Trade secret or patent: how do I choose?

A patent trades disclosure of the technology for a time-limited exclusive right and also protects against reverse engineering; a trade secret is not disclosed and has no statutory term, but independent development, or reverse engineering of a lawfully obtained product, is not infringement; once the information becomes known in the industry it loses secrecy and is no longer protected (if it leaks only to specific people, you can still seek removal of the infringement and damages under the Trade Secrets Act). Processes, formulas, source code and customer data are usually protected as trade secrets.

How long does trade secret protection consulting take?

Four phases (inventory and determination, programme design, implementation and training, verification and handover) usually take three to six months; when combined with ISO 27001 or ISO 56001, the timeline merges into that project.

How to choose a trade secret protection consultant in Taiwan: eight criteria

Direct answer: the first question to ask a trade secret protection consultant is "will a court be able to see the measures you build?" Article 2 of Taiwan's Trade Secrets Act requires information to have secrecy, economic value and reasonable confidentiality measures at the same time. The first two depend mainly on the information itself (a company that discloses the information itself also loses secrecy); the third is the one a company can most actively build, and one that is frequently disputed in litigation. In the judgment compilations of Taiwan's Intellectual Property Office, drawings without confidentiality marking, confidentiality agreements that did not specify their scope, and unclassified documents have all been among the reasons courts found reasonable confidentiality measures lacking (courts weigh several gaps together). Next, check how the consultant divides the work with lawyers: the consultant builds the programme and the evidence; litigation and the final legal opinion come from a lawyer.

Three kinds of trade secret helper on the market

Role	What they mainly do	Best suited to
Law firms	Legal opinions on contracts; litigation and criminal complaints after an infringement	A leak has already happened, rights must be enforced, or key contracts need review
Security tool vendors	Access control, logging, watermarking, data loss prevention (DLP) and similar tools	Implementing and automating technical controls
Management consultants	Trade secret inventory and determination, grading, confidentiality clauses, exit procedures, training and evidence keeping	Turning reasonable measures into a programme that runs every day and produces evidence when something goes wrong

The three roles differ and most companies combine them. When choosing a consultant, confirm they know where they sit among the three.

Eight criteria

Criterion	A question you can put to any consultant
Determination under the law	Will you check each item against the three elements of Article 2 and decide which information is a trade secret and which should be protected by patent or contract instead?
Measures a court can see	Grading, confidentiality marking, a register of who knows, access records: where is the evidence we could produce if something happens?
Specific confidentiality clauses	Do our confidentiality agreements state the protected scope specifically, rather than just "all business information"?
Lawful non-competes	Do they meet all four conditions of Labor Standards Act Article 9-1: a legitimate business interest to protect, a position with access to or use of trade secrets, a reasonable period (at most two years), area, scope of activity and employers, and reasonable compensation (excluding pay received during employment)?
Exits and leak response	What is the procedure for returning materials, revoking access and preserving evidence? Has it been rehearsed even once?
Division of work with lawyers	Who builds the programme? Who handles litigation, asking the prosecutor to issue an investigation confidentiality order and applying for a court confidentiality preservation order, and the final legal opinion?
Integration with existing systems	Can it share one document set with ISO 27001 information classification, access control and logging, and with ISO 56001 intellectual property management?
Who leads, and named cases	Who actually runs the engagement? Do you have named cases that clients have agreed to publish?

When you may not need a consultant

If the information is already public (exhibitions, papers, published patents) or anyone can easily reverse-engineer it from the product, it is no longer secret and trade secret protection does not apply. A patent is then limited by novelty (after the applicant's own disclosure, an invention patent must be filed within the 12-month grace period), and a contract binds only the parties who sign it. For technology that might be patented, decide the protection route before it is disclosed. If a leak has already happened and you are preparing to sue, the first call is to a lawyer: the programme can be fixed later, but evidence preservation cannot wait.

How Winners addresses these criteria

What follows is Winners' own account. Use the questions above to test us in exactly the same way you test any other consultant.

Determination under the law: each item is checked against the three elements of Article 2 and assigned one of three protection routes: trade secret, patent or contract
Measures a court can see: a three-level grading rule (top secret, confidential, internal), confidentiality marking, a register of who knows, and an access control and logging specification
Confidentiality clauses and non-competes: four template sets (joining, employment, leaving, external parties); non-competes checked clause by clause against Labor Standards Act Article 9-1
Exits and leak response: exit procedures and an evidence preservation handbook; after implementation we simulate one case of a leaver taking data and run it from logs to evidence preservation
Division of work with lawyers: Winners builds the programme and the evidence chain; litigation, asking the prosecutor to issue investigation confidentiality orders, applying for court confidentiality preservation orders and the final legal opinion on contracts are handled by partner lawyers
Integration with existing systems: one document set shared with ISO/IEC 27001:2022 (Annex A 5.12, 5.15, 8.15) and ISO 56001
Who leads: VP- and director-level consultants guide the whole engagement and nothing is outsourced
Named cases: clients published with their authorisation for trade secret protection consulting include MediaTek and MPI Corporation

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.