Exit Protocols That Protect Confidential Information When Employees Leave

Why the exit is where trade secret cases are won or lost

Trade secret protection under the Texas Uniform Trade Secrets Act depends on the owner having taken reasonable measures under the circumstances to keep the information secret. The departure of an employee who had access is the circumstance that matters most. A company that lets a salesperson keep a laptop for two weeks after resigning, leaves the CRM login active, and never tells the employee in writing what she signed will have trouble proving reasonable measures, and will have no clean record of what left with her. The same facts that protect the secret are the facts that win the injunction hearing later.

What follows is the protocol as a sequence. The legal rules that shape each step are noted where they apply. The broader program of protection before anyone leaves is covered in reasonable measures to protect trade secrets.

Step one: before the last day, know what the employee can reach

The moment the company knows an employee is leaving, whether by resignation or by its own decision, someone should produce a list: every system, shared drive, cloud application, customer portal, vendor account, company credit card, building and vehicle access, and every physical item issued. For a resignation, pull the access logs and download history for the preceding 30 to 90 days before saying anything. Large downloads, forwarding rules sending company email to a personal address, cloud-sync folders and USB activity in the weeks before notice are the usual signs, and they are easiest to find before the employee knows anyone is looking.

For an involuntary termination, do the same inventory before the meeting, and schedule the access cutoff to coincide with it.

Step two: the last day, in order

1. Revoke access at a set time. Email, VPN, cloud storage, CRM, accounting, code repositories, social media accounts the employee administered, shared passwords. Reset any credential the employee knew that others still use. For a resignation, the cutoff is usually the end of the last working day; for a termination, during or immediately before the meeting.
2. Collect property and credentials. Laptop, phone, tokens, badges, keys, documents, and the passwords or recovery codes needed to access company accounts the employee set up. Use a checklist and have the employee initial each item.
3. Preserve, do not wipe. Set the returned laptop and phone aside, powered off, with a note of who received them and when. Suspend the deletion of the employee's mailbox and cloud account; convert them to a preserved state. Reissuing a departed employee's laptop the next week destroys the evidence the company will want if a problem surfaces. Whether and how to examine the devices is covered in what is allowed when investigating a departing employee's devices and accounts.
4. Ask about personal devices and accounts. If the employee used a personal phone or personal cloud storage for work, ask in the exit meeting what company information is on them and request, in writing, that it be returned or deleted after return. The company has no right to take or search a personal device, but the employee's answer, and any refusal, is evidence.
5. Give the written reminder. A letter, handed over and emailed, that identifies by date and title each agreement the employee signed with continuing obligations, attaches copies, summarizes the confidentiality, non-solicitation and non-compete terms in plain words, and asks the employee to confirm that all company information and property has been returned and that none has been retained. Where the company knows the new employer, the letter can note that the company may send the new employer a copy of the restrictive covenants.
6. Get the acknowledgment. A one-page certificate signed by the employee: all property returned, no company information retained on any personal device or account, obligations understood. An employee who refuses to sign has told the company something useful; note the refusal and the reason.

Step three: the accounts the company must not enter

An employee's personal email, messaging and cloud accounts are off limits even when the credentials are saved on the company laptop. The federal Stored Communications Act, 18 U.S.C. § 2701, makes it an offense to intentionally access without authorization a facility through which an electronic communication service is provided and thereby obtain a stored communication, and the statute carries civil liability. Logging into a departed employee's personal Gmail from the returned laptop to look for forwarded files is the textbook example. The company may examine what is stored on its own device, including copies of personal messages that were synced to it, with care and preferably under counsel's direction, but it may not use the stored password to reach into the account itself.

The same caution applies to the employee's personal phone and personal cloud storage. If company information is believed to be there, the remedy is a demand, an agreement for a neutral forensic review, or a court order, not self-help.

Step four: the two weeks after

• Watch for the signals: customers reporting contact, LinkedIn announcements of the new role, a competitor's proposal that reads like the company's, log-in attempts on disabled accounts.
• Send the restrictive-covenant reminder to the new employer only if the agreements justify it and only after a lawyer has read them, because an inaccurate letter can expose the company to a tortious interference claim.
• Decide, within days rather than months, whether the pre-departure activity warrants a forensic examination of the preserved devices. Injunctive relief depends on speed, and delay is argued as evidence that the information was not that valuable.
• Document the whole sequence in one file: the inventory, the cutoff times, the property checklist, the reminder letter, the acknowledgment, the final pay record.

What the former employee will say if it goes to court

A departing employee who later faces a trade secret or non-compete claim will argue that the company did not treat the information as secret: access was wide open, nothing was marked, the laptop was never collected, no one ever mentioned the agreement at departure, and the employee was never asked to return or delete anything. The protocol above is the answer to each of those points, and the signed acknowledgment is the single most useful exhibit, because it establishes what the employee represented on the day he or she left. An employee who certified that nothing was retained and is later found with the customer database has a credibility problem that colors the whole case.

The employee will also argue that the company violated his or her rights during the exit: withheld pay, searched a personal account, or made defamatory statements to the new employer. A protocol that pays on time, stays out of personal accounts and keeps the reminder letter factual removes those counterclaims before they exist.

Example

Suppose a Dallas commercial insurance agency learns on a Tuesday that a producer with a signed non-solicitation and confidentiality agreement is leaving Friday for a competitor. Before saying anything, IT pulls his activity for the past 60 days and finds that on Monday night he exported his book of business from the agency management system to a spreadsheet and emailed it to a personal address. On Friday afternoon the agency disables his access at 3:00 p.m., collects his laptop and phone, and hands him a letter attaching his agreement and asking him to confirm he has retained nothing. He signs the certificate. His final pay, including earned commissions, goes out on the next regular payday. The laptop is bagged and stored.

The agency now has a signed certificate it knows to be false, a preserved device, and logs showing the export. It has not touched his personal email. Within the week its lawyer sends a demand to return and delete the spreadsheet and a notice to the new employer, and the agency is in a position to seek a temporary injunction with evidence rather than suspicion. The steps that follow are described in what a company can do when a key employee leaves and takes clients.

Putting the protocol in writing

The protocol works only if it is written down, assigned to named roles in IT, HR and the employee's manager, and run identically for every departure, including friendly ones. Selective use is argued as evidence that the company did not really care about the information, and an employee treated differently from colleagues will say so. The documents it needs are short: an access and property inventory template, a last-day checklist, a reminder letter template with blanks for the agreements, a return-and-nonretention certificate, and a final-pay checklist keyed to the Payday Law deadlines. A litigator who handles trade secret litigation can review the templates against the company's actual agreements, so that the letter the employee receives on the last day matches what the company would later ask a court to enforce.