Checklist · Intellectual Property

Protecting Trade Secrets When Employees Leave: A Practical Checklist

Type
Checklist
Jurisdiction
National
Date
2026-02-10
Topic
Intellectual Property

The days between an employee's resignation and last shift are the highest-risk interval in the entire life of a trade secret, because a departing insider still holds the keys and may now have a reason to use them. This checklist walks counsel, HR, and IT through a disciplined offboarding built to survive later litigation: triaging risk the moment notice lands, recovering property and extracting a specific written deletion confirmation, revoking access across every system rather than just the laptop, conducting an exit interview that produces signed evidence, sending a continuing-obligations letter with provable delivery, and, when a departure looks wrong, preserving perishable forensic evidence before anyone contaminates it. It draws the load-bearing legal line between an employee's portable skill and the company's protectable secrets, explains why the inevitable-disclosure doctrine is a weak foundation, and maps the DTSA and UTSA remedies that a clean record makes available, from a preliminary injunction to exemplary damages and fees. The recurring theme is documentary: access logs, signed acknowledgments, a proven-delivered letter, and a forensic image built the right way are the exhibits that decide misappropriation cases.

Protecting Trade Secrets When Employees Leave: A Practical Checklist

Intellectual Property > Trade Secret | Published 10 February 2026 - Updated 19 March 2026 | UpLaw - uplaw.us

Most trade secret cases are won or lost in a window of a few weeks. This checklist turns the departure of a knowledgeable employee into a documented, defensible process — one that either deters the theft outright or builds the record that proves it — and it explains the law that makes each step matter.

Keywords: departing employee, employee offboarding, trade secret protection, exit interview, continuing obligations letter, access revocation, forensic imaging, litigation hold, spoliation, deletion confirmation, DTSA, inevitable disclosure, non-solicitation, Section 1833(b) notice, personal devices, misappropriation

A company can spend a decade classifying its secrets, restricting access, and papering every relationship, and still lose the whole investment in the ten days between an engineer's resignation email and the return of her badge. That interval is where trade secret protection is actually tested. The employee still has legitimate credentials, still knows exactly where the valuable files live, and — if she is leaving for a competitor or to start something of her own — now has a motive she did not have last month. Handle those days with discipline and you either deter the misappropriation or capture the proof of it. Handle them carelessly and you can watch a court refuse to help you against a theft you can practically see.

This resource is the departure-side companion to the front-end work covered in standing up a trade secret protection program and the periodic discipline of auditing your trade secrets. For the doctrine and the distributed-workforce dimension that now complicates every offboarding, see guarding trade secrets without a perimeter and the broader map in trade secret law: how secrecy becomes protectable intellectual property. What follows assumes those programs exist; it addresses what to do when someone who has been inside them walks out.

The one legal line that governs everything

Before any checkbox, internalize the line that a court will draw whether or not you ask it to. An employee is free to take her general skills, knowledge, training, and experience to a competitor or a new venture. What she may not take is her former employer's specific, identifiable trade secrets. The Defend Trade Secrets Act protects information that (a) the owner has taken reasonable measures to keep secret and (b) derives independent economic value from not being generally known. 18 U.S.C. § 1839(3). The Uniform Trade Secrets Act, adopted in forty-nine states (New York is the holdout, still on common law), uses a materially similar definition. Neither protects the fact that your departing sales director has, over eight years, become excellent at selling.

Everything in a clean offboarding is really an effort to make that line easy for a judge to draw in your favor. The more clearly you marked the specific secret, restricted it to people who needed it, and documented who touched it, the more concrete "the trade secret" becomes — and the harder it is for the departing employee to reframe your crown jewels as her own hard-won intuition. Judge Posner's classic formulation still governs the intuition behind reasonable measures: perfect secrecy is not required, but the owner must take precautions proportionate to the value of the secret and the cost of protecting it. Rockwell Graphic Sys., Inc. v. DEV Indus., Inc., 925 F.2d 174, 179-80 (7th Cir. 1991). Offboarding is one of those precautions, and one courts increasingly expect to see.

Keep a second principle in view as well. Trade secret protection has always coexisted with a strong public policy favoring employee mobility and the free flow of skill between employers. See Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470, 481-82 (1974). Courts are wary of employers who use "trade secret" as a synonym for "everything my former employee learned here." The remedy for that suspicion is specificity, and specificity is built at the exit.

How to use this checklist

The phases below run in rough chronological order, from the moment notice is given through, if it comes to it, litigation. Not every departure needs every step — a warehouse associate leaving for an unrelated job does not warrant a forensic image. The triage in Phase 1 tells you how far down the list to go. Treat the checkboxes as a defensible baseline and the surrounding analysis as the reason each one earns its place in the record.

