When Does a Business Need a Trade Secret Policy for Employees?
A business usually needs a written trade secret policy for employees once confidential know-how starts leaving the founder's head and reaching other people: the first hire with access to formulas, code or client data, a contractor on a live project, or a staff member who is about to leave. For many Jaipur and other Indian businesses without in-house counsel, that moment arrives earlier than expected.
Key Takeaways
- Policy and contract do different jobs: a trade secret policy is an internal rulebook for handling information, while the confidentiality clause in an employment contract and any NDA create the enforceable obligations.
- Three common trigger points: onboarding, giving staff access to R&D or core know-how, and offboarding. Most businesses formalise a policy at one of these.
- Access controls carry weight: a policy that says "keep this confidential" helps little if every employee can open every file on a shared login.
- India has no standalone trade secret statute: protection rests largely on contract and equitable principles, so written terms and documented practice matter.
- Post-employment limits need care: confidentiality duties and non-compete clauses are treated differently, and a broad non-compete may not be enforceable.
Trade Secret Policy for Employees at a Glance
| Decision point | What the policy usually addresses | Supporting document |
|---|---|---|
| Onboarding | What counts as confidential, duty not to bring a former employer's information, signed acknowledgement | Appointment letter with confidentiality clause |
| R&D or know-how access | Need-to-know access, no shared logins, marking, physical security | Access register, role-based permissions |
| Working with contractors or vendors | Sharing only under written terms, limited scope of disclosure | NDA or services agreement with confidentiality terms |
| Devices and remote work | Personal devices, cloud storage, messaging apps, printing | Acceptable-use or IT policy |
| Offboarding | Access revoked, materials returned, reminder of continuing duties | Exit checklist and signed return-of-property form |
| Incidents | Who staff report a suspected leak to, and what happens next | Incident log, disciplinary procedure |
What Is a Trade Secret Policy for Employees?
A trade secret policy for employees is a written internal document that tells staff which business information is confidential, who may access it, how it must be handled, and what happens when someone leaves. It works alongside contracts, rather than replacing them.
Think of it as the operating manual for confidentiality. The employment contract says that an employee owes a duty of confidence. The policy explains what that duty looks like on an ordinary Tuesday: which folders are restricted, whether a prototype may be photographed, and whether a client list may be exported to a personal phone.
Why the policy matters in India
India does not have a dedicated trade secret statute. Protection is generally pursued through contractual obligations and equitable remedies for breach of confidence, which makes the paper trail important. The Law Commission of India has taken the view that a sui generis legislation should be introduced to protect trade secrets, but until that happens, a business has to build its own protection through documents and conduct.
A court asked to restrain misuse of confidential information will usually want to see two things. One is that the information was in fact confidential. The other is that the business treated it that way. A written policy, signed acknowledgements and working access controls are the evidence of the second point.
What a trade secret can be
Trade secrets are not limited to formulas. They can include manufacturing parameters, supplier terms, pricing models, unreleased source code, customer lists, test data and business plans. What they share is that they have value because they are not generally known, and the holder takes steps to keep them that way.
When Does a Business Usually Formalise One?
Most businesses formalise a trade secret policy when a specific event forces the question: onboarding a hire who will touch sensitive information, opening R&D or process knowledge to a team, engaging outside contractors, facing investor due diligence, or preparing for a key employee's departure. Waiting until a leak is the common but costly alternative.
There is no statutory trigger in India that makes a written policy mandatory for a private business. The decision is practical. A useful rule of thumb is this: if losing a piece of information to a competitor would hurt, and more than one person other than the owner can reach it, a written policy is worth having.
Signals that the moment has arrived
- You are about to hire the first person who is not a founder or family member and who will see pricing, formulas, designs or code.
- A contractor or freelancer needs working access to unreleased material.
- Your process or product know-how lives in shared drives, WhatsApp groups or personal laptops.
- An employee with deep process knowledge has resigned, or you suspect they may.
