Why companies should protect trade secrets before a leak happens

When a company learns that an employee has left with important technical data or business information, or has moved to a competitor, it treats this as a trade secret leak and begins to consider legal action. In an actual dispute, however, there is a threshold the company must clear first: whether the leaked information qualifies as a "trade secret" that the law will protect.

Not every internal document a company has treated as important is a trade secret in the legal sense. Korea's Unfair Competition Prevention and Trade Secret Protection Act requires, as one condition for protection as a trade secret, that the information be "maintained as a secret." Although this requirement has been relaxed compared with the past, in actual disputes the key question is how the company has managed the information on a day-to-day basis, including who had access to it, whether it was managed in a way that made clear it was confidential, and whether employees were placed under confidentiality obligations.

In handling actual trade secret cases, it often turns out that even when the leak itself is fairly clear, the information cannot be protected as a trade secret because it was not properly managed beforehand. Even if the company insists the material was core information, its secrecy management may be found lacking if many employees could access it without meaningful restrictions, if it was stored without being distinguished from ordinary materials, or if the company only collected blanket security pledges without specifying which information was confidential. Even if the information was in fact leaked, if it is not recognized as a trade secret, legal action premised on trade secret misappropriation faces a fundamental limitation.

Managing the departure process also matters. Companies should have procedures in place to close the accounts and access rights the employee used, to confirm whether company materials have been returned or deleted, and, where necessary, to remind the employee of their confidentiality obligations. If a leak is already suspected, the order of the response also matters. Rather than immediately confronting the other party, the company may need to first identify what materials were taken and whether evidence such as access and transfer logs or emails remains, and to preserve that evidence. If litigation or criminal proceedings follow, these records become important evidence for proving the facts.

For this reason, corporate advice on protecting trade secrets should not end with drafting security policies or confidentiality pledges. It should start by deciding which information will be protected as trade secrets, and then set out, in a way that fits how the company actually works, who will have access to that information, how confidential information will be marked and stored, and what steps will be taken at each stage of an employee's tenure, from hiring through employment to departure.

The key point is that these measures should not be seen merely as internal administrative procedures. If you work backward from a future dispute, considering what the company would need to argue and what records it would use to prove it, what needs to be prepared in advance becomes clear. Anticipating the requirements and evidence needed in a dispute and building them into everyday management systems is an important role of corporate advice on trade secrets.

Companies doing business in the United States, or preparing to enter the U.S. market, need to consider one more thing. Korea has steadily relaxed the secrecy management requirement for trade secrets, and in 2019 even removed the phrase "reasonable efforts" from the statute. By contrast, the U.S. Defend Trade Secrets Act (DTSA) still expressly requires that the owner of a trade secret have taken "reasonable measures" to keep the information secret. Companies doing business in the United States therefore should not stop at asking whether their information would be protected as a trade secret in Korea; they also need to consider the level of protection required in the United States.

In particular, where a Korean headquarters and its U.S. subsidiary share important technical data or business information, or where local employees are hired, companies should check whether simply applying the security policies and confidentiality pledges used in Korea is enough. They need to prepare, in a way that fits their U.S. business and workforce, for questions such as what information will be shared with whom, how access rights and confidentiality markings will be managed, and how the return and deletion of materials will be confirmed when local employees leave.

Once legal action has begun in a trade secret case, the state of management before the leak cannot be changed. Which information was designated as confidential, who had access to it, and how it was managed are all matters decided before any leak occurs. Good corporate advice does not end with putting the necessary policies and documents in place. It should also include anticipating the possibility of an actual dispute and building the requirements and evidence that would be needed at that point into the company's everyday operations.