Phase 1: Triage the departure the moment notice lands

  • [ ] Classify the risk the same day notice is given: routine departure to a non-competing role, or departure to a direct competitor (or a stealth startup) under circumstances that reward suspicion.
  • [ ] For high-access employees, act immediately — sometimes with same-day access revocation, sometimes, where an abrupt cutoff is operationally impossible, with heightened monitoring through the notice period.
  • [ ] Pull and preserve the employee's recent access, download, print, and email-forwarding logs to fix a baseline of what "normal" looked like before notice.
  • [ ] Convene HR, IT, security, and legal at the outset and assign one owner. The single most common operational failure is the lag between HR learning of the resignation and IT actually changing anything.

Why this matters. Misappropriation clusters in the notice-to-departure window because that is the only moment when access and motive overlap. The access logs are, in most departure cases, the most persuasive evidence in the file: they show a court, in the defendant's own system's neutral voice, exactly what the employee reached for in her final days. A download of the entire customer database, or the full source repository, in the week after resignation — "wildly out of pattern with normal work," as courts describe it — is worth more than any affidavit. The logs are also perishable; many systems roll them over on a fixed window, so preserving them is a Phase 1 task, not a litigation-day afterthought.

Worked example. Meridian Turbine Coatings (hypothetical) learns on a Monday that Priya, a senior process engineer with access to its proprietary thermal-barrier formulations, has resigned to join a direct competitor. HR's instinct is to let her serve a gracious two-week notice. Legal's instinct is better: pull her thirty-day access history that afternoon. The logs show that normal weekly activity for Priya is a handful of formulation-file opens. They also show that on the Friday before her Monday resignation she exported 214 formulation and process files to a folder synced to a personal cloud account at 11:40 p.m. That single log line reframes the entire departure — and it existed only because someone thought to preserve it in Phase 1.

The triage judgment is genuinely a judgment. Same-day revocation for a departing CTO protects the crown jewels but can also tip the employee off and, in a benign departure, sour a relationship you may want later. Where an immediate cutoff is impractical — the person is mid-deployment on a live system, or is a founder-level figure whose sudden lockout would disrupt operations — enhanced monitoring during a shortened notice period is the fallback: the employer preserves access but watches it closely and shortens the runway. Either way, resolve one bias in advance: when in doubt about a high-access, competitor-bound departure, err toward moving faster. The employee who is going to copy the database will do it in the window you leave open.

Phase 2: Recover property and get a deletion confirmation that means something

  • [ ] Collect every piece of company property: laptops, phones, tablets, peripherals, external and USB drives, badges, key fobs, corporate cards, and hard-copy files.
  • [ ] Inventory what the employee had. You cannot confirm the return of a company laptop and two external drives if no one ever recorded that they were issued.
  • [ ] Obtain a written, specific deletion confirmation that company information has been removed from every personal device, personal cloud account, and personal email — and separately ask for the data itself back before it is deleted.
  • [ ] Where your contracts secured the right at onboarding, exercise the right to audit or image personal devices that held company data, rather than accepting a self-certification at face value for a high-risk departure.

Why this matters. Two appellate decisions turn this phase from housekeeping into a secrecy-element issue. In DM Trans, LLC v. Scott, 38 F.4th 608 (7th Cir. 2022), the employer's failure even to ask departing employees to return information residing on their personal devices was part of why it could not show the reasonable measures the DTSA requires. And in Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d 1279, 1300-01 (11th Cir. 2018), the employer had actually encouraged an executive to store sensitive customer and pricing information on his personal phone and laptop and then never reclaimed it; the Eleventh Circuit held that leaving valuable information on devices the company did not control, and never retrieving it, undercut the very secrecy the company sought to protect. The lesson is blunt: information you let live on a device you do not control, and never try to get back, may not be a secret you can enforce at all.

A deletion confirmation is only as good as its specificity. "I have returned all company property" is a sentence a departing employee will sign without reading and a court will read without believing. A useful confirmation identifies the categories of company information the employee is attesting she has deleted (customer lists, pricing models, source code, formulations), names the locations searched (personal laptop, home NAS, iCloud/Google Drive, personal Gmail, messaging apps), and states that the employee has not retained copies in any form. It should be paired, for higher-risk departures, with an actual data return — because a confirmation that files were "deleted" from a personal account, without the company ever seeing them, both destroys potential evidence and forecloses your ability to prove what was there. Ask for the data first; confirm deletion second. For the personal-device architecture that makes this workable, and the BYOD terms that should have been signed years earlier, see guarding trade secrets without a perimeter.

