The disclosure of an industrial secret can jeopardize a project, a customer list, a production method, a commercial strategy, or a technical archive even before the damage is easy to quantify. If you fear that internal information has been copied, forwarded, or used by third parties, the question is not merely whether someone has violated a confidentiality obligation: it is necessary to understand whether that information was truly protected as a trade secret and what tools can stop its use.
In this guide I explain what distinguishes confidential business data from protectable secrets, why digital evidence requires attention, and when a criminal complaint can complement civil protection. We will also examine which facts concretely change the answer: indeed, it is not enough for information to be internal; its value, who could know it, and how the business guarded it all matter.
When business information is a trade secret
Not every internal piece of information is a trade secret. Article 98 of the Industrial Property Code protects business information and technical-industrial experiences, including commercial ones, only if three requirements are met together: they must be secret, have independent economic value because they are not known, and be protected by measures reasonably adequate to keep them as such. The discipline therefore also concerns know-how, formulas, procedures, development plans, and commercial data, not just patentable inventions. Article 98 of the Industrial Property Code.
Secret does not mean unknown to anyone. Information may be known by employees, consultants, suppliers, or partners without losing protection, provided it is not generally known or easily accessible to industry operators. An organized combination of data can remain secret even if certain elements, taken individually, are public. Conversely, a presentation sent without caution to numerous external recipients hardly demonstrates effective confidentiality.
The value must depend on confidentiality. The list of potential clients, the price charged to each client, an algorithm, a production process, or a roadmap can offer a competitive advantage because they are not available on the market. It is not necessary for the information to already produce autonomous revenues; however, it must have economic utility linked to the fact of remaining undisclosed.
Secrecy measures are not a formal detail
Concrete protection is part of the requirement. Individual passwords, graded access permissions, confidential folders, non-disclosure agreements, document classifications, access logs, and file return rules are elements that can show how the business has limited the circulation of information. There is no single mandatory measure: adequacy depends on the type of data, the size of the organization, and the risk of dissemination.
A simple “confidential” stamp may not suffice. If anyone in the business can download a strategic archive without authorization, or if files are shared on personal channels without controls, it becomes more difficult to argue that reasonable precautions were adopted. This does not render a misappropriation lawful, but it can affect the specific protection of trade secrets and the measures the judge deems proportionate.
Acquiring, using or unlawfully disclosing: what changes
Civil protection concerns three different conducts. The lawful holder of the secret can prohibit third parties from acquiring, disclosing, or abusively using it without consent. Protection does not operate, instead, against anyone who has independently developed the same solution or the same information. This distinction avoids turning the trade secret into a monopoly on ideas, skills, or knowledge obtained lawfully. Article 99 of the Industrial Property Code.
The end user may be involved. The law also considers unlawful the acquisition, use, or disclosure by anyone who knew, or should have known according to the circumstances, that the secret came from a prior abusive acquisition or disclosure. This is why it matters to reconstruct not only who extracted the data, but also how they reached a competitor, a supplier, or a new economic entity.
Professional knowledge does not always coincide with the secret. Personal abilities, experience, and skills matured on the job do not automatically become confidential information of the business. The case is different if a person reproduces a reserved file, exports a database, delivers a project not yet disclosed, or uses a documented procedure kept and guarded by the company. The boundary depends on the specific information employed, not solely on the circumstance that the person who knew it worked in the enterprise.
Time must not be overlooked. For actions arising from the conducts provided for by Article 99, the Industrial Property Code establishes a five-year limitation period. This term does not replace urgent assessments: if dissemination is ongoing, waiting can make it harder to prevent the secret from losing its essential quality, namely non-accessibility to the public. The discipline of protection and limitation.
The disclosure of trade secrets can have criminal relevance
The criminal complaint can activate the criminal side. Article 623 of the criminal code punishes, inter alia, anyone who knows trade secrets for reasons of their state, office, profession, or art and discloses them or uses them for their own or others' profit. The same provision takes into consideration anyone who has abusively acquired trade secrets and then discloses or uses them for profit. If the act occurs through IT tools, the penalty is increased. Legislative Decree no. 63 of 2018, Article 9.
The rule requires precise facts. Not every incorrect behavior, nor every violation of a confidentiality agreement, automatically constitutes the crime. It is necessary to distinguish data access from its disclosure or use for one's own or others' advantage; it is then necessary to verify the commercial nature of the secret and the way the person came to know it. The criminal-law concept does not, however, coincide with the civil-law definition in Article 98: Court of Cassation judgment no. 3211 of 2024 also protects further industrial or commercial information where there is a legally appreciable interest in keeping it confidential. Failure to satisfy a civil-law requirement therefore does not, by itself, settle the criminal-law assessment.
Proceedings under Article 623 are initiated upon a complaint by the injured party. Generally speaking, the criminal complaint must be filed within three months from the day the injured party learned of the fact constituting the crime. The delicate point is the news of the fact, not the date when the economic damage fully manifests: identifying a suspicious copy, discovering a sending to a competitor, and understanding the scope of use are events that can have different weight and must be placed with precision. Prosecutor's Office indications on the complaint and the general term.
