Trade secret protection for CTOs: how to classify R&D data and what records to keep

When is R&D output protected by the Trade Secrets Act, and does it belong to the company or the engineer?

Under Article 2 of the Trade Secrets Act, information usable in production, sales or business must meet three elements at the same time:

• It is not known to people generally involved with that type of information (secrecy)
• It has actual or potential economic value because of its secrecy
• The owner has taken reasonable confidentiality measures

The first two depend mainly on the information itself, and a company that discloses it also loses secrecy; the third is the one a company can most actively build and the one most often disputed in litigation. Under Article 3, trade secrets researched or developed by employees in the course of their duties belong to the employer unless the contract provides otherwise. Trade secrets need no registration and have no standalone certificate.

Which confidentiality measures that a court can see should R&D document management keep?

Courts look at whether measures exist, are visible and are carried out. A CTO can build four of them into R&D document management:

In the judgment compilations of Taiwan's Intellectual Property Office, drawings without confidentiality marking, agreements that did not specify their scope and unclassified documents have all been among the reasons courts found reasonable measures lacking.

Should R&D output be patented or kept as a trade secret?

A patent trades disclosure for a time-limited exclusive right and also protects against reverse engineering; a trade secret is not disclosed and has no statutory term, but independent development by others, or reverse engineering of a lawfully obtained product, is not infringement. Processes, formulas, source code and customer data are mostly protected as trade secrets.

Timing matters: information already disclosed at a trade show, in a paper or in a patent, or easily reverse-engineered from the product, has no secrecy; after an applicant's own disclosure, an invention patent application must be filed within the 12-month grace period. Decide the protection route before any disclosure. The choice in each case is for a patent attorney or legal counsel to judge.

Engineers may leave with R&D data. What should a CTO prepare in advance?

• Departure procedure: return of data, access revocation and evidence preservation need a written procedure and one real drill, for example simulating a departure-with-data incident from logs to evidence preservation.
• Non-compete: it must meet all of Article 9-1 of the Labor Standards Act: a legitimate business interest to protect, a position with access to or use of trade secrets, a period (at most 2 years), region, scope of activity and employers that are not unreasonable, and reasonable compensation. Whether a clause is valid is for legal counsel to judge case by case.
• If data has already leaked: call a lawyer first; the programme can be completed later, evidence preservation cannot wait.

Is every government-funded R&D project a national core key technology?

No. National core key technologies must be identified and take effect on announcement by the Executive Yuan; Article 3 of the National Security Act, which prohibits obtaining trade secrets of national core key technologies by improper means, applies only to technologies identified and announced, not to all R&D.

The approval requirement for entering mainland China under Article 9 of the Act Governing Relations between the People of the Taiwan Area and the Mainland Area likewise applies only to people working on government-commissioned, subsidised or funded projects above a threshold that involve identified national core key technologies, including those who left less than three years ago. Whether a project is covered depends on the official announcement and a case-by-case judgment.

How does trade secret protection fit the R&D cycle of internal control and ESG indicator S-10?

Under Article 7, item 8 of the Regulations Governing Establishment of Internal Control Systems by Public Companies, the R&D cycle covers R&D records and document keeping and the acquisition, maintenance and use of intellectual property; trade secret grading, marking and access records can join the same process rather than a second one. These regulations apply to public companies; companies that are not public companies are not bound by them but may refer to them voluntarily.

Indicator S-10 of the TWSE ESG evaluation asks about an IP management plan linked to business goals and its implementation, reported to the board at least once a year; TIPS, ISO 56001 or a similar standard with third-party certification earns one extra point overall. The evaluation covers listed companies; others may refer to it voluntarily.

How does Winners help a CTO with trade secret protection?

The service page lists four stages, typically 3 to 6 months depending on company size and information scope: inventory and determination (2–4 weeks), programme design (4–6 weeks), rollout and training (4–8 weeks), verification and handover (2–4 weeks).

• Check each item against the three elements of Article 2 and assign it a trade secret, patent or contract route
• A three-level grading rule (top secret, confidential, internal); four agreement templates for joining, employment, departure and external parties
• Technical controls through ISO/IEC 27001; IP management through ISO 56001
• VP- and director-level consultants lead throughout, never outsourced; litigation is handled by partner lawyers
• Named clients: MediaTek, MPI Corporation

Trade secret protection programme｜Choosing a trade secret consultant｜CTO guide｜Apply for a free mechanism diagnosis