One caution about deletion itself. If the departure is already suspicious, do not rush to have the employee delete anything. Deletion is destruction of evidence, and in a case that is heading toward litigation you would rather have the personal device preserved and imaged than wiped on a promise. Phase 2's deletion confirmation is the tool for ordinary, low-suspicion departures. When the triage in Phase 1 flags a real risk, skip to Phase 6 and preserve.

Phase 3: Kill access everywhere, not just the laptop

  • [ ] Disable network, email, VPN, and remote-desktop credentials at (or before) the effective departure time, coordinated to the minute with HR.
  • [ ] Terminate accounts across every system — cloud drives, code repositories, SaaS tools, CRM, ticketing, design platforms, expense and analytics systems — including the ones that accumulate quietly outside IT's central directory.
  • [ ] Check for and remove email-forwarding rules, auto-forwarding, and delegated mailbox access set up before departure.
  • [ ] Disable access to company systems from any personal device that was enrolled, and revoke API tokens, SSH keys, and saved OAuth grants.
  • [ ] Reclaim or reset shared credentials the employee knew, and rotate any service-account passwords the employee could have used.
  • [ ] Confirm control of company-owned social media and messaging accounts the employee administered.

Why this matters. The perimeter that IT thinks it controls is almost never the whole perimeter. Modern work spreads credentials across dozens of independently provisioned tools, many adopted by a team without a central offboarding hook. A revoked laptop login means nothing if the employee still has a personal-browser session into the code repository, an active API token, or an auto-forward quietly copying every inbound sales lead to a personal address. The forwarding rule is a particular favorite: it is trivial to set up, invisible to a casual review, and it keeps feeding the departed employee current information for weeks. Sweep for it specifically.

Access revocation is also an evidentiary act, not just a security one. The moment you disable credentials, you fix a clean boundary in the logs: everything the employee did up to that timestamp was with authorized access, and any attempt afterward was not. That boundary matters because of how narrow the federal computer-crime statute has become. In Van Buren v. United States, 141 S. Ct. 1648 (2021), the Supreme Court held that the Computer Fraud and Abuse Act's "exceeds authorized access" clause does not reach a person who accesses information he is entitled to obtain but for an improper purpose. 18 U.S.C. § 1030(a)(2). Translated to departures: an employee who downloads files he was allowed to see, even in order to take them to a competitor, may not have violated the CFAA at all — but an employee who logs back in after you cut off access has crossed into unauthorized territory. Revoking access cleanly and promptly both closes the barn door and, if the employee comes back through it, hands you a much stronger CFAA theory alongside the trade secret claim.

Worked example. Cirrus Analytics (hypothetical) offboards a departing data scientist, wipes his laptop login, and considers the job done. Three weeks later, sales reports stop matching the pipeline. IT discovers an inbound-forwarding rule the scientist created in his last week, silently copying every demo-request email to his personal account, and an active personal-device session into the analytics workspace that was never terminated because that SaaS tool was provisioned by the marketing team and never made it onto IT's offboarding list. The information kept flowing for twenty-two days after his "last day." A single afternoon spent enumerating every system he touched — and sweeping for forwarding rules — would have closed both leaks.

Phase 4: The exit interview as evidence, not ceremony

  • [ ] Conduct an exit interview with every departing employee who had access to confidential information — not only the ones you already suspect.
  • [ ] Use a neutral interviewer (HR), not the direct supervisor, which tends to produce more candid answers about where the person is headed and in what role.
  • [ ] Establish and confirm the destination and the new role, review the specific restrictive covenants that survive, and hand the employee copies of the agreements she signed.
  • [ ] Capture a signed acknowledgment that all property has been returned and that continuing obligations are understood; where warranted, present the categories of trade secrets the employee accessed and have her acknowledge them.

Why this matters. The exit interview's real product is not information; it is admissible evidence, generated at low cost, that defeats the two defenses departing employees reach for most. The first is ignorance: "I never understood that material to be confidential." A signed acknowledgment that identifies the categories of protected information the employee handled removes that defense at the root. It also directly reinforces the reasonable-measures element — you are documenting, in the employee's own signature, that the company marked its secrets and told her they were secret. The end-of-employment protocol that trade secret practitioners follow specifically counsels removing "the employee's ability to claim ignorance regarding the employer's interest in preserving the confidentiality of certain materials," and the exit interview is where that happens.

