Table of Contents
- How to Respond When a Former Employee Takes Files, Lists, or Sensitive Data
- Why This Situation Can Escalate Quickly
- Step 1: Contain The Problem Without Destroying Evidence
- Step 2: Figure Out Exactly What Was Taken
- Information That Is Likely Public Or Easily Recreated
- Information That Is Confidential But Not Necessarily A Trade Secret
- Information That Looks More Like A Trade Secret
- Step 3: Check The Contracts, But Don’t Stop There
- Step 4: Assess Whether Emergency Relief Is Realistic
- Step 5: Consider Claims Beyond Trade Secret Law
- Step 6: Be Careful With Self-Help Tactics
- Step 7: Think About The New Employer Early
- Step 8: Don’t Ignore The Possibility Of Criminal Exposure
- What Companies Often Get Wrong
- Treating The Issue As Purely An HR Problem
- Overstating The Claim
- Waiting Too Long
- Failing To Preserve ESI
- Contacting The Competitor Too Aggressively
- Forgetting To Prove Reasonable Secrecy Measures
- What Evidence Often Matters Most
- When To Involve A Lawyer
- A Practical Closing Thought
Type
Great Grandchild
Status
Approved
Caption
Title (YouTube)
Caption X
Cover
OG Image
Alt Image Text
Minimal flat vector illustration of a former employee leaving with digital files while a company representative reviews access logs and secures sensitive information.
Images
Videos
Video Published (Blog)
Publish Date (Social)
Apr 15, 2027 18:00
Scheduled (Social)
Scheduled (Social)
Images Posted (Social)
Images Failed (Social)
Videos Posted (Social)
Videos Failed (Social)
Featured
Do not index
Videos Post IDs (Social)
Created time
Apr 8, 2026 06:38 PM
Sub-item
Authors
Images Post IDs (Social)
YT Post ID
YT Embedded
Images Delete (Social)
Videos Delete (Social)
How to Respond When a Former Employee Takes Files, Lists, or Sensitive Data
When a former employee leaves with files, customer lists, pricing data, source code, formulas, or other sensitive information, the first few hours often feel chaotic. Access has changed. Devices may be missing. Email rules may have been altered. People inside the company may be asking whether this is “just competition” or something more serious.
In general terms, a calm, evidence-focused response tends to matter more than a fast emotional one. Trade secret and confidential-information cases often turn on what was taken, how it was protected, what systems recorded the activity, and how quickly the company preserved evidence. In this post you’ll learn how businesses often respond, what legal issues may come into play, and where an attorney may help evaluate emergency options.
If you want a broader foundation on this area of law, our overview of what companies look at in trade secret theft disputes can help frame the bigger picture.
Scroll to the bottom for every post in this series.
Why This Situation Can Escalate Quickly
Not every departing employee who emails a spreadsheet to a personal account is committing trade secret misappropriation. At the same time, not every “routine” departure is harmless. Under the federal Defend Trade Secrets Act, a trade secret owner may bring a civil action if the trade secret relates to a product or service used in interstate or foreign commerce. The statute also allows courts, in extraordinary circumstances, to issue ex parte seizure orders aimed at preventing further spread of the information. That remedy is unusual, but its existence reflects how quickly digital information can move once it leaves the company’s systems.
State law matters too. Most states use some version of the Uniform Trade Secrets Act framework, which generally protects information that derives economic value from not being generally known and is subject to reasonable secrecy measures. In practical terms, a customer list, pricing model, vendor data set, source code repository, manufacturing process, or internal playbook may or may not qualify depending on the facts, including how secret it really was and what steps the business took to protect it.
That distinction matters because employers sometimes assume every internal file is a trade secret. Courts usually look more carefully than that. A list available from public sources may be treated very differently from a curated database built over years and locked behind access controls.
Step 1: Contain The Problem Without Destroying Evidence
A common first move is to limit ongoing access. That can include disabling accounts, revoking tokens, changing shared passwords, reviewing cloud permissions, and checking whether any forwarding rules, sync connections, or third-party integrations remain active. Cybersecurity guidance on insider threats regularly emphasizes rapid containment and log preservation because data exfiltration often involves email forwarding, cloud sync tools, removable media, or unusual device activity. CISA’s Insider Threat Mitigation Guide discusses these risks in detail, and CISA’s ransomware response guidance also notes the importance of preserving volatile evidence such as system logs and related records during fast-moving incidents.
That said, containment and preservation can pull in different directions. If an IT team wipes a laptop, resets a mailbox, or overwrites logs too early, the company may lose the very proof it later needs. Under Federal Rule of Civil Procedure 37(e), courts can address the loss of electronically stored information when a party failed to take reasonable steps to preserve data that should have been preserved in anticipated litigation.