- An investor, acquirer or large customer has asked how you protect confidential information.
Who should not rush to a long policy
A two-person startup with no confidential material beyond a business idea may not need a twenty-page document. A short confidentiality clause in each agreement and sensible habits may be proportionate. The policy should grow with the number of people and the sensitivity of the information. An over-engineered document that nobody follows is arguably worse than a short one that is followed.
Moment 1: Onboarding New Employees
Onboarding is the cleanest time to set expectations, because the employee has not yet seen anything sensitive. The confidentiality clause in the appointment letter, a copy of the policy and a signed acknowledgement can all be handled in the first week.
A typical onboarding set includes a clear definition of confidential information, an obligation not to disclose it during and after employment, an obligation to return materials, and an acknowledgement that the employee has read the policy. The Startup India confidentiality and IP assignment agreement template is one publicly available starting point for seeing how such clauses are commonly structured.
The former-employer problem
Onboarding runs in both directions. A new hire may carry information from a previous employer, and that can expose your business. WIPO notes that when hiring, companies can use an on-boarding checklist requiring new employees to confirm compliance with confidentiality obligations to former employers. Writing that expectation into the policy is a low-cost safeguard.
Assignment of work product
Onboarding documents also tend to deal with who owns what the employee creates. Where staff write code, design products or develop processes, an assignment clause helps keep ownership with the business. This sits next to confidentiality rather than inside it, and it is worth reading together with the choice between copyright and secrecy for software, discussed in our piece on copyright vs trade secret for software.
Moment 2: Giving Staff Access to R&D and Know-How
The second moment comes when know-how stops being one person's knowledge and becomes a shared asset. The policy then has to deal with who gets access, in what form, and on what record. This is where access controls matter more than wording.
WIPO's guidance on NDAs flags R&D teams in particular: staff who work with proprietary assets daily might later change jobs for a competitor. That is not an accusation against any employee. It is a reason to design access so that no single person holds everything.
Practical handling rules
Handling rules should be concrete and match how work really happens. One published confidentiality-policy guide lists need-to-know access and no shared logins as the practical core of a policy, and both are easy to adopt in a small business. A workable set looks like this:
- Need-to-know access: staff see only what their role requires, and the list of who has access is written down.
- Individual logins: no shared passwords for folders, tools or accounts holding sensitive material.
- Marking: sensitive documents, drawings and samples are labelled as confidential so staff know what they are handling.
- Physical security: formulas, prototypes and batch records are kept in locked rooms or cabinets, with visitors logged.
- Splitting knowledge: where practical, no one employee holds the complete process.
- Devices and channels: a clear rule on personal phones, personal email, cloud drives and messaging apps.
Eight steps and the idea of "reasonable measures"
WIPO Magazine's article on eight steps to secure trade secrets lists records to document protection, physical and electronic security and confidentiality measures, and due diligence and ongoing management of third parties among them. The theme is consistent: protection is a set of habits that can be shown to exist, not a single document.
Local context: manufacturers and small teams
In Jaipur, much valuable know-how sits in small manufacturing, jewellery, textile and craft businesses where a few trusted workers hold process knowledge. Those settings call for particular care with shop-floor access and supplier information. Our guide on trade secret protection for Jaipur manufacturers looks at that setting in more detail.
Moment 3: Offboarding and Exit
The third moment is departure. Offboarding is where a policy is tested, because it is when an employee may take information, files or relationships. The steps are simple but need to be done on the day, not weeks later.
A published reasonable-measures checklist describes departing employees as the most common source of misappropriation and offboarding as the measure courts examine most closely. Whether or not that holds in every case, it matches common practice. A reasonable exit routine includes:
- Disabling email, system and cloud access on the last working day.
- Collecting laptops, drives, documents, samples and access cards, and recording what was returned.
- Asking the employee to confirm in writing that no confidential material has been kept.
- Reminding the employee, in writing, of the confidentiality obligations that continue after exit.