The second defense is I didn't take anything, and you can't prove otherwise. Here the exit interview's value is in what it locks down: a contemporaneous statement of where the employee is going and what she claims to have returned. If she later turns up at a competitor doing exactly what she disclaimed, or if the forensic image contradicts her sworn "I returned everything," the interview becomes an impeachment exhibit. Use a neutral HR interviewer precisely because candor is the point — a departing employee will often tell a sympathetic HR representative things she would never volunteer to the supervisor she is leaving. A model exit questionnaire, run consistently for every departure rather than improvised for suspects, both improves the answers and inoculates against a later claim that the company only scrutinizes employees it plans to sue.

Presenting the categories of accessed trade secrets can feel confrontational, and for a genuinely routine departure it may be overkill. But for anyone leaving a sensitive role, it is excellent evidence. A short schedule — "During your employment you had access to the following categories of confidential and trade secret information: [customer and pricing data]; [source code for the X platform]; [manufacturing process specifications]" — followed by the employee's signature, is nearly dispositive on the "she knew what was protected" question that recurs in every misappropriation trial.

Phase 5: The continuing-obligations letter, delivered so you can prove it

  • [ ] Send a continuing-obligations letter that recites the specific surviving covenants, attaches copies of the signed agreements, and reserves all rights and remedies.
  • [ ] Request a signed acknowledgment of receipt.
  • [ ] Where the employee is bound for a direct competitor, consider a parallel letter to the new employer — carefully, and with an eye on the tortious-interference risk discussed below.
  • [ ] If the letter must go by mail, use certified mail or another method that generates proof of delivery; if by email, use read-receipt and retain the transmission record.

Why this matters. The continuing-obligations letter does two things at once. Prospectively, it removes any argument that the former employee forgot or misunderstood her post-employment duties; the reminder is itself part of the reasonable-measures story a court wants to see. Retrospectively, proof that the letter arrived can matter more than the letter itself. The presumption that a properly mailed letter was received is rebuttable — an affidavit of non-receipt can defeat it — as the Third Circuit explained in the ERISA context in Lupyan v. Corinthian Colleges, Inc., 761 F.3d 314, 319-21 (3d Cir. 2014), contrasting ordinary mail (weak presumption) with certified mail and tracking (strong proof). The doctrine travels: if your reasonable-measures narrative depends on having reminded the departing employee of her obligations, do not let her rebut it with a shrug. Send it in a way that produces a receipt.

The letter to the new employer is a sharper instrument and cuts both ways. Sent well, it signals that you know about the hire, you are watching, and the new employer now has notice of the covenants — notice that is an element of a later tortious-interference claim against that employer. Sent badly, on thin facts, it can itself trigger a tortious-interference counterclaim if the new hire is fired or disciplined because of an inaccurate letter, and it can prematurely tip off the very person you might otherwise catch. Substantiate before you send. The standard cease-and-desist letters that practitioners use for former employees and new employers are deliberately measured for exactly this reason. For the anatomy of a letter that is firm, accurate, and legally safe, see writing an effective demand letter and the discussion of settlement-privilege and delivery-proof pitfalls in drafting an effective demand letter.

Phase 6: When the departure looks wrong, preserve before you look

This is the phase that separates companies that win misappropriation cases from companies that had winning facts and destroyed them. The evidence in a departing-employee case is uniquely perishable, and the most common way it is lost is not malice but a well-meaning IT manager or supervisor "just checking the laptop." Once triage or the access logs flag a real problem, the order of operations is preserve, then investigate — never the reverse.

  • [ ] Immediately suspend any auto-deletion, re-imaging, or device-wipe routine that could touch a device you may need. Companies routinely re-image a departed employee's laptop within 30 to 90 days; a calendar reminder somewhere is quietly counting down toward the destruction of your best exhibit.
  • [ ] Issue a litigation hold the moment litigation is reasonably anticipated, and suspend routine deletion across all relevant sources, including ephemeral and collaboration-tool data (Slack, Teams, iMessage).
  • [ ] Do not power the device on and off repeatedly or let an untrained person browse it. Both alter metadata and can destroy the very artifacts — deletion timestamps, USB-insertion records, file-access history — that prove the case.
  • [ ] Engage a qualified forensic e-discovery vendor to create a complete forensic image of the critical devices before anyone searches them; investigate the image, not the original.
  • [ ] Capture credentials and encryption keys, label and secure the physical devices, and maintain a documented chain of custody for everything.
  • [ ] Run the investigation under counsel so it is privileged and steered toward the facts that will actually matter, and continue monitoring the market for a few months, because departing employees often take time off before competing.

