How can I document who received confidential material and which terms they accepted?

Make one record for each disclosure

Give each exchange a reference and connect it to the material shared. Record the recipient’s name, organisation, role and contact address, together with the purpose, date, channel and exact file or collection revision.

Record separately what was offered and what the evidence shows happened. An email sent with an attachment, an invitation to a file portal and a logged download are different records. If several people need access, keep their individual records rather than treating one person’s activity as evidence for the whole group.

WIPO’s trade-secret management guidance treats contractual restrictions and access controls as complementary measures when information goes outside an organisation. A practical disclosure record connects those measures to a particular exchange.

Preserve the terms the recipient actually saw

Keep a fixed copy of the relevant NDA, confidentiality notice or sharing terms. Link it to the package and to the acceptance record. Saving only a webpage address is insufficient if the wording at that address can later change.

For a signed agreement, retain the executed document and any associated signature records. For acceptance through a portal, retain the terms version, the account or address involved, the event time and the recorded action. Also keep the invitation or covering message explaining why the recipient was asked to accept.

For example, if a technical adviser accepts terms before downloading revision 3, preserve that sequence. Do not later attach revision 4 or a rewritten set of terms to the same event and imply those were what the adviser accepted.

Check who is acting for the recipient organisation

A company email address helps connect an exchange to an organisation, but does not automatically establish authority to bind it. The UK Intellectual Property Office’s NDA guidance advises checking that the person signing has the necessary authority.

Where this matters, keep the relevant role confirmation or correspondence. An email verification code records access to a mailbox; it is not, by itself, a full identity check. Shared mailboxes and forwarded messages can make individual attribution less certain. Describe the evidence at the level it supports.

Explain what each event means

An invitation shows that access was offered. A delivery record may support receipt by a system. A view or download event records activity attributed to an account or session. Acceptance records an action relating to particular terms. These do not necessarily establish that the person read every document, understood the terms or complied with them afterwards.

If no access confirmation is available, say so. A subsequent reply discussing a drawing may be useful corroboration; silence is not confirmation of receipt or agreement. Retain the original messages and available logs, not only a summary you typed later.

Keep later access changes traceable

Record further recipients, new disclosures, revised terms and the ending of access. Withdrawal of online access does not retrieve files already downloaded or information already learned. Handle return, deletion and any permitted retention under the relevant agreement, preserving acknowledgements without presenting them as proof that every copy has disappeared.

Keep the record in controlled storage with the files and agreements it describes. Limit personal data to what is needed and set retention arrangements appropriate to the relationship. The employee NDA article illustrates why the connection between material, terms and recipients needs to survive personnel changes.

Use digital services to record the exchange

Digital services can help record what you shared, with whom and when. Registered email services, such as REM services in Europe and IncaMail in Switzerland, provide receipts documenting delivery events. Controlled file-sharing services can also record access to a specific version and require acceptance of confidentiality terms before opening it. Keep these records alongside the exact files and terms involved.

But recording a disclosure must not compromise the secret itself. Exposing confidential material to unintended recipients or unnecessary intermediaries can put its secrecy and trade-secret protection at risk. For sharing trade-secret material, our recommendation is to use only end-to-end encrypted services, so the contents are readable by the intended parties rather than the service provider. A delivery receipt or a “certified email” label does not itself guarantee that protection: check how the particular service handles encryption and access.

Share only what the recipient needs, under the agreed terms. Encryption protects the exchange; the recipient’s handling of the information still matters afterwards.