A customer pricing model copied by a departing manager, a supplier list forwarded to a personal email account, or source code shared too broadly with an offshore contractor can cause lasting commercial damage. Knowing how to protect trade secrets means treating confidential know-how as a business asset before it becomes the subject of a dispute.

For founders and growing businesses, the challenge is rarely a lack of useful information. It is deciding what genuinely needs protection, who needs access, and what practical controls will stand up when relationships change. This is particularly relevant where staff, suppliers, investors or operations span Australia, Hong Kong and Mainland China.

What counts as a trade secret?

A trade secret is commercially valuable information that is not generally known and is kept confidential. It may include product formulas, manufacturing processes, technical specifications, source code, customer and supplier information, pricing strategies, sales data, business plans, algorithms and unreleased research.

Not every piece of internal information is a trade secret. General industry knowledge, publicly available material and skills an employee has genuinely acquired may not be capable of being controlled in the same way. The stronger the information’s commercial value and the clearer your efforts to keep it confidential, the stronger your position is likely to be.

Unlike a patent or trade mark, trade secret protection does not arise from registration. In Australia and Hong Kong, protection commonly depends on contractual obligations and the law relating to confidential information. In Mainland China, trade secret rules also place weight on whether the information is non-public, commercially valuable and subject to reasonable secrecy measures. The legal detail differs between jurisdictions, but the practical lesson is consistent: confidentiality needs to be actively managed, not assumed.

How to protect trade secrets: start with an information audit

Many businesses use broad confidentiality clauses without first identifying the information they are trying to protect. That creates uncertainty for employees and makes enforcement harder later.

Start by mapping information that would harm the business if a competitor, former staff member or unauthorised third party obtained it. Consider where it is stored, who can see it, whether it has been shared externally, and whether it is still confidential in practice. A spreadsheet sent to every manager is unlikely to be treated with the same care as a restricted file held by a small commercial team.

Classify material in a practical way. For example, information may be labelled public, internal, confidential or highly confidential. The label alone is not decisive, but it helps staff recognise their obligations and supports the wider system of protection. Your highest-value material should have a clear owner within the business, rather than being nobody’s responsibility.

This audit should also identify unnecessary copies. Old folders, former project channels, personal devices and unmanaged cloud drives are common points of exposure. Retaining information indefinitely is not always safer. Often, reducing the number of copies reduces the risk.

Put the right legal terms around the right people

Confidentiality obligations should be built into employment contracts, contractor agreements, consultancy arrangements, supplier terms, joint venture documentation and non-disclosure agreements. The document should define confidential information in a way that is broad enough to cover real business assets, while being clear enough to be understood and enforced.

A well-drafted agreement usually addresses how information may be used, who it may be disclosed to, how it must be stored, what happens on termination, and the return or destruction of material. It should also deal with intellectual property created during the engagement where that is relevant. An obligation to keep information confidential is less useful if the business does not clearly own the work product that contains it.

Do not rely on an NDA as a substitute for commercial judgement. An NDA may be suitable before early discussions with a potential buyer, investor, manufacturer or strategic partner. But before releasing sensitive information, consider whether the recipient truly needs it and whether a staged disclosure is possible. Share enough to assess the opportunity, not every detail that makes the opportunity valuable.

Post-employment restraints can sometimes assist, but they are not a universal answer. In Australia, restraints must generally go no further than reasonably necessary to protect legitimate business interests. An overreaching restraint may be difficult to enforce. Clear confidentiality obligations, carefully managed access and a disciplined exit process are often more reliable than relying on a broad non-compete clause.

Make access controls match the commercial risk

Legal documents matter, but they do not prevent an accidental download or an unauthorised forwarding of files. Trade secret protection needs operational controls that fit the size and risk profile of the business.

For highly sensitive information, adopt a need-to-know approach. A sales employee may need selected customer details, but not full margin data or the company’s acquisition strategy. A developer may need access to a defined code repository, but not unrelated commercial files. Access should be reviewed when people change roles, not only when they leave.

Four practical controls are particularly useful:

• Use role-based permissions, multi-factor authentication and separate access for administrators.
• Keep valuable files in managed systems with activity logs, rather than personal email accounts or uncontrolled shared drives.
• Limit downloading, printing and external sharing for highly confidential material where appropriate.
• Maintain a clear process for removing access immediately when an employee or contractor leaves.

These measures should be proportionate. A small business does not need enterprise-level systems simply because it has one confidential spreadsheet. However, if that spreadsheet determines pricing across a major market, basic controls may no longer be enough. The question is whether your safeguards reflect the likely harm from disclosure.

Train people to recognise confidential information

Most trade secret losses do not begin with deliberate theft. They begin with unclear expectations, hurried work practices or staff who do not understand that sending files to a private account creates a real risk.

Provide targeted induction training and repeat it when staff begin handling more sensitive work. Explain what information is confidential, why it matters commercially and what employees should do if they need to share it with a customer, adviser or supplier. Policies should be short enough to be used, not simply stored in an unread handbook.

Managers need a slightly different level of guidance. They should know when to involve legal advisers before entering a new partnership, outsourcing a function, granting data-room access or discussing technology with a prospective investor. A business that treats confidentiality as a routine decision point is less likely to create an irreversible disclosure.

Take extra care in cross-border operations

Cross-border business adds practical complexity. Information may be held on servers in one country, accessed by staff in another and disclosed to a supplier in a third. Language differences can also create gaps between the legal document signed and the commercial understanding of the parties.

For arrangements involving Australia, Hong Kong or Mainland China, agreements should clearly identify the confidential information, permitted purpose, governing law, dispute process and obligations on return or deletion. Where a Chinese-language version is required for staff, suppliers or local operations, it should accurately reflect the intended legal and commercial position rather than being treated as an afterthought.

It is also sensible to check whether data protection, cybersecurity, employment or industry-specific rules affect how the information can be accessed or transferred. Customer data may be both confidential and regulated personal information, which creates obligations beyond trade secret protection. Technical data may also raise export control or national security considerations depending on the sector.

Cultural fluency matters here as much as documentation. In some commercial settings, relationship-based sharing is expected and a request to sign an NDA may be handled differently than it would be in Australia. That does not mean abandoning protections. It means explaining the purpose clearly, setting workable boundaries and using documentation that the parties can genuinely follow.

Respond quickly when confidentiality is at risk

If you suspect a trade secret has been taken or disclosed, preserve evidence before acting. Secure relevant accounts, retain system logs, document what information is involved and identify who had access. Avoid making accusations before the facts are clear, particularly where an employee relationship or key commercial contract is still in play.

The right response may range from a practical request for return and deletion through to a formal demand, urgent court action or a negotiated resolution. Timing matters because confidential information can lose much of its value once it becomes widely available. Early legal advice can help the business protect its position without escalating the problem unnecessarily.

The most useful protection is not a document signed years ago. It is a living process that identifies valuable information, limits access sensibly and gives people clear rules when opportunities, roles and markets change. For a business growing across borders, that process creates confidence to share what is necessary without giving away what makes the business distinctive.