Why this matters. The duty to preserve relevant evidence attaches once litigation is reasonably anticipated — a standard the leading authority, Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 216-18 (S.D.N.Y. 2003), fixed for the ESI era, and one that a demand letter or an internal decision to investigate can trigger. See Sonrai Sys., LLC v. Romano, 2021 WL 1418405, at *10 (N.D. Ill. Jan. 20, 2021) ("a demand letter threatening litigation may trigger the duty to preserve documents within its scope"); John B. v. Goetz, 531 F.3d 448, 459 (6th Cir. 2008). In the departing-employee posture, the trigger frequently arrives the instant the access logs surface a suspicious download, and it binds both sides — which is why a well-drafted preservation letter to the former employee is worth sending. See QueTel Corp. v. Abbas, 2017 WL 11380134, at *5 (E.D. Va. Oct. 27, 2017); Konica Minolta Bus. Sols. U.S.A., Inc. v. Lowery Corp., 2016 WL 4537847, at *4 (E.D. Mich. Aug. 31, 2016).

The sanctions for getting this wrong are real, and Federal Rule of Civil Procedure 37(e) supplies the framework: if a party fails to take reasonable steps to preserve ESI that should have been preserved, and it cannot be restored or replaced, a court may impose measures to cure the prejudice — and, on a finding of intent to deprive, may instruct the jury that it may or must presume the lost information was unfavorable, or dismiss the action outright. Courts have applied that framework hard in exactly this posture. In Red Wolf Energy Trading, LLC v. BIA Capital Management, LLC, 2022 WL 4112081 (D. Mass. Sept. 8, 2022), the court entered a default-judgment-level sanction for the failure to produce highly relevant Slack messages and the alteration of algorithm evidence in a trade secret dispute. In Sonrai Systems, the court addressed spoliation where a former employee's device activity was at the center of the case. And the cautionary tales run in both directions: even innocent handling — copying, renaming, re-saving, or reorganizing files, or simply powering a device on and off — alters metadata and can render original versions unavailable. See OmniGen Rsch. v. Wang, 321 F.R.D. 367, 372-73 (D. Or. 2017).

The disciplined response is to treat the suspicious device the way a crime scene is treated: photograph its state, do not touch it, and bring in someone trained to collect it. Forensic specialists recommend working from a complete forensic image rather than a copy of user files precisely because the good evidence lives below the file layer — in deleted-file remnants, shadow copies, registry entries recording which USB drives were connected and when, and link-file records of what was opened. Where litigation is likely, courts often appoint a neutral forensic examiner and set an inspection protocol, which both prevents spoliation and answers the personal-privacy objections a former employee will raise about handing over a device that also holds personal data. See Genworth Fin. Wealth Mgmt., Inc. v. McMullan, 267 F.R.D. 443, 447-49 (D. Conn. 2010); Steves & Sons, Inc. v. JELD-WEN, Inc., 327 F.R.D. 96 (E.D. Va. 2018).

Two practical notes. First, initial investigation and full imaging are not the same step. It is often reasonable, and proportionate under Rule 26(b)(1), to begin with sources unlikely to be altered by review — server-side email, network storage, fully backed-up systems — and to escalate to imaging computers, phones, and flash drives once that cursory look reveals a real problem. What is never reasonable is letting a supervisor "poke around" the actual laptop to satisfy his curiosity before anyone has preserved it. Second, run the whole investigation under counsel. Privilege is fragile in forensic investigations, and the difference between a privileged, litigation-directed investigation and a discoverable business-operations review is often just whether a lawyer was directing it from the start. For the deeper preservation discipline that applies when a data breach and a departure collide, see when a breach hits your crown jewels and protecting trade secrets during a data breach. For the mechanics of preservation obligations, holds, and Rule 37(e) generally, see federal civil discovery: mastering the tools, rules, and pitfalls and Rule 26 initial disclosures and the discovery plan.

The doctrine to handle with tongs: inevitable disclosure

  • [ ] Do not build a departure strategy on the inevitable-disclosure doctrine. It is powerful where it exists and unavailable or sharply narrowed in many states — most notably California.
  • [ ] Build instead on documentary proof of actual or threatened misappropriation: the access logs, the bulk download, the deleted files, the USB-insertion record. That proof works in every jurisdiction.
  • [ ] Understand the DTSA's own limit: a federal injunction may not prevent a person from taking a new job, and any conditions on employment must rest on evidence of threatened misappropriation, not merely on what the person knows. 18 U.S.C. § 1836(b)(3)(A).

