Policy required document Information security
Confidentiality and Trade Secrets Policy
A confidentiality policy tells employees what company information is confidential, how it must be handled, what they may not do with it during and after employment, and how to report a suspected violation of law without breaching it. Two legal hooks make it more than good housekeeping.
First, information is only a trade secret if the owner took reasonable efforts to keep it secret.
California's Uniform Trade Secrets Act defines a trade secret as information that derives economic value from not being generally known and is the subject of efforts that are reasonable under the circumstances to maintain its secrecy (Civil Code 3426.1(d)); every state's version says the same.
An employer with no policy, no marking and no acknowledgment has trouble proving the second half, and without it there is no trade secret to protect, whatever was taken.
Second, the federal Defend Trade Secrets Act attaches a specific sentence to the document.
Under 18 U.S.C. 1833(b), an employee cannot be held liable for disclosing a trade secret in confidence to a government official or an attorney solely to report a suspected violation of law, and the employer must give notice of that immunity in any contract or agreement governing trade secrets.
An employer that fails to give the notice may not be awarded exemplary damages or attorney fees under the Act against that employee.
The statute lets the notice be a cross-reference to a policy document setting out the employer's reporting policy, which is why the confidentiality policy and the whistleblower policy have to be written together, and why a confidentiality agreement drafted before 2016 usually costs its owner double damages.
Obligation ledger
Who requires it, and what each one says.
| Source | Applies when | What it requires | Status |
|---|---|---|---|
| Defend Trade Secrets Act, immunity and notice 18 U.S.C. 1833(b) | Any contract or agreement with an employee, contractor or consultant that governs the use of a trade secret or other confidential information | Immunity for confidential disclosure to a government official or attorney solely to report a suspected violation of law, and for filings under seal. The employer must provide notice of the immunity in the agreement, or by cross-reference to a policy document setting out its reporting policy. Without the notice the employer may not be awarded exemplary damages or attorney fees against that employee. Employee includes contractors and consultants. | Mandatory |
| Defend Trade Secrets Act, civil action 18 U.S.C. 1836 | Any owner of a trade secret that is misappropriated | A federal civil action with injunctions, damages, exemplary damages up to twice actual damages and attorney fees for willful and malicious misappropriation. The exemplary damages and fees are the remedies the missing notice forfeits. | Implied |
| California Uniform Trade Secrets Act, definitions Cal. Civ. Code 3426.1(d) | Any claim that information is a trade secret | A trade secret must derive independent economic value from not being generally known and be the subject of efforts that are reasonable under the circumstances to maintain its secrecy. The policy, its acknowledgment and the handling rules are the reasonable efforts. | Implied |
| NLRB, Stericycle, Inc. 372 NLRB No. 113 (August 2, 2023) | Every private employer covered by the National Labor Relations Act, union or not | A work rule is presumptively unlawful if it has a reasonable tendency to chill employees from exercising their Section 7 rights, read from the perspective of an economically dependent employee; the employer may rebut by proving a legitimate and substantial business interest that cannot be served by a narrower rule. Overruled the more permissive Boeing standard. | Implied |
Required sections
- What is confidential, in categories with examples, and what is not: an employee's own pay, and information already public
- Marking and handling rules: storage, transmission, sharing outside the company, use of personal devices and accounts
- Duties on separation: return of materials, deletion, and that the duty of confidentiality continues
- The DTSA immunity notice, in the statutory terms, or a cross-reference to the whistleblower policy that contains it (18 U.S.C. 1833(b)(3))
- A carve-out for discussing wages, hours and working conditions, which the NLRA protects and which a confidentiality rule cannot forbid (see Stericycle)
- A carve-out for reports to government agencies and for cooperating with investigations
- How to report a suspected leak, and no retaliation for doing so
- Cross-reference to any signed confidentiality or invention agreement so the two documents do not conflict
What the examiner asks for
What changed
Change log.
Frameworks
Where this document is required.
Need a hand implementing it?
Find a Consultant for Confidentiality and Trade Secrets Policy
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Manage This Document in AllyMatter
Route it for approval, keep every version, and record a named acknowledgment from everyone who has to read it.
Questions
What people ask.
We have signed NDAs with everyone. Do we still need a policy?
The agreement is the promise; the policy is the practice that proves reasonable efforts. Courts have found information was not a trade secret because the owner never told employees what was secret or how to handle it, NDA or not. And if the NDA predates 2016 or lacks the immunity notice, the policy is the cheapest place to add it by cross-reference.
What happens if the DTSA notice is missing?
The trade secret is still protected and the employer can still sue. What it loses, against that employee, is exemplary damages and attorney fees under the federal Act, which are often the difference between a case worth bringing and one that is not.
Can the policy forbid employees from discussing their pay?
No. Wages, hours and working conditions are protected subjects under the National Labor Relations Act for most private employees, union or not, and a confidentiality rule broad enough to cover them is unlawful under the current Board standard. The policy needs an explicit carve-out.
Do contractors count?
Yes. The DTSA defines employee to include contractors and consultants, so their agreements need the notice too.
Sources
18 U.S.C. 1833, DTSA exceptions and whistleblower immunity notice (Cornell LII)18 U.S.C. 1836, DTSA civil proceedings (Cornell LII)Cal. Civ. Code 3426.1, Uniform Trade Secrets Act definitions (California Legislative Information)NLRB, Board adopts new standard for assessing lawfulness of work rules (Stericycle), August 2, 2023