Reasonable Measures: Protecting Trade Secrets Before Anyone Leaves

Why reasonable measures is the element you control

Both the Texas Uniform Trade Secrets Act, in section 134A.002(6) of the Civil Practice and Remedies Code, and the federal Defend Trade Secrets Act, in 18 U.S.C. § 1839(3), define a trade secret by two conditions. The information must derive independent economic value from not being generally known or readily ascertainable, and the owner must have taken reasonable measures under the circumstances to keep it secret.

The first condition is about the information. The second is about the company. When a trade secret case fails, it is most often on the second condition, because the defendant can point to a shared drive anyone could open, a pitch deck sent without an NDA, or an exit with no checklist. None of that can be repaired after the employee has left. The rest of this article is about what a company does while everyone is still on the payroll. What qualifies as a trade secret in the first place is covered in what counts as a trade secret in Texas.

What courts count as reasonable

Reasonable under the circumstances is a sliding scale. A company with forty employees is not held to the standards of a defense contractor, but it is held to the standards of a careful company its own size. The measures that show up in court as persuasive are the ordinary ones, done consistently:

• confidentiality agreements signed by employees, contractors and vendors who receive the information;
• access limited by role, so the pricing model is open to the three people who price, not to everyone with a login;
• passwords, multi-factor authentication and logging on the systems that hold the information;
• confidential markings on documents that are actually confidential, and not on everything;
• a written policy, acknowledged by employees, saying what is confidential and how it is handled;
• physical controls where they matter: locked areas, visitor sign-in, no photographs on the production floor;
• an exit process that recovers devices, cuts access and reminds the departing person of continuing duties.

No single item is required. What courts look for is a pattern showing the company treated the information as secret in practice, not only in a handbook.

Step one: know what your secrets are

A company cannot protect what it has not identified, and a company that calls everything confidential has effectively called nothing confidential. The first exercise is an inventory: which information gives the business an edge that a competitor could not readily reproduce? Typical entries for a Dallas business are the pricing or bid model, customer-level data beyond names, supplier terms, formulations or process settings, source code, and unreleased plans.

The inventory serves two purposes. Internally, it tells the company where to concentrate its controls. In litigation, it answers the first question every court asks, which is what exactly the trade secret is, and it answers it with a document that predates the dispute.

Step two: put confidentiality in writing

Texas trade secret law does not require a signed agreement; an employee who receives confidential information owes a duty of secrecy by virtue of the relationship. The agreement still matters, for three reasons. It is the cleanest proof of reasonable measures. It adds a breach of contract claim, with its own damages and often its own fee clause, alongside the statutory claim. And it defines the information broadly enough to cover confidential material that may not meet the trade secret definition.

A confidentiality agreement used in Texas should, at minimum, define the information covered, state the duty not to use or disclose it except for the company, require return or deletion at the end of the relationship, and survive termination. Two additions are worth attention:

• The DTSA whistleblower notice. Under 18 U.S.C. § 1833(b), any contract with an employee, contractor or consultant that governs the use of trade secrets or confidential information must give notice of the immunity that section provides for disclosures to the government or an attorney to report a suspected violation of law. An employer that omits the notice cannot recover exemplary damages or attorney's fees under the federal Act against that person. The notice may be given by cross-reference to a policy document provided to the employee. Why this matters when choosing a court is covered in when to sue under the federal Defend Trade Secrets Act.
• Non-solicitation and non-compete covenants. These are separate promises governed by section 15.50 of the Texas Business and Commerce Code, with their own enforceability rules. They protect relationships and goodwill; the confidentiality agreement protects information. The two are often in one document but are analyzed differently, as explained in non-solicitation agreements in Texas.

Vendors, consultants and prospective buyers or investors should sign before they see anything. A disclosure to a prospect with no agreement in place is the most common way a company's own conduct defeats its later claim.

Step three: control and log access

Access control does two jobs. It keeps the circle of people who can take the information small, and it creates the evidence that shows who took it. A company that can produce a log showing the departing employee exported the customer database at 11:40 p.m. the night before resigning has most of its case. A company whose systems keep no such record is left with inference.

The practical measures are role-based permissions in the CRM and file system, disabled USB ports or logged removable media, alerts on bulk downloads and on forwarding to personal email, and a policy that company information lives only on company systems. Personal devices used for work should be covered by a written policy that addresses company data on them, including the company's right to have that data removed when the person leaves.

Step four: train, remind, repeat

A signed agreement from the first day of employment, never mentioned again, is weaker evidence than one that was reinforced. Annual acknowledgments of the confidentiality policy, a short training on what the company treats as secret, and a reminder when someone is promoted into a role with wider access all show a living program. They also make it much harder for a former employee to say they did not know the information was confidential.

Step five: the exit process

The departure is where most trade secret cases begin, and the company's conduct in that week is examined closely later. A consistent exit process for anyone with access to confidential information includes:

1. disabling system, email and cloud access at the agreed time, and changing shared credentials;
2. collecting company devices and preserving them, not reissuing or wiping them, until the company is satisfied nothing was taken;
3. a written reminder of the continuing confidentiality obligations, with a copy of the signed agreement;
4. a certification from the departing employee that all company information has been returned or deleted, including from personal devices and accounts;
5. a review of the person's recent activity logs for unusual downloads, forwards or deletions;
6. notice to customers and vendors of the new point of contact, where the relationship warrants it.

The full checklist, and how it interacts with other departure issues, is in exit protocols that protect confidential information. Where a review turns up something, the rules on how far the company may look are strict, and the device should go to a forensic examiner rather than to a curious manager.

Example

Suppose a Dallas commercial insurance agency keeps its book of business, with renewal dates, carrier quotes and commission data, in an agency management system. Only producers and the two principals can see client-level data, each under their own login. Every producer signs a confidentiality agreement at hire that includes the federal whistleblower notice, and signs an acknowledgment of the information policy each January. When a producer resigns, the agency disables access the same afternoon, keeps the laptop in a locked cabinet, sends the reminder letter and obtains the certification.

Six weeks later the agency learns that the producer is quoting its clients at a competing agency and that, in his final week, he exported 212 client records. The agency can prove reasonable measures with documents that all predate the dispute, prove the taking with its own log, and point to a signed agreement with a fee clause. The producer's defense is reduced to arguing about the value of the records, not about whether the agency guarded them.

The mistakes that undo everything

• Sharing without an agreement. Pitch decks, due diligence rooms, vendor demos and trade show conversations are where secrets leak with the owner's consent.
• Marking everything. If every email footer says confidential, a court may conclude the label meant nothing.
• Publishing the secret in a patent application. Information disclosed in a published application is public and cannot be a trade secret, so the choice between patent and secrecy should be made deliberately.
• Wiping and reissuing the laptop. The best evidence of the taking is destroyed, and the company may face a spoliation argument of its own.
• Inconsistency. An exit process applied to some departures and skipped for others invites the argument that the company did not really treat the information as secret.

What this buys you if someone does leave

A company that has done these things is in a different position on day one of a dispute. It can identify the secret from its inventory, prove reasonable measures from its agreements and logs, show the taking from its access records, and plead a contract claim with a fee clause alongside the statutory one. That is what makes a temporary injunction obtainable within days rather than a hearing the company is likely to lose. Tina Wysk represents Dallas businesses in trade secret disputes in state and federal court and sees, in every case, how much the outcome depends on steps taken before the dispute began; the practice is described at trade secret litigation.