Why this matters. The inevitable-disclosure doctrine, most associated with PepsiCo, Inc. v. Redmond, 54 F.3d 1262, 1269-70 (7th Cir. 1995), lets a court enjoin a former employee from a new role on the theory that he could not perform it without inevitably drawing on the former employer's secrets — even without proof he has taken or used anything. It is seductive because it promises relief on the facts you have (a key employee going to a direct competitor) rather than the facts you have to prove. It is also treacherous. California rejects it outright as an end-run around the state's near-total ban on non-competes: in Whyte v. Schlage Lock Co., 101 Cal. App. 4th 1443, 1462-64 (2002), the court held that the doctrine is not the law of California and will not be used to convert a confidentiality agreement into a de facto non-compete. Other states apply it narrowly, unevenly, or not at all, so a strategy that depends on it is a strategy that fails wherever it is not recognized.

The deeper problem is that inevitable disclosure asks a court to restrain a person for what is in his head. The DTSA was drafted to resist exactly that. Section 1836(b)(3)(A) forbids an injunction that prevents a person from entering an employment relationship and requires that any conditions on that employment be based on evidence of threatened misappropriation rather than merely on the information the person knows — and it further bars injunctions that conflict with state laws protecting the practice of a lawful profession, trade, or business. The upshot: even in federal court, the "he knows too much" theory is disfavored, and the durable ground is evidence. The access logs and the bulk download persuade a court to grant emergency relief in California and Illinois alike; the theory that a talented person cannot help but disclose persuades a court only where local law lets it, and increasingly not even there. Build on the evidence.

Non-competes, non-solicits, and garden leave after the FTC rule's collapse

The contractual tools available at departure have been reshuffled, and knowing which ones still hold weight changes how you frame the exit.

  • [ ] Prefer well-drafted non-solicitation and confidentiality covenants, which hold up even in jurisdictions hostile to non-competes, over reliance on a non-compete whose enforceability now turns entirely on the law of the specific state.
  • [ ] Treat non-compete enforceability as a state-by-state question, not a national one. The FTC's attempted nationwide ban did not survive.
  • [ ] For senior departures, consider whether a garden-leave structure — keeping the employee on payroll and off the market during a notice period — fits better than a post-employment non-compete.
  • [ ] If you want a new restrictive covenant at departure, remember that most jurisdictions require fresh consideration to support it.

Why this matters. The Federal Trade Commission's Non-Compete Clause Rule, 16 C.F.R. pt. 910, would have voided most non-competes nationwide, but it was set aside before taking effect. Ryan LLC v. FTC, 746 F. Supp. 3d 369 (N.D. Tex. 2024) (holding the FTC lacked authority to promulgate the rule and setting it aside nationwide). The rule's collapse left the pre-existing fifty-state patchwork fully in force, and that patchwork is only getting more restrictive of employers at the state level. California voids employee non-competes almost entirely, Cal. Bus. & Prof. Code § 16600, and its 2024 amendments went further — voiding out-of-state non-competes as applied to California workers and requiring employers to notify affected current and former employees. Cal. Bus. & Prof. Code §§ 16600.1, 16600.5. Several other states have enacted income thresholds, notice requirements, and outright bans. The practical consequence for offboarding: do not assume the non-compete in the file is enforceable, and do not center your departure strategy on it. For the full survey of the failed federal ban and the state-law terrain, see the future of non-competes: FTC rulemaking and the state-law patchwork.

Non-solicitation covenants — of customers and of employees — are the more durable tool, because they restrain conduct rather than employment and are less likely to be struck as an unreasonable restraint. (California is again an outlier; its courts have cast doubt even on employee non-solicits.) Confidentiality covenants, properly scoped to actual trade secrets rather than "all information," survive nearly everywhere. And for senior people, garden leave is an increasingly favored structure: rather than a post-employment non-compete the employee may not honor, the employer keeps the departing executive employed and paid through a notice period during which she owes an ongoing duty of loyalty and simply cannot join a competitor. Because the employee remains on payroll and off the market, courts view it as less draconian and more enforceable than an unpaid post-employment restraint. See Natsource LLC v. Paribello, 151 F. Supp. 2d 465, 470-72 (S.D.N.Y. 2001) (enforcing a notice period followed by a paid non-compete where the employer paid full salary throughout); cf. 820 ILCS 90/5 (Illinois Freedom to Work Act, recognizing garden-leave notice provisions as distinct from non-competes). Whatever mix you use, ensure the invention-assignment and confidentiality architecture underneath is sound; a departure is a poor time to discover a chain-of-title gap. See employee invention assignment agreements and, for the underlying covenants themselves, building an enforceable NDA clause by clause and non-disclosure agreements for technology deals.