The complaint must express the will to proceed. A generic report may be useful to describe an anomaly, but it does not necessarily equate to the declaration requesting that the offender be prosecuted for a crime prosecutable upon complaint. When the injured party is a company, it must also be ensured that the act originates from someone with the power to act for the enterprise or possessing the necessary representation powers.
Digital evidence: protecting evidence without amplifying damage
The primary need is to preserve what exists. Access logs, download history, messages, attachments, exports from business archives, user authorizations, and file versions can help reconstruct which data were consulted, copied, or transmitted. It is useful to keep originals, note dates and provenance of copies, and prevent automatic procedures from deleting relevant recordings.
Collection does not authorize new access. The suspicion that a file has ended up on a personal device or account does not allow entering others' email boxes, clouds, phones, or profiles without a legitimate basis. The business may instead preserve and analyze, within the limits of its authorizations and applicable rules, corporate systems, accounts, and devices. Searching for evidence in improper ways can create further problems and weaken the sought protection.
The decisive document is the one linking data and conduct. A confidentiality agreement can show that a recipient knew a constraint; a security policy can show adopted measures; an access log can indicate who exported certain files. None of these elements, in isolation, always proves disclosure. Their value grows when they allow a verifiable sequence: what information was protected, who could access it, what operation took place, and what use followed.
Preservation must remain confidential. In a lawsuit on trade secrets, the disclosure of evidence can reproduce the damage one wishes to avoid. The discipline introduced into the Industrial Property Code allows the judge, upon request, to use or disclose secrets present in the file and to adopt arrangements to limit access and redact the confidential parts of rulings. Protection of confidentiality in the trial: Article 121-ter CPI.
Injunction, corrective measures and damages: civil protection
The civil lawsuit can aim to stop the use of the secret. If the danger is current, the goal is not merely obtaining money after years, but arresting acquisition, use, or disclosure and preventing products or activities from benefiting from the misappropriated information. Civil measures can accompany the criminal complaint: the two paths have different purposes and one does not automatically replace the other.
The injunction requires a proportionate request. In proceedings regarding trade secrets, the law requires considering, among other factors, the value of information, adopted protection measures, contested conduct, impact of unlawful use, and interests of parties and third parties. This explains why a blocking request does not derive automatically from the mere existence of a confidentiality agreement: it must be calibrated on the secret and demonstrated risk. Proportionality criteria for civil measures.
Damages are not the only alternative. In some situations, the priority is to obtain an order preventing further dissemination; in others, when information is no longer recoverable or use has already consolidated, economic consequences become central. The choice should not be reduced to “complaint or damages”: precautionary protection, merits judgment, and criminal initiative may serve at different times.
Hasty accusatory communications should be avoided. Warning an opposing party may be appropriate when it serves to demand the cessation of use and establish a clear position. However, before spreading allegations to clients, suppliers, or the market, one must evaluate the content of evidence, real confidentiality of information, and the risk of making public data that should remain protected. If the problem requires intervention, I can help you identify a coherent path among containment, evidence, and judicial initiatives.
Frequently Asked Questions
Can I file a complaint if a former collaborator takes company information with them?
Yes, but simple possession of information is not enough. Under Article 623 of the criminal code, it is necessary to verify the nature of trade secret, how the information was known or acquired, and any disclosure or employment for profit. The criminal complaint is subject, generally speaking, to the three-month term from the news of the crime.
Does a confidentiality agreement alone prove the trade secret?
No: it is useful evidence, not complete proof. The agreement can show that the recipient knew the obligation of non-disclosure, but the requirements of Article 98 remain to be proven: effective secrecy, economic value deriving from secrecy, and reasonable measures adopted to protect the information.
Do I have to choose between civil action and criminal complaint?
No, remedies can coexist. The complaint concerns potential criminal liability; the civil action can aim to stop the use or dissemination of the secret and ask for the patrimonial consequences of the violation. The choice depends on the documented fact, urgency, and result that needs to be pursued.
Can I use screenshots and messages as evidence?
They can be relevant if their provenance is clear. Screenshots, emails, and messages acquire strength when accompanied by original files, metadata, logs, or other elements allowing the reconstruction of who produced them, when, and in what context. It is not prudent to alter files, cut conversations, or access others' accounts without authorization.
Does the competitor who receives data always answer for the violation?
Not automatically. Article 99 also considers use by anyone who knew, or should have known, the abusive origin of the secret to be unlawful. If the competitor obtained and independently developed information, the conclusion can be different. The provenance of data, communications received, and characteristics of the proposed solution thus become relevant.
Essential normative references
To guide protection, one must start from Articles 98 and 99 of the Industrial Property Code, which define the trade secret and prohibited conducts, and from the reform implemented with Legislative Decree no. 63 of 2018, relevant also for Article 623 of the criminal code and procedural confidentiality precautions.