, confidential identification, not in a public complaint. ⚠ Too broad invites a public-domain defense; too narrow may exclude what was taken. ☐ Move immediately for a protective order with an attorneys'-eyes-only tier. ☐ File under seal where permitted; prepare redacted public versions. ☐ Limit expert access and require confidentiality undertakings. ☐ Consider in camera review and a special master for technical disputes. ☐ In criminal proceedings, invoke 18 U.S.C. § 1835. ☐ Address return or destruction at the conclusion, with certification. ☐ ⚠ Plead the trade secret claim, not the computer statute. 18 U.S.C. § 1030 has been narrowed and does not reach misuse of information the person was authorized to access. ☐ Consider criminal referral under 18 U.S.C. § 1832, or 18 U.S.C. § 1831 where a foreign government benefits, with forfeiture under 18 U.S.C. § 1834 and extraterritorial reach under 18 U.S.C. § 1837. ⚠ Referral takes the matter out of your control. ⭐ State remedies remain available — 18 U.S.C. § 1838.

---

Phase 9 — Defending a claim

☐ Attack reasonable measures — ⭐ the strongest defense. No marking, unrestricted access, no agreements, no exit process, information shared with customers or vendors without protection. ☐ Attack value and secrecy — published, disclosed at conferences, visible in the product, available from public sources, readily ascertainable. ☐ Demand identification with particularity and move to compel early. ☐ Establish independent development with a contemporaneous record — ⭐ documented development history is the strongest affirmative defense. ☐ Establish reverse engineering from a lawfully obtained product — ⭐ expressly excluded from improper means, and grounded in Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470. ☐ Establish general skill and knowledge. ☐ Attack the covenant on scope, consideration, notice requirements, and the state's overbreadth rule. ☐ Raise the limitations period. ☐ Consider 18 U.S.C. § 1833 immunity where disclosure was in confidence to counsel or a government official to report a suspected legal violation, or in a sealed filing. ☐ ⭐ Consider a bad-faith fee claim. ☐ Consider a declaratory judgment action in a favorable forum — ⚠ forum matters enormously, and the first filer often chooses it.

---

If you are the one leaving

☐ ⭐ Take nothing. Not one file. ⚠ "I created it" is not a defense — work in the scope of employment belongs to the employer. ☐ ⚠ Forward nothing to a personal email address, at any point. ☐ Connect no USB drive in your final weeks. ☐ Install no personal cloud sync on a company device. ☐ ⚠ Delete nothing and wipe nothing. Deletion looks worse than whatever you were deleting. ☐ Do not solicit colleagues or customers while still employed — that breaches the duty of loyalty independent of any covenant. ☐ Get copies of every agreement you signed before you resign. ☐ Get advice on the governing state's law. ☐ ⭐ Tell the new employer what restrictions exist. A new employer that knows can structure the role. One that learns from a demand letter tends to withdraw the offer. ☐ Return everything and get a written receipt. ☐ Keep your own record of what you returned and when. ☐ ⭐ Know that 18 U.S.C. § 1833 immunity covers confidential disclosure to counsel or a government official for reporting a suspected violation — ⚠ but it does not authorize taking documents home, posting them, or giving them to a competitor.

---

Common mistakes

⚠ Designating everything confidential, and therefore nothing. ⚠ Unrestricted access to the crown jewels. ⚠ Ninety-day log retention. ⚠ Omitting the 18 U.S.C. § 1833 notice — forfeiting exemplary damages and fees. ⚠ One national covenant template. ⚠ A nationwide restriction on a regional role. ⚠ Reissuing the laptop before imaging it. ⚠ Accusing before investigating. ⚠ Building the case on 18 U.S.C. § 1030. ⚠ Filing a public complaint that describes the secret. ⚠ Asking a new hire what their old employer charged. ⚠ Agreeing with a competitor not to hire each other's employees.

---

Authority quick reference

Authority	Use it for
18 U.S.C. § 1839	⭐ Definitions — the two elements and "improper means"
18 U.S.C. § 1836	Private civil action; injunctions; ⚠ no employment prohibitions; seizure; damages; fees both ways
18 U.S.C. § 1833	⭐ Whistleblower immunity and the notice requirement
18 U.S.C. § 1832	Criminal theft of trade secrets
18 U.S.C. § 1831	Economic espionage
18 U.S.C. § 1834	Criminal forfeiture
18 U.S.C. § 1835	Preserving confidentiality during proceedings
18 U.S.C. § 1837	Extraterritorial application
18 U.S.C. § 1838	⭐ State remedies preserved
18 U.S.C. § 1030	⚠ Computer access — narrowed; do not build the case on it
15 U.S.C. § 45	Unfair methods of competition
15 U.S.C. § 57a	Federal rulemaking authority
29 U.S.C. § 157	⚠ Protected concerted activity
29 U.S.C. § 158	Unfair labor practices
Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470	⭐ Reverse engineering is lawful
Ruckelshaus v. Monsanto Co., 467 U.S. 986	Trade secrets as property; government disclosure

⚠ State law supplies the covenant rules — enforceability, thresholds, notice periods, and the overbreadth approach — and it varies more here than in almost any other commercial area. ⭐ Check the governing state before drafting or threatening anything.

---

The five-minute triage

When the call comes that someone has resigned for a competitor, answer these five questions before doing anything else.

1. ⭐ Have the devices been preserved and imaged? If not, do that now, before anything else.
2. What do the last ninety days of access and download logs show?
3. What did this person actually have access to, and was any of it marked and restricted?
4. What agreements did they sign, and does the governing state enforce them?
5. ⭐ What outcome do we actually want?

⚠ If you cannot answer question one in the affirmative, nothing else on this list will matter.

---

The annual audit

Once a year, an hour, and it is the cheapest insurance available.

☐ Re-run the secrets inventory. ⭐ What is new? What is no longer secret because it was published, demonstrated, or built into a shipped product? ☐ Spot-check marking and classification on a sample of restricted documents. ☐ Review access permissions against current roles, and remove stale access — ⚠ departed contractors and former team members retain access far more often than anyone expects. ☐ Confirm log retention is at least a year and that logs are actually being written. ☐ Confirm every current employee, contractor, and vendor has a signed agreement on file — ⭐ and that each contains the 18 U.S.C. § 1833 notice. ☐ Review covenant templates against current state law, jurisdiction by jurisdiction. ☐ Confirm the exit process was followed for everyone who left in the last year, including whether devices were imaged. ☐ Deliver training and record attendance. ☐ Review anything published or presented in the last year against the secrets inventory. ☐ Test the incident response: who images the laptop, who pulls the logs, who calls counsel, and how fast?

⭐ Every item is evidence of reasonable measures, which means the audit is simultaneously the prevention and the proof.

---

Related Documents

• Trade Secrets and Restrictive Covenants: A Comprehensive Guide to Protection, Enforcement, and Defense
• What Walks Out the Door: Trade Secrets, Non-Competes, and the Employee Who Leaves
• The Trade Secret and Restrictive Covenant Toolkit
• You Made It, So You Own It: What Copyright Actually Protects and What It Does Not
• Registering, Licensing, and Enforcing a Copyright: A Practical Checklist
• The Copyright Registration and Enforcement Toolkit
• Clearing, Registering, and Policing a Trademark: A Practical Checklist
• The Trademark Clearance and Enforcement Toolkit
• At Will Does Not Mean For Any Reason: What Actually Makes a Firing Unlawful
• Issuing a Litigation Hold and Preserving ESI: A Practical Checklist
• Filing and Pursuing an Employment Discrimination Charge: A Practical Checklist
• The Data Privacy and Breach Response Toolkit