Phase 7: When misappropriation is confirmed, the response and the remedies

When the evidence shows a secret has walked, a prompt, disciplined response preserves both the evidence and the full menu of remedies. The instinct to fire off a furious cease-and-desist letter within the hour is usually wrong; the instinct to first nail down the facts under privilege is usually right.

  • [ ] Complete the investigation under counsel, documenting what triggered it, what was gathered, and what it concluded — a privileged, contemporaneous record that will anchor any later filing.
  • [ ] Decide on a cease-and-desist letter deliberately. It can resolve matters short of suit and help establish the willfulness that unlocks enhanced remedies — but it alerts the recipient, may invite a tortious-interference counterclaim if the facts are thin, and, by "publicizing" the dispute, can foreclose a DTSA ex parte seizure. Substantiate first.
  • [ ] Evaluate the DTSA and UTSA remedies and move for the ones that fit: a TRO and preliminary injunction under Federal Rule of Civil Procedure 65 (often the real prize, because it preserves confidentiality going forward in a way money never can); damages measured as actual loss plus unjust enrichment not captured in that loss, or a reasonable royalty; exemplary damages up to twice the compensatory amount and attorneys' fees for willful and malicious misappropriation.
  • [ ] In the extreme case — data about to cross a border, a defendant who will evade an ordinary order — consider the DTSA civil seizure under 18 U.S.C. § 1836(b)(2), with sober attention to its eight statutory findings and the wrongful-seizure exposure.
  • [ ] Seek a protective order and sealing under 18 U.S.C. § 1835 so the litigation itself does not become the vehicle that further exposes the secret.

Why this matters. The DTSA's remedial structure is the payoff for everything upstream. Injunctive relief comes first and matters most: § 1836(b)(3)(A) authorizes an injunction to prevent actual or threatened misappropriation (subject to the employment-mobility limits above), and in most cases the preliminary injunction — not the eventual damages award — is what actually protects the business, because it stops the secret from spreading while the case is pending. Monetary relief under § 1836(b)(3)(B) can be measured as actual loss plus unjust enrichment, or as a reasonable royalty. Where the misappropriation was willful and malicious, § 1836(b)(3)(C) allows exemplary damages up to two times the compensatory award, and § 1836(b)(3)(D) allows attorneys' fees. The claim must be brought within three years of when the misappropriation was or should have been discovered. 18 U.S.C. § 1836(d). For how these numbers are actually built and proven, see what an IP case is worth.

Two theories usually travel alongside the DTSA claim. State UTSA claims cover the same ground and, in states recognizing inevitable disclosure, may reach further on injunctive relief. And a bundle of common-law and statutory claims — breach of the confidentiality and non-solicit covenants, breach of the duty of loyalty, tortious interference with contract against the new employer (which requires proving the new employer knew of the covenants and acted with the requisite intent), and, where access was revoked and then breached, the CFAA — rounds out the complaint. Choose them for what each adds; do not simply pile them on. The federal criminal provisions of the Economic Espionage Act, 18 U.S.C. §§ 1831-1832, sit in the background as leverage in egregious cases, and the civil-and-criminal exposure map is laid out in the real cost of IP piracy.

The ex parte civil seizure deserves its reputation as an extraordinary remedy of last resort. Section 1836(b)(2) lets a court order federal marshals to seize property to prevent the dissemination of a trade secret, but only on eight specific findings — among them that an ordinary Rule 65 order would be inadequate because the defendant would evade it, that immediate and irreparable injury will otherwise occur, that the harm to the applicant outweighs the harm to the target, that the target actually possesses the trade secret, and that the applicant has not publicized the request. A seizure sought on inadequate facts exposes the applicant to wrongful-seizure damages, and the remedy is simply unavailable if a Rule 65 injunction would do. It is the right tool for a defendant with a plane ticket and a thumb drive, and the wrong tool for almost everyone else. When the defendant is offshore — a recurring feature of the highest-stakes matters — the service and asset-freeze mechanics get their own treatment in service and ex parte remedies against Chinese defendants in IP litigation.

Worked example. Return to Meridian Turbine and Priya. The Friday-night export of 214 formulation files is discovered on Monday. Counsel is looped in that afternoon and directs the investigation. Rather than confronting Priya, Meridian preserves her laptop (no one turns it on), sends her a preservation letter, and has a forensic vendor image the machine — which reveals not only the export but a subsequent attempt to delete the browser history recording the upload. The deletion is itself evidence: courts treat the destruction of records of one's own conduct as a marker of improper means and consciousness of wrongdoing. See WeRide Corp. v. Huang, 379 F. Supp. 3d 834, 848-49 (N.D. Cal. 2019). On that record — a bulk download wildly out of pattern, an upload to a personal account, and a cover-up — Meridian obtains a TRO within the week. And because Priya's confidentiality agreement contained the Section 1833(b) notice discussed below, exemplary damages and fees remain on the table. Every one of those outcomes traces to a Phase 1 log pull and a Phase 6 decision not to touch the laptop.

