Protecting Trade Secrets in a Serbian Company: Legal Measures and Common Mistakes

The salesman leaves the company and takes with him an Excel table with clients, contacts, prices and special conditions of cooperation. A few weeks later he starts working for a competitor.

Does the company thereby automatically acquire the right to demand protection of its trade secret?

Not necessarily.

The fact that some information is internal or confidential does not in itself constitute a trade secret in the legal sense. The protection of a trade secret depends on the nature of the information itself and on what the company has previously undertaken to preserve its secrecy.

According to the Act on the Protection of Trade Secrets, the information must meet certain conditions, among which is the requirement that the person who legally controls it take reasonable measures to preserving its secrecy.

That is why protection does not start when the employee goes to a competitor or when the documentation has already reached a third party. It starts much earlier, with proper contracts, internal procedures, access control and the way the company deals with sensitive information on a daily basis.

What is considered a trade secret?

Not every information that a company marks as confidential is automatically and legally protected a trade secret.

According to the Law on the Protection of Trade Secrets, information must cumulatively meet three basic conditions:

that it is not generally known or easily accessible to persons who normally deal with this type of information;

It has commercial value because it is a secret;

that reasonable measures have been taken to preserve its secrecy.

Depending on the type of business, a trade secret can be:

• customer and supplier databases;
• special price lists and commercial conditions;
• business and investment plans;
• information about negotiations;
• production processes;
• technical documentation;
• internal methodologies;
• algorithms and source code;
• sales and marketing strategies;
• know-how;

development plans for new products and services.

The key question is therefore not only whether the information is important to the company, but also whether it meets the legal criteria and whether the company has really treated it as information it wants to keep secret.

The “confidential” label alone is not enough

The “confidential”, “confidential” or “trade secret” label can be useful, but does not in itself create a complete system of protection.

If a document with such a label can be downloaded without restriction by a large number of employees, forwarded to a private email address or saved on a private cloud account, the label alone will not solve the problem.

The law recognizes as possible reasonable protection measures, among other things, the adoption of an internal act on dealing with trade secrets, limiting access, physical and electronic protection, marking documents and contracting confidentiality obligations.

In other words, legal protection must also be visible in the actual way of doing business.

Why is an NDA not enough?

A confidentiality agreement, or NDA, is one of the most important instruments for protecting confidential business information.

But it is not enough by itself.

A company that gives all employees access to the entire customer base, allows data to be downloaded to private devices and keeps no access logs, one generic NDA cannot be expected to solve all risks.

A good confidentiality agreement should clearly define:

• what information is considered confidential;
• for what purpose it may be used;
• to whom it may be disclosed. available;
• what protection measures the recipient must apply;
• what happens to the documentation after the termination of cooperation;
• how long does the obligation of confidentiality last;

what consequences may arise in the event of a violation.

The problem can also be posed by overly broad wording that covers almost every piece of information related to the business declares confidential.

A more efficient system identifies information that really requires protection and determines the appropriate regime for it.

Protection of trade secrets in relation to employees

A special risk exists when employees, due to the nature of their work, have access to customers, prices, financial data, technology, strategic plans or other sensitive information.

That is why protection should be arranged while the employment relationship lasts.

Obligations of employees regarding the storage of confidential information should be precisely linked to employment contracts, appropriate internal acts and procedures of the company.

The documentation should, to the extent necessary for a specific organization, arrange:

• what information is considered confidential;
• who has the right of access;
• how the employee is allowed to use them;
• whether downloading to local or private devices is allowed;
• what happens to the documentation after the termination of employment;

what confidentiality obligations continue to apply after termination engagements.

These questions should be harmonized with the entire labour law documentation of the company.

A special risk arises when an employee leaves

The procedure for an employee leaving the company should not be only administrative.

Depending on his position and level of access to information, you should consider:

• returning laptops, phones and other business equipment;
• deactivating business emails account;
• terminating access to servers and cloud services;
• returning business documents;
• checking the status of access orders;
• recording the materials to which the employee had access;

reminding of existing confidentiality obligations.

The worst time to establish such a procedure is after the company already suspects that the data has been taken.

Trade secret and non-compete are not the same

These two legal mechanisms are often mistakenly identified.

The confidentiality clause refers to the use and disclosure of certain information.

Prohibition of competition, under the conditions prescribed by labour law, can limit the performance of certain competitive jobs.

This means that the transfer of an employee to a competitor does not automatically constitute a violation of trade secrets.

A problem can arise if a former employee of a new employer makes unauthorized use of information from the previous company that meets the requirements for legal protection.

Therefore, confidentiality and non-competition should be treated as separate, though sometimes related, issues.

Can a customer database be a trade secret?

It can, but not automatically.

The mere fact that a company has a list of clients is not enough to make that database a trade secret in any case.

What matters is what the database contains.

A list of publicly available company names and their general contact information is not the same as an internal database that contains contacts of responsible persons, negotiation history, individual prices, rebates, commercial terms, client needs and other data that arose during a long-term business relationship.

How the company protects such a database is equally important.

If it is accessed by a limited number of employees, access is controlled, and rules of use are clearly regulated, the company will have a much stronger basis to claim that it really treated such information as a trade secret.

If the same database is copied, sent and stored on private devices uncontrolled for years, the situation is different.

Technical and organizational measures have legal significance

Protection of trade secrets is not only the job of the legal department.

The way in which the IT system and internal organization control information can be as important as contract documentation.

