Trade secrets for the CEO: when an engineer leaves with data, what must the company prove?

A core engineer leaves with data. What must the company prove to claim trade secret protection?

Article 2 of the Trade Secrets Act requires three elements at once: not known to people generally involved with that kind of information, actual or potential economic value because of its secrecy, and reasonable confidentiality measures taken by the owner.

Courts look at whether measures exist, are visible and are carried out:

• Information is graded and marked confidential
• Confidentiality agreements specify their scope
• Access is limited to named people, with access records
• Confidentiality contracts are in place before disclosure to outsiders

An NDA alone is not enough to count as reasonable measures. The key is to have logs and grading before anyone leaves; adding them afterwards is too late.

On criminal liability, domestic infringement carries up to 5 years' imprisonment and an optional fine of NT$1 million to 10 million; with intent to use the secret abroad, in mainland China, Hong Kong or Macao, 1 to 10 years and an optional fine of NT$3 million to 50 million (Articles 13-1 and 13-2).

A new hire brings in and uses data from a previous employer. Can our company be fined too?

It can. As the service page summarises Article 13-4 of the Trade Secrets Act: when a company's representative or employee commits an offence under Article 13-1 or 13-2 in the course of business, the company is also fined.

The Intellectual Property Office's Trade Secret Judgment Quarterly (Q4 2025) explains that the article punishes the company's own breach of its duty of supervision, so the company is punished only if it did not do its best to prevent unlawful acts by its representatives or employees; the company may show that it has implemented a compliance system or rules with similar effect and claim the exemption in the proviso. In one judgment summarised there, the court weighed facts including:

• Recruiters were asked to inform candidates of their confidentiality duties
• Employees signed confidentiality agreements on joining
• Information security audits were carried out
• Trade secret training was given after joining

Whether a company meets the proviso is for legal counsel to judge case by case. What the CEO can do is give "prevention" a system and records: training with sign-off records, and access and logging controls.

Should R&D results be patented or kept as trade secrets?

This is a business decision, not only a legal one. The service page compares them:

If the information is already public (trade shows, papers, published patents) or anyone can easily reverse-engineer it from the product, trade secret protection does not apply and patents or contracts should be used instead. The first phase on the service page decides, item by item, between trade secret, patent and contract protection.

Should every employee sign a non-compete?

No. Article 9-1 of the Labor Standards Act sets four requirements:

1. The employer has a legitimate business interest that needs protection
2. The employee's position gives access to or use of trade secrets
3. The period, region, scope of activity and employers covered are reasonable (at most 2 years)
4. The employer gives reasonable compensation for the employee's loss from not competing (not counting pay received during employment)

An agreement that fails the four requirements is void. It is only effective when signed for positions with access to secrets and when compensation is stated; signing everyone up does the opposite.

The CEO decides which positions count as having access to core secrets and the compensation budget; HR and legal then build it into joining, employment and exit.

Is our technology a national core key technology, and what more must we do?

First confirm whether it applies:

• National Security Act, Article 3: prohibits obtaining trade secrets of national core key technologies by improper means; such technologies must be identified and take effect on announcement by the Executive Yuan. It applies only to technologies identified and announced, not to all R&D.
• Act Governing Relations between the People of the Taiwan Area and the Mainland Area, Article 9: people working on projects commissioned, subsidised or funded by government agencies above a set threshold and involving identified technologies need approval to enter mainland China, including for three years after leaving. It applies only to such project staff.

Whether your technology falls within the announced items must be checked against the authority's announced list, item by item, and confirmed by legal counsel. Either way, the reasonable measures under Article 2 of the Trade Secrets Act are the baseline.

The board and the ESG evaluation look at IP management. What must the CEO account for?

• ESG indicator S-10 (same wording in 2026 and 2027, A+ item): whether the company has drawn up and disclosed an intellectual property management plan linked to business goals, with its implementation, reported to the board at least once a year. Implementing the Taiwan Intellectual Property Management System (TIPS), ISO 56001 or a similar IP management system standard with third-party certification adds one point overall.
• ISO 56001:2024: a certifiable innovation management system standard that requires managing knowledge and intellectual property in the innovation process; the trade secret list, patent portfolio and knowledge management are one asset register. As listed on the service page, ISO 56001 usually takes 6–9 months.
• Shared with ISO 27001: 27001's information classification, access control and logging are the technical evidence of reasonable measures.

The ESG evaluation covers listed companies; companies that are not public companies are not evaluated and can use the indicators voluntarily.

How does Winners Consulting help a CEO with trade secret protection?

This is Winners Consulting's own description; hold us to the questions above.

• Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced
• Only measures a court can see: every measure maps to a failure pattern in the judgment compilations or to a statutory element
• Law, management and technology together: grading, contracts and exit procedures designed under the Trade Secrets Act; the technical side through ISO/IEC 27001; IP management through ISO 56001
• Lawyers connected, not replaced: litigation, applications for investigation confidentiality orders and final legal opinions on contracts come from partner lawyers
• Timeline (as listed on the service page): four phases, usually 3 to 6 months; at the end we simulate a departing employee taking data, from logs to evidence preservation
• Named clients: MediaTek (trade secret protection consulting), MPI Corporation (ISO 27001 ISMS and trade secret protection consulting)
• First step: the first mechanism diagnosis is free

Go deeper: Trade secret protection programme, ISO 56001 innovation management system, Choosing a trade secret consultant, CTO role page