Trade secrets for the CHRO: what evidence to keep at hiring, non-compete and exit

If a new hire brings in and uses a former employer's data, can our company be fined? How does HR prevent it?

It can. Article 13-4 of the Trade Secrets Act provides that when a company's representative or employee commits an offence under Articles 13-1 or 13-2 in the course of business, the company is also fined, unless it did its best to prevent the conduct. The commentary in the Intellectual Property Office's trade secret judgment bulletin for Q4 2025 explains that the article punishes the company's own failure in its duty of supervision.

In one judgment the bulletin covers, the company was found to have done its best to prevent the offence. Facts the court weighed include:

• When recruiting through an agency, the contract required the agency to remind candidates of their confidentiality duty toward current or former employers' trade secrets
• When the employees joined, the company again had them sign a written agreement not to disclose the former employer's confidential information
• The company ran an information security audit system that met an international certification standard
• Soon after the employees joined, the company gave on-the-job training that included not leaking others' trade secrets

All four sit in HR processes. Whether the proviso applies is for legal counsel to judge case by case.

Who should sign a post-employment non-compete, and how much compensation is required?

Under Article 9-1 of the Labor Standards Act, all four requirements must be met; if any one is breached, the agreement is void:

1. The employer has a legitimate business interest that needs protection
2. The worker's position or duties give access to or use of the employer's trade secrets
3. The period, area, scope of activity and prospective employers are within a reasonable range; the period may not exceed two years
4. The employer gives reasonable compensation for the worker's loss from not competing (excluding pay received during employment)

The Ministry of Labor explains that under Article 7-3 of the Enforcement Rules, monthly compensation may not be less than 50% of the worker's average monthly wage at departure, and the agreement must provide for either a lump sum paid in advance after departure or monthly payments.

HR's job: list the roles with access to trade secrets and check them against the list of people who know each secret; sign non-competes only for those roles and budget the compensation. Signing them with every employee makes them void. Whether an agreement is valid is for the courts to decide case by case.

How specific does a confidentiality agreement have to be for a court to accept it?

Courts look at whether measures exist, are visible and are carried out. Key points from the service page:

• Specific scope: the agreement should specify which information must be kept confidential; courts have found vague, sweeping scopes to be poorly defined.
• Signing is not enough: a signed confidentiality agreement does not on its own amount to reasonable measures; it needs information classification and confidentiality labels, limited access and access records.
• One onboarding document: combine the NDA, IP ownership, non-compete and security commitments into one onboarding document, so departments do not issue separate, conflicting versions.
• Four points in time: Winners Consulting prepares four templates, for joining, during employment, leaving and external parties, so the confidentiality duty is in writing at every stage.

The final legal opinion on any agreement comes from a lawyer.

After an employee resigns, what must HR finish before their last day?

The key is that logs and classification exist before anyone resigns; adding them afterwards is too late. At exit, you need to do everything in one pass:

The service page recommends one checklist that covers returning devices, disabling access and signing the exit declaration together. If data has already leaked and you are preparing to sue, call a lawyer first; the system can be fixed later, but evidence preservation cannot wait.

Some R&D staff work on national core key technologies. What extra does HR need to manage?

First confirm whether the rules apply:

• National Security Act, Article 3: prohibits obtaining trade secrets in national core key technologies by improper means; a national core key technology must be designated and take effect by Executive Yuan announcement. It applies only to announced, designated technologies, not to all R&D.
• Act Governing Relations between the People of the Taiwan Area and the Mainland Area, Article 9: people engaged in work involving designated technologies that is commissioned, subsidised or funded by government agencies above a set threshold need review and permission before entering mainland China; this also applies within three years after leaving. It applies only to such project staff.

What HR can do is confirm the list of these people with R&D and legal, tell them of their duties when they join and leave, and keep a record of the notice. Whether a technology falls within the announced items must be checked item by item against the competent authority's announced list and confirmed by legal counsel.

The board and the ESG evaluation look at IP management. What does HR provide, and how long does it take?

• ESG evaluation item S-10 (same wording in the 2026 and 2027 evaluations, A+ type): has the company set and disclosed an IP management plan linked to operating goals and its implementation, reporting to the board at least once a year? Companies that adopt the Taiwan Intellectual Property Management System (TIPS), ISO 56001 or a similar IP management system standard with third-party certification gain one extra point. The evaluation covers listed companies; companies that are not public companies are not covered and can use it voluntarily.
• Implementation evidence HR can provide: signature records for confidentiality and non-compete agreements, trade secret training records and records of the exit process.
• Shared with ISO 27001: ISO 27001 information classification, access control, logging and people security serve as evidence of reasonable confidentiality measures.
• Timeline (as listed on the service page): the four phases of a trade secret protection programme usually take 3 to 6 months; ISO 56001 usually takes 6–9 months.

How does Winners Consulting help a CHRO with trade secret protection?

This is Winners Consulting's own description; hold us to the questions above.

• Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced
• Confidentiality and non-competes: four templates for joining, during employment, leaving and external parties; non-competes checked clause by clause against Article 9-1 of the Labor Standards Act
• Exit and leak response: an exit procedure and evidence preservation handbook; after implementation we simulate one case of a leaver taking data and run it from logs to evidence preservation
• Fits existing systems: one set of documents shared with ISO/IEC 27001:2022 and ISO 56001
• Division of work with lawyers: Winners Consulting builds the system and evidence chain; litigation, applications for investigation confidentiality orders and final legal opinions on contracts are handled by partner lawyers
• Named clients: clients who have authorised disclosure of our trade secret protection work include MediaTek and MPI Corporation

More: Trade secret protection programme, Choosing a trade secret consultant, ISO 27001 consulting, CTO role page