Skip to content
Perspectives

ReferenceInternational Business Law

Effective protection of trade secrets

Requirements for confidentiality measures and the burden of pleading and proof in trade-secret cases, with notable rulings on catch-all employment clauses.

Peter Poleacov9 min

Effective protection of trade secrets

Background

On 26 April 2019, the German Trade Secrets Protection Act (Geschäftsgeheimnisgesetz, GeschGehG) entered into force, transposing Directive (EU) 2016/943 on the protection of trade secrets against unlawful acquisition, use, and disclosure into German law. Since then, several court decisions have been issued, summarized below.

What the measures actually are

Protection turns on a single requirement that the company itself controls: adequate confidentiality measures (Section 2 No. 1 lit. b GeschGehG). They fall into three layers, and none substitutes for another:

  • Organizational: risk analysis and classification of information, graded access rights, internal training.
  • Technical: access controls and restrictions, encryption, IT security.
  • Legal: a non-disclosure agreement, specifically framed confidentiality clauses in employment and service contracts, and supporting industrial property rights.

How much is needed depends on the case. The Higher Regional Court of Düsseldorf named the standard: it is objective, and the statute requires neither optimal protection nor extreme security. What counts is the nature and value of the secret, its development costs, its significance for the business, the size of the company, the measures customary there, how the information is marked, and the agreements in place with employees and business partners. The Higher Regional Court of Hamm adds the economic value, the competitive advantage secrecy confers, the difficulty of keeping the information secret, and the concrete exposure.

The decisive sentence is the one most often missing from protection concepts: where implementation is absent or flawed, legal protection falls away. A concept in a drawer is not a measure.

Case law

Higher Labor Court of Baden-Württemberg (8th Chamber), order of 3 July 2025 – 8 Ta 1/25

  1. A party seeking to have information classified as confidential in proceedings under Section 16(1) GeschGehG must plead all requirements coherently, including the adequate confidentiality measures.

  2. Confidentiality obligations in an employment contract that do not relate to specific information but merely require silence in general terms do not amount to an adequate confidentiality measure. That confirms the Aachen line, now in an official headnote.

  3. Nor do a post-contractual confidentiality obligation that is invalid under Section 307(1) sentence 1 BGB or the employee’s general ancillary duty under Section 241(2) BGB.

  4. The technical protective measures were insufficient on the facts. The claimant’s appeal failed.

Higher Regional Court of Düsseldorf, judgment of 11 March 2021 – 15 U 6/20 (final)

  1. The technical information embodied in a CAD design drawing can, taken as a whole, be a trade secret. General availability is then assessed by reference to the drawing itself, not to individual devices or parts drawn in it.

  2. The standard for adequacy is objective; optimal protection is not required.

  3. The measures must have been in place from the entry into force of the GeschGehG.

Higher Regional Court of Hamm, judgment of 15 September 2020 – 4 U 177/19

  1. An injunction under Section 6 GeschGehG is available only where adequate confidentiality measures have been taken and breaches of those measures lead to a corresponding response by the company.

  2. The company must pursue every indication of circumvention diligently, adjust its security concept promptly, and impose sanctions where know-how is used without authorization or passed on.

Labor Court of Aachen, judgment of 13 January 2022 – 8 Ca 1229/20

  1. Where the defendant plausibly argues that competitors could have obtained the secret information through reverse engineering, the claimant must plead and, where necessary, prove in substance that knowledge not known on the market underlies its products.

  2. Where the defendant denies that reasonable confidentiality measures within the meaning of Section 2 No. 1 lit. b GeschGehG have been taken, the claimant must plead and, where necessary, prove in detail, with reference to specific information, which protective measures it has put in place to keep that information confidential.

  3. A blanket clause in the employment contract (see below) that extends to all operational information received during the employment relationship (a so-called catch-all clause) is not an adequate confidentiality measure within the meaning of Section 2 No. 1 lit. b GeschGehG.

“Mr/Ms [first and last name] shall maintain silence on all operational and trade secrets, as well as on all other matters and processes of the company that come to his/her knowledge in the course of his/her work. He/she shall ensure that no third party gains unauthorised knowledge thereof.”

Higher Labor Court of Baden-Württemberg, judgment of 18 August 2021 – 4 SaGa 1/21

  1. The court held that the price calculation at issue was the subject of confidentiality measures appropriate to the circumstances within the meaning of Section 2 No. 1 lit. b GeschGehG and qualified as a trade secret under Section 2 No. 1 GeschGehG. The claimant had implemented, among other things, a concrete IT policy, a need-to-know principle, and a corporate compliance system. The claimant had also used a contractual clause by which the defendant (a compliance officer) was bound to confidentiality regarding trade secrets, including after termination. In the court’s view, this clause was not too broadly framed: “operational and trade secrets connected with the management of [name of business area] and with confidential matters of the management board and the senior management” were expressly identified.

