Reasonable Measures to Protect Trade Secrets: What Courts Expect

Last updated: November 2026

Trade secret protection in California exists only if the information is the subject of efforts that are reasonable under the circumstances to maintain its secrecy. (Civ. Code, § 3426.1, subd. (d)(2).) Courts look for confidentiality agreements, limited access, marking, and consistent treatment of the information as confidential. The standard is reasonable, not perfect, and it scales with the size of the business and the value of the secret. Kolmogorov Law, P.C. advises on protection programs and litigates the secrecy element in Orange County, Los Angeles, and across California.

Call (909) 235-6116 or contact us online to review whether your protections would hold up in court.

The element businesses control

A trade secret has two elements: independent economic value from not being generally known, and reasonable secrecy efforts. (Civ. Code, § 3426.1, subd. (d).) The first depends on the market. The second depends entirely on what the owner did before the dispute started. The federal Defend Trade Secrets Act phrases it as whether the owner has taken reasonable measures to keep the information secret. (18 U.S.C. § 1839(3)(A).)

I raise this element in nearly every trade secret case I defend, because a surprising number of plaintiffs cannot show that they treated the information as secret until the day the employee left. Our page on what counts as a trade secret covers the first element.

What courts have accepted as reasonable

The published decisions give a workable picture. In a case about a roofing company's customer compilation, the Court of Appeal found reasonable efforts on three facts. The company limited circulation of its customer lists, told employees through an employment agreement and a handbook that the information was confidential, and stored it on a computer with restricted access. (Morlife, Inc. v. Perry (1997) 56 Cal.App.4th 1514, 1521-1523.)

In a case about a lock manufacturer's pricing and strategy, the same court treated a confidentiality agreement signed by executives as a reasonable step to ensure secrecy. Information that was not publicly disseminated and was covered by that agreement was treated as protected. The exception was information the company had disclosed to a major customer without a secrecy agreement in the record; that information could not be treated as a trade secret. (Whyte v. Schlage Lock Co. (2002) 101 Cal.App.4th 1443 [125 Cal.Rptr.2d 277, 286-287].)

Those two cases describe the floor. Written agreements, restricted access, and consistent internal messaging usually satisfy the element. Disclosure outside the company without a confidentiality obligation usually defeats it.

Where businesses lose the secrecy element

Three patterns account for most of the losses I see.

The shared drive with no permissions. A company's pricing models, customer database, and product roadmap sit in a cloud folder that every employee, including interns and departed contractors whose credentials were never revoked, can open. The information may be valuable, but a court will ask why nobody treated it as secret.

The customer who was never bound. A manufacturer sends detailed cost breakdowns and process descriptions to a large customer during a bid, without a non-disclosure agreement. The customer is free to share them, and the manufacturer has given up the ability to claim them as secret, as the lock company learned.

The agreement nobody signed. The company has a good confidentiality agreement in its template folder. Half the staff signed it. The engineer who left was hired in a rush and never did.

What a trade secret protection program looks like

Reasonable efforts are a set of habits, not a single document. These are the ones I recommend to clients of all sizes.

Written confidentiality agreements with every employee and contractor who touches the information, signed at the start of the relationship. The agreement should define confidential information by category, require return of materials on departure, and include the federal whistleblower immunity notice. Without that notice, an employer cannot recover exemplary damages or attorney fees under the federal statute against an employee who did not receive it. (18 U.S.C. § 1833(b)(3)(A), (b)(3)(C).)

Non-disclosure agreements with customers, vendors, and prospective partners before any secret is shared, and a record of what was shared with whom.

Access limited to the people who need it, with permissions that are reviewed and revoked on departure.

Marking. Documents and folders that contain secrets should say so. Marking everything "confidential" dilutes the signal; marking the crown jewels sharpens it.

Onboarding and exit procedures. New hires are told what is confidential. Departing employees return devices, certify deletion, and are reminded of their obligations. Our page on the departing employee protocol sets out the steps.

Reasonable, not perfect

The statute asks for efforts reasonable under the circumstances. A three-person startup is not expected to run the security program of a defense contractor. Courts weigh the cost of a measure against the value of the secret and the risk of disclosure. What matters is consistency: a company that says the information is secret and acts that way, even modestly, is in a far better position than one with a lavish policy nobody followed.

Security that exists on paper only, or that was imposed for the first time after the employee gave notice, tends to persuade a court that the information was not treated as a secret when it mattered.

How the element plays out in litigation

The secrecy element shows up at every stage. At the temporary restraining order hearing, the declaration describing the protective measures is often the difference between an order and a denial. Under Code of Civil Procedure section 2019.210, the plaintiff must identify the secret before taking discovery, and a plaintiff who cannot describe how it was protected has a hard time describing what it is. And a claim brought over information the plaintiff never protected invites a bad faith fee award. (Civ. Code, § 3426.4.)

Our trade secret misappropriation guide covers the full claim, and our page on DTSA and CUTSA claims explains the forum choice.

What to bring to the first meeting

Bring your confidentiality and non-disclosure agreements, your employee handbook, a description of how the information is stored and who can reach it, any access logs, and the agreements with customers or vendors who have seen the information. If a dispute has already started, bring the demand letter or complaint and a timeline of when each protective step was put in place.

Frequently asked questions

What are reasonable efforts to maintain secrecy?

Steps a prudent business would take, given the value of the information and the risk of disclosure, to keep it from becoming generally known. Courts have accepted confidentiality agreements, limited circulation, restricted computer access, and employee handbook provisions. (Morlife, Inc. v. Perry (1997) 56 Cal.App.4th 1514, 1521-1523.) The measures must be in place before the dispute, not adopted in response to it.

Is a confidentiality agreement enough to protect trade secrets?

It is a reasonable step and often the most important one, but it is rarely sufficient alone. A court will also ask whether access was limited and whether the information was shared outside the company without restriction.

Does disclosing information to a customer destroy trade secret protection?

It can. Information disclosed to a customer without a confidentiality obligation may lose protection, because the customer is free to pass it along. (Whyte v. Schlage Lock Co. (2002) 101 Cal.App.4th 1443 [125 Cal.Rptr.2d 277, 287].) A signed non-disclosure agreement before the disclosure preserves the claim.

Do I need to mark documents as confidential?

Marking is not required by statute, but it is strong evidence of effort and of notice to employees. Selective marking of the documents that matter is more persuasive than a blanket "confidential" footer on every page the company produces.

How much security does a small business need?

Enough to show the information was treated as secret in a way that fits the business. Signed agreements, password-protected storage limited to those who need it, and a basic exit procedure will usually satisfy the element for a small company. The standard is reasonableness under the circumstances. (Civ. Code, § 3426.1, subd. (d)(2).)

Talk to a California trade secret attorney

To review your protection program or to litigate the secrecy element, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is at 327 Magnet, Irvine, CA 92618, and represents businesses in Orange County, Los Angeles, and throughout California. See also our trade secret attorney page.

This page provides general information about California law and is not legal advice. Outcomes depend on the information, the measures actually taken, and the court.