- Recording the exit interview and any concerns about information leaving.
For a fuller walk-through, see our employee exit checklist for protecting trade secrets in India.
What a post-exit restriction can and cannot do
Founders often assume a non-compete will do the work after an employee leaves. Section 27 of the Indian Contract Act, 1872 provides that every agreement by which a person is restrained from exercising a lawful profession, trade or business is, to that extent, void. Courts, including the Delhi High Court in a 2025 decision, have treated post-termination restrictive covenants in employment contracts as void under that section, while a restriction during employment is treated differently.
The practical point is that a continuing duty of confidence about specific information is a different thing from a ban on working for a competitor. Policies that rely on a broad non-compete may give less protection than their drafters expect. How a court applies this to a particular clause depends on its wording and facts, so it needs advice on the document in front of you.
What Should the Policy Cover?
A trade secret policy for employees should cover a definition of confidential information, classification levels, access rules, handling and device rules, dealings with third parties, incident reporting, exit procedures and consequences for breach. Keeping it short, specific and tied to real workflows matters more than length.
The checklist below is a general starting point. Adapt it to the size and sector of the business.
- Purpose and scope: who the policy applies to, including employees, interns, contractors and directors.
- Definition: examples of what is confidential in your business, plus a catch-all, without sweeping in everything an employee learns on the job, such as general skills.
- Exclusions: information already public, independently known to the employee, or lawfully received from others.
- Classification: two or three levels, for example general confidential and restricted, with different handling rules.
- Access: need-to-know principle, role-based permissions, no shared credentials, an access register for restricted material.
- Handling: storage, copying, printing, emailing, photographing, discussing in public places.
- Devices and remote work: personal devices, cloud tools, messaging apps and what may not be uploaded.
- Third parties: disclosure to vendors, customers, investors and contractors only under written confidentiality terms.
- Former-employer information: a rule that staff must not bring or use confidential material from earlier jobs.
- Reporting: whom to tell about a suspected leak, and a no-blame channel for honest mistakes.
- Exit: return of property, access removal, continuing obligations.
- Consequences: disciplinary action and the possibility of legal remedies.
- Review: an owner for the policy and a date for revisiting it.
A pass mark for a workable policy
A simple test is whether an average employee could answer three questions after reading it: what is confidential here, who can see it, and what do I do when I leave. If any of the three answers is unclear, the policy needs simplifying. If the document cannot be matched to what actually happens in the office or workshop, it has drifted from practice and should be corrected before it is relied upon.
How Do Confidentiality Clauses, Access Controls and NDAs Work Together?
They protect different relationships. The confidentiality clause in an employment contract binds employees, the NDA binds outsiders such as vendors and prospective investors, access controls limit what anyone can reach, and the policy ties these together as everyday rules. Each layer covers a gap the others leave.
| Layer | Who it binds | What it does | Typical weakness |
|---|---|---|---|
| Trade secret policy | Employees, contractors on notice of it | Sets everyday handling rules and shows the business treats information as confidential | Not a contract by itself unless incorporated into the terms of employment |
| Employment confidentiality clause | Employee | Creates an enforceable duty during and after employment | Vague definitions of "confidential information" |
| NDA | Vendors, advisers, investors, prospective partners | Allows controlled disclosure outside the business | Signed after the information has already been shared |
| Access controls | Everyone, in practice | Limits who can see or copy information in the first place | Permissions never reviewed when roles change |
Where the policy fits with NDA practice
Many businesses already use NDAs with outsiders, and those usually work well. The gap is the inside. An NDA with a supplier does not tell your own team how to treat the supplier's drawings. Ensuring the policy is incorporated by reference into appointment letters, and that staff acknowledge it in writing, helps connect the internal rules to enforceable terms.