  2. An interim injunction prohibiting the use of a trade secret is unavailable for lack of a risk of first commission or repetition where the defendant’s affidavit establishes that the defendant no longer holds the trade secret.1

Practice notes

  • Catch-all clauses are invalid under the German rules on standard terms because they go beyond the employer’s legitimate interests. The employer’s legitimate business interest in confidentiality has to be tied to specific data and matters.2 This is also the prevailing view in legal literature.3

  • In a dispute, the claimant bears the burden of pleading and proof for the existence of a trade secret and the implementation of adequate confidentiality measures.

  • According to the Labor Court of Aachen, the claimant’s submissions on the adequacy of confidentiality measures must not be confined to generic descriptions of the overall protection level. They require a detailed account of the specific measures taken (trade-secret management), with particular focus on the specific information at issue. Beyond a list of measures, the claimant must describe specifically how those measures protect the information at issue.

  • Measures have to be lived, not just adopted. According to the Higher Regional Court of Hamm it is not enough to introduce them: a company that fails to pursue indications of circumvention, to adjust its security concept, and to sanction breaches loses its injunctive relief. The protection concept therefore needs an owner, a record of incidents, and a response that can be evidenced later.

  • The decisions contain important guidance on adequate confidentiality measures and are worth reading for that reason alone.

The new leak is AI

The fastest way to lose a trade secret today does not run through a departing employee but through an input field. At Samsung, employees entered source code and internal notes into ChatGPT in May 2023, putting the information onto someone else’s servers. The company responded with a group-wide ban on external AI tools, and several large corporations have issued comparable bans since.

The provider itself describes who can view the conversations: authorized staff for support, abuse investigation, and compliance with legal requirements, plus specialist service providers. Those legal requirements include the US CLOUD Act, which obliges US providers to give authorities access to stored data even where the storage sits outside the United States.

For the protection concept, that means a module of its own:

  • Use business accounts with established providers only, no third-party apps and no browser extensions.
  • No trade secrets in prompts.
  • A clear policy on the use of AI tools at work, with regular training.
  • Monitor access and unusual activity.
  • Agree the confidentiality obligation expressly beyond the end of the employment.

What your counterparty may do with the data you hand over is the other side of the same question; I address it in the article “Data and AI in contracts: what may your counterparty do with your data?”.

In litigation: the new Section 273a ZPO

Protection does not end with the claim; that is where it really starts. Enforcing a secret in court means disclosing it, and civil proceedings are public in principle (Section 169 GVG). It is precisely this contradiction that drove commercial disputes into arbitration for years, whose advantage is confidentiality.

Until 2025 the GeschGehG helped only in trade-secret proceedings: on application, the court classifies the information at issue as confidential in whole or in part where it may be a trade secret (Section 16(1) GeschGehG). Everyone involved in the proceedings must then treat it as permanently confidential and may neither use nor disclose it, inside the proceedings and outside, and beyond their conclusion (Sections 16(2), 18 GeschGehG). Third parties get access to the file only in redacted form (Section 16(3) GeschGehG), and breaches carry an administrative fine or detention (Section 17 GeschGehG).

With the Act to Strengthen Germany as a Place of Justice, that instrument has been available in all civil proceedings since 1 April 2025 through Section 273a ZPO. Two points deserve attention: the decision is made by order and, as a rule, without hearing the other side first, which is heard afterwards; and the classification can be challenged only together with the appeal on the merits.

The application does not repair what was neglected earlier. The Higher Labor Court of Baden-Württemberg requires coherent pleading of all requirements here too, including the adequate confidentiality measures. Whoever failed to take them loses at the threshold of the very proceedings meant to protect them.

Notes

  1. Likewise Higher Labor Court of Rhineland-Palatinate, judgment of 25 January 2021 – 3 SaGa 8/20. ↩

  2. Likewise Higher Labor Court of Düsseldorf, judgment of 3 June 2020 – 12 SaGa 4/20; Higher Labor Court of Cologne (2nd Chamber), judgment of 2 December 2019 – 2 SaGa 20/19. ↩

  3. Fuhlrott/Fischer NZA 2022, 809 (812); Köhler/Bornkamm/Feddersen/Alexander UWG, 40th ed. 2022, GeschGehG § 2 marginal no. 61 a; Apel/Stolz GRUR-Prax 2021, 1 (2); Hauck GRUR 2022, 530 (535); Hoeren/Münker MMR 2021, 523 (524); Holthausen NZA 2019, 1377 (1380). ↩

Reference: Poleacov, P. (2026). Effective protection of trade secrets. INN.LAW. https://inn.law/en/perspectives/protection-trade-secrets/