Depending on the nature of the business and the level of risk, the company can apply:

• individual user accounts;
• different levels of document access;
• the “need to know” principle;
• data access and download records;
• cloud control platforms;
• rules for using USB devices and external drives;
• rules for sending data outside the business system;
• procedures for working from home;
• classification of documentation;
• appropriate authentication methods;

training of employees.

The bottom line is simple: the fact that someone works for the company does not mean that he needs access to all the information that the company has.

Such measures simultaneously reduce the risk of unauthorized use and show that the company actively protects confidential information.

Trade Secrets in Relationships with Partners, Suppliers and Investors

Confidential information does not leave the company only when the employee changes jobs.

They are regularly exchanged during:

• negotiations on business cooperation;
• due diligence procedures;
• talks with investors;
• sale of a company or stake;
• joint development products;
• outsourcing arrangements;
• hiring consultants;
• IT development;

cooperation with distributors and suppliers.

The most important question is what the other party is allowed to do with the information it receives.

Therefore protection should be arranged before the disclosure of sensitive data, and not after the technical documentation, business plan or client base has already been submitted.

Confidentiality provisions should be harmonized with contracts on business cooperation and other commercial contracts.

10 common mistakes when protecting trade secrets

1. Everything is declared a trade secret

If every internal document is marked as a trade secret, the classification system practically stops distinguishing important information from everyday documentation.

A better solution: identify information that has real business value due to its secrecy and determine the appropriate level of protection for it.

2. There is an NDA, but there are no real safeguards

A contract can hardly compensate for the lack of access control and clear internal procedures.

A better solution: connect contractual protection with technical and organizational measures.

3. The confidentiality clause is generic

A provision copied from another contract may not correspond to a specific business relationship.

A better solution: precisely define the categories of information, the method of use and the obligations of the other party.

4. Too many people have access to sensitive information

The larger the circle of users, the more difficult it is for the company to control the use of data.

Better solution: organize access according to the business need and function of the employee.

5. It is not regulated to whom the documentation created during cooperation belongs

The problem is particularly pronounced with consulting, development and IT projects.

A better solution: the contract clearly regulates the rights to work results, documentation, data and confidential information.

This issue can also be intertwined with intellectual property rights, but trade secret, copyright, patent and trademark are not the same protection mechanisms.

6. Access remains active after the employee leaves

A former employee should not retain access to systems because someone forgot to deactivate the user account.

Better solution: include termination of access in the standard termination procedure.

7. Business data is on private devices

Private laptops, email accounts and cloud services can make it significantly more difficult to control information.

A better solution: clearly regulate when the use of private devices is allowed and how the data must be protected.

8. The company reacts only when the information is leaked

Then the focus shifts from prevention to proving and limiting the consequences.

A better solution: establish a protection system before the incident occurs.

9. Trade secret is mixed with other rights

Patent, trademark, copyright, non-competition and trade secret have different functions.

A better solution: for each important business value determine the appropriate legal mechanism or combination of mechanisms.

10. There is no proof who had access

A company can claim that a document was confidential, but in case of a dispute it is important to be able to prove how it protected it.

A better solution: arrange access logs, document distribution, file versions and appropriate internal procedures.

What can a company do if a trade secret is violated?

The Law on the Protection of Trade Secrets provides for civil protection mechanisms in case of illegal acquisition, use or disclosure of a trade secret.

Depending on the circumstances of the specific case, one may request, among other things, the establishment of a violation, the cessation or prohibition of certain actions, measures related to documents or goods related to the violation, as well as compensation for damages under the conditions prescribed by law. The law also provides for the possibility of determining temporary measures when the appropriate conditions are met.

In practice, it is therefore very important to quickly provide relevant evidence, such as:

• contracts and confidentiality agreements;
• internal acts;
• email communication;
• logs access;
• document download records;
• data on user accounts;
• information classification documentation;
• evidence that employees were familiar with the rules;

communication with an employee, partner or other relevant person.

When a dispute already exists, the legal protection of trade secrets can be connected to broader commercial disputes, litigation or arbitration.

How to set up a trade secret protection system in a company?

A good system does not mean that every document must be treated as strictly confidential.

The measures should be adapted to the importance of the information and the real business risk.

1. Identify information that has real business value

The first question is simple: what information would give a competitor an advantage if they obtained it?

2. Classify information

Different types of data may require different levels of protection.

3. Determine who really needs to have access

Access should follow a business function, not just the fact that someone is employed by the company.

4. Harmonize contracts and internal documents

Employment contracts, NDA documents, agreements with partners and internal procedures should function as one system.

5. Introduce technical and organizational measures

Legal documentation must be supported by a real data management method.

6. Educate employees

Employees should know what information is confidential and how to handle it.

7. Arrange exit procedures

Both employees and external collaborators should lose access to information when there is no longer a business need for it.

8. Periodically review the system

Changes in technology, organization, work methods and business relationships require periodic review of existing rules.

Trade secret protection starts before a problem arises

A company that first seriously considers a trade secret when an employee leaves for a competitor is already at a disadvantage.

Effective trade secret protection starts much earlier: identifying important information, restricting access, proper contracts, internal procedures and technical measures that are actually applied.

NDA can be an important part of that system, but it cannot replace it. replace.

The goal is that the company can clearly show at all times what information it considers particularly valuable, who has access to it, under what conditions it is used and what has been done to keep it secret.

Jusufović & Partners provides legal support to companies in the field of corporate law, commercial contracts, labour law, intellectual property and resolving business disputes. Timely analysis of existing contracts, internal acts and procedures can help to adapt the trade secret protection system to the specific business model and risks of the company.