What records help demonstrate that a company treated particular information as a trade secret?

Identify the information being protected

Describe the particular formula, process settings, source code, dataset or commercial information the company wants to keep secret. Give it an internal reference, identify the relevant versions and storage locations, and name the person responsible for managing access. Avoid descriptions so broad that nobody can tell which information they cover.

Record why secrecy matters commercially: for example, a combination of process settings reduces waste, or disclosure of a pricing model would let competitors predict the company’s bids. Distinguish the confidential details from information already published or routinely shared without restrictions. Keep the description itself under appropriate access controls.

Once you have identified the information, connect it to the measures used to protect it. For example, a confidential formula should be linked to the laboratory’s access permissions, staff confidentiality agreements and records of any external disclosures. These show how the company put its decision to keep the formula secret into practice.

Keep evidence of access restrictions in practice

Preserve records showing who was authorised to access the information, why they needed it, and when access was granted, changed or removed. Useful records include permission lists, approval requests, system logs and, where relevant, visitor or restricted-area entry records.

Keep the system exports and enough detail to interpret them: which folder or files they cover, the period recorded and who the usernames identify. A screenshot of today’s permissions does not explain who could open the folder six months ago. Record gaps in logging rather than treating the absence of an entry as proof that nobody accessed the information.

WIPO’s protection guidance includes physical and technical access restrictions and periodic reviews of who needs the information. Preserve the review decisions too, such as removing a former project member’s access.

Link confidentiality duties to the people and files concerned

Retain signed employment clauses, contractor agreements and NDAs, including the versions and dates that applied. Connect them to the people receiving the information and the project or material covered.

For each external disclosure, record the recipient, purpose, exact files or versions shared, applicable terms and sharing date. Keep the signed terms or acceptance messages, together with any delivery or access records. An NDA alone does not identify what was subsequently disclosed; the file list and correspondence supply that connection.

Keep the confidentiality instructions employees received, together with dated training materials and attendance or acknowledgements. Concrete instructions might specify which project folders are restricted, who can approve external sharing and where confidential files may be stored. The USPTO’s trade secret toolkit gives examples of contractual and operational protection measures in the US context; it does not prescribe a universal checklist.

Record how the company responded to changes and problems

When someone changes role or leaves, retain the access-removal record, equipment-return checklist and any requested confirmation about returning or deleting confidential copies. A deletion confirmation documents what the person stated; it does not independently verify every device or copy.

If information was sent to the wrong recipient or exposed through an open link, preserve the incident details, the investigation and the steps taken to contain it. Keep dates and unresolved questions. Do not rewrite the history to suggest that controls were always effective.

WIPO’s management guide treats monitoring, responses to leaks and employee departures as parts of ongoing protection. Keep records of access reviews, leak investigations and departure checks alongside the original policies.

Preserve a dated history of the measures

For example, a manufacturer protecting a coating formula could retain the formula version, a note explaining its commercial value, the approved laboratory users, their confidentiality terms and access logs. When a testing partner receives selected results, add the NDA, the files disclosed and the access-expiry record.

Preserve and timestamp these collections as the formula, recipients or controls change. Successive collections help document which versions and protection records existed at each stage. For timestamping methods and their limits, see what a digital timestamp establishes.

Keep the original files, certificates and verification data. Timestamping supports when those records existed, but does not authenticate every statement or demonstrate that information remained secret. The agreements, system records and documented actions provide the evidence of how the company handled it. Protect this evidence collection as carefully as the confidential information it describes.