The Section 1833(b) trap that quietly forfeits your best remedies

  • [ ] Confirm that the departing employee's confidentiality or non-disclosure agreement contains the DTSA whistleblower-immunity notice required by 18 U.S.C. § 1833(b)(3).
  • [ ] If it is missing, understand the precise consequence: you do not lose your DTSA claim, but you lose the ability to recover exemplary damages and attorneys' fees against that employee.
  • [ ] Fix it going forward — put the notice in every covered agreement — but do not reopen and re-execute old agreements solely to add it.

Why this matters. The DTSA gives employees immunity for disclosing trade secrets in confidence to a government official or attorney solely to report or investigate a suspected violation of law, and in certain sealed court filings. 18 U.S.C. § 1833(b)(1)-(2). To keep the enhanced remedies, employers must give employees notice of that immunity in any agreement governing trade secrets or confidential information entered into or updated after May 11, 2016. § 1833(b)(3). The statute's only stated penalty for omitting the notice is narrow but sharp: the employer "may not be awarded exemplary damages or attorney fees" against an employee who never received it. That is precisely the segment of the remedy — the two-times multiplier and the fee-shift — that makes a willful-misappropriation case worth bringing. The claim survives; the leverage evaporates. This is the least glamorous item on the entire checklist and one of the most consequential, and it is verified at the exit interview, not discovered on the eve of a fee motion. For where the notice belongs and how it reads, see building an enforceable NDA clause by clause.

A one-page failure-mode catalog

The mistakes that lose winnable cases are consistent, cheap to avoid, and expensive to commit.

  • The HR-to-IT lag. HR knows on Monday; IT acts on Thursday. The determined employee copies at leisure in between. Assign one owner and a same-day trigger for high-access departures.
  • Never asking for the data back. The DM Trans error: letting company information sit on a personal device you do not control, and never even requesting its return, can defeat the secrecy element by itself.
  • "Just checking the laptop." The most common spoliation in this field. Powering on the device, opening files, or letting an untrained person browse it alters metadata and forfeits the forensic record.
  • Letting a re-imaging routine run. A calendar-driven wipe destroys the device you needed 60 days after the departure you should have flagged. Suspend the routine the moment suspicion arises.
  • Betting on inevitable disclosure. A theory that fails wherever it is not recognized, when the access logs would have won everywhere.
  • The missing Section 1833(b) notice. Forfeits exemplary damages and fees — the part of the recovery that justifies the fight.
  • Revoking the laptop but not the ecosystem. The forwarding rule, the personal-device SaaS session, the live API token: the leaks that keep leaking because offboarding stopped at the login screen.
  • Firing off a cease-and-desist on thin facts. Tips off the defendant, invites a tortious-interference counterclaim, and can foreclose an ex parte seizure. Substantiate first.

Fitting the offboarding into the larger program

A departure protocol is only as good as the program it sits inside. The access logs are persuasive only because access was restricted in the first place; the signed acknowledgment reinforces reasonable measures only because the underlying agreements exist and the secrets were actually marked. If any of that is thin, the exit is where you will find out — too late to fix it for this employee, in time to fix it for the next. Use each significant departure as a live audit: Did every person who should have signed a confidentiality and invention-assignment agreement actually sign one? Do the covenants still describe the business, including product lines and technologies that did not exist when the forms were drafted? Are the HR-to-IT communication paths fast enough to cut access on the day someone leaves? Those questions belong to the program-building work in standing up a trade secret protection program, building trade secret protection from the ground up, and the full life-cycle trade secret protection toolkit. The handbook and policy layer that tells employees these obligations exist is covered in building a legally sound employee handbook, and the way trade secret protection interlocks with the other IP regimes — so you know what you are actually protecting and how — is mapped in how the law protects software and copyright, trademark, patent, and trade secret compared.

A compact table of primary authority

The authorities that recur in departing-employee trade secret matters, gathered for reference.

Related UpLaw Resources

Related Checklists

Related Guides

Related Articles

Related Toolkits

This checklist is for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. Trade secret and employment law vary by jurisdiction and continue to evolve. Consult qualified counsel about your specific circumstances before acting.