WIPO's NDA guidance lists employee and contractor onboarding as a first use case for NDAs, which shows how the two documents overlap. Where an employment contract already has a well-drafted confidentiality clause, a separate employee NDA may be repetitive. Where contractors or interns sit outside a formal employment contract, a standalone NDA is the usual route. Our guide to the NDA format in India covers the clauses in more detail.
Should the policy be part of the contract?
That is a drafting choice with trade-offs. A policy incorporated into the contract is harder to change unilaterally. A policy kept separate is easier to update but may carry less contractual weight. Many businesses put the core obligations in the contract and keep operational detail in the policy, which can be revised more often. This is a point where reading the actual documents together, rather than in isolation, matters.
A Hypothetical Walk-Through for a Jaipur Business
This is an illustration only, not a real engagement. Suppose a small Jaipur food-processing company has a founder who developed a recipe and process parameters over several years. She now plans to hire a production supervisor and a quality analyst, and to use an outside packaging contractor.
Before the hires start, the business could write a short policy and attach it to the appointment letters. It could classify the recipe and batch parameters as restricted, keep them in a locked file and a permissioned folder, and give the supervisor only the parameters for the stage they run. The packaging contractor would sign an NDA before seeing any labelling or specification details.
If the supervisor later resigns, the exit routine would cut system access that day, collect any notes or photos, record the return of keys and documents, and give a written reminder of continuing confidentiality duties. Nothing here guarantees that information will never leak. It simply means the business can show it took sensible, documented steps.
Common Gaps in Employee Confidentiality Practice
The same weak points tend to recur in small businesses, and most are about follow-through rather than drafting.
- Policy without enforcement: a document nobody has read, with no signed acknowledgements.
- Over-broad definitions: treating everything as confidential, which can weaken the claim that particular information was treated as special.
- Shared logins and open drives: access that never narrows as the team grows.
- Late NDAs: information shared with a vendor before any paper is signed.
- Exit done informally: laptops returned, but cloud accounts, chat groups and personal copies untouched.
- Relying on a non-compete: assuming a post-employment restriction will hold, without checking it against section 27.
One question remains open for many Indian businesses: how far a court will go in restraining an ex-employee who uses general know-how rather than a specific document. That line is fact-specific and not settled by a policy alone. Documenting what is genuinely secret, and why, is the practical way to make that distinction clearer later.
Frequently Asked Questions
Is a trade secret policy for employees mandatory in India?
No. Indian law does not require a private business to adopt a written trade secret policy. It is a risk-management choice. A written policy helps show that the business treated certain information as confidential, which can matter if it ever has to seek relief for misuse.
Is a policy enough without a signed confidentiality clause?
Usually not. A policy sets expectations, but enforceable obligations generally come from contract terms, so the policy should be linked to the appointment letter or employment agreement. A signed acknowledgement that the employee has read and accepted it adds further evidence.
Does the policy apply to contractors and interns?
It can, if they are told of it and agree to it in writing. Contractors and interns often sit outside the standard employment contract, so a short confidentiality agreement or an NDA is the more reliable way to bind them to the same rules.
How often should the policy be reviewed?
There is no set interval in law. Reviewing it when the business changes, such as a new product line, a new office, remote work or a key hire, is a sensible approach. A yearly check that access lists and exit practice match the document is also common.
Further Reading and Official Resources
For further reading on how confidentiality can be protected in practice, the WIPO pages on protecting corporate trade secrets describe tailored measures for companies of all sizes, including customised policies and procedures. The Government of Rajasthan's State Policy on Intellectual Property Rights 2021-2026 gives the state-level context for IP awareness in Rajasthan.
For wider IP choices, our overview of trademark vs copyright vs patent shows where trade secrets sit among the other rights. Any specific policy or clause should be checked against the facts and documents of the business concerned by a qualified advocate.
This content is published for general information only. It is not legal advice, an advertisement, or a solicitation of work, and reading it does not create an advocate-client relationship. In keeping with the Bar Council of India Rules, Riva Legal Associates does not solicit work or advertise.