Here’s what that often looks like in real life:
- suspend access without deleting the account history
- preserve laptops, phones, and external media in their current condition
- capture audit logs, email metadata, download histories, VPN records, and cloud activity
- pause auto-delete settings where relevant
- identify who had access to the same files and systems
- document the timeline before memories blur
If your team is already looking at device logs and download records, our related post on preserving technical evidence in a trade secret dispute would usually be the next issue to examine closely.
Step 2: Figure Out Exactly What Was Taken
One of the biggest mistakes companies make is describing the issue too vaguely. “He took confidential files” sounds serious, but it may not be enough. Attorneys and courts often want detail:
- Which files?
- From what location?
- On what date and time?
- How were they accessed?
- Were they emailed, synced, printed, photographed, or copied to USB?
- Who owned the accounts or devices involved?
- Did the employee have authorized access at the time?
- Is there evidence the files were later opened or used?
This is where the line between ordinary employee mobility and misappropriation starts to sharpen. The Department of Justice has repeatedly brought trade secret theft cases involving customer lists, formulas, source code, and technical files taken from former employers. For example, DOJ has described cases involving former employees with access to customer lists and ordering histories, semiconductor files, formulas, and source code allegedly taken or retained after departure, illustrating that both technical and business information can become the focus of serious enforcement.
A careful inventory can also help separate three very different categories:
Information That Is Likely Public Or Easily Recreated
This may include names of widely known customers, public pricing, or generic contact details that a competitor could gather lawfully. Those facts can weaken a trade secret theory.
Information That Is Confidential But Not Necessarily A Trade Secret
Internal procedures, drafts, planning documents, or nonpublic business data may still support contract, fiduciary duty, unfair competition, conversion, or computer-use claims even if trade secret status is debatable.
Information That Looks More Like A Trade Secret
Examples often include source code, product formulas, nonpublic customer intelligence, strategic pricing architecture, unreleased product plans, algorithmic models, and curated datasets that derive value from secrecy and were protected through technical and contractual controls.
Step 3: Check The Contracts, But Don’t Stop There
Employment agreements, confidentiality agreements, invention assignment clauses, return-of-property certifications, and exit paperwork often matter. So do BYOD policies, acceptable-use policies, and trade secret training records.
Still, many cases are not won or lost on the contract language alone. A signed NDA may help, but courts usually also look at actual company practices. Were the files labeled confidential? Were repositories access-controlled? Did only certain employees have access? Were downloads monitored? Did the company use multifactor authentication, segmented permissions, or device restrictions? Was there an offboarding checklist?
Those facts go directly to the “reasonable efforts” issue that sits at the center of trade secret protection. If the company treated the information casually, the legal theory may become harder to prove. If the company used objective safeguards, the claim often becomes easier to explain.
This is also why some businesses discover that a former employee problem is partly an internal controls problem. CISA and other cybersecurity guidance frame insider incidents not only as legal disputes but as operational failures in access governance, monitoring, and escalation.
Step 4: Assess Whether Emergency Relief Is Realistic
In many trade secret disputes, the key question is not just whether a company can sue, but whether it can move fast enough to stop ongoing use or disclosure. Federal Rule of Civil Procedure 65 governs temporary restraining orders and preliminary injunctions in federal court. In a trade secret setting, that may include requests to stop use of specific information, prevent deletion of evidence, require return of company materials, or restrict further dissemination while the case is litigated.
Emergency relief often turns on practical proof:
- evidence of recent copying, forwarding, or downloads
- evidence the data remains on personal devices or cloud accounts
- evidence the employee joined a competitor in a role connected to the information
- evidence of threatened use or actual use
- evidence the company moved promptly after discovery
Delay can complicate an emergency request. If a company waits weeks or months after learning of the problem, a court may question how “immediate” the harm really is. On the other hand, filing too fast without a clear factual record can also backfire.
The federal trade secret statute’s ex parte seizure provision is even narrower. Under the DTSA, courts may order seizure only in extraordinary circumstances, and wrongful or excessive seizure can expose the applicant to damages. That usually makes this a highly specialized remedy rather than a routine one.
If you’re evaluating whether a TRO request is worth exploring, our related post on mistakes that can undermine emergency injunctive relief fits naturally into that analysis.
Step 5: Consider Claims Beyond Trade Secret Law
A former employee taking data does not automatically create just one legal claim. Depending on the facts and the state involved, attorneys may also evaluate:
- breach of contract
- breach of fiduciary duty or duty of loyalty
- conversion
- trespass to chattels
- unfair competition
- computer fraud or unauthorized access claims
- claims against a new employer that received or used the information
This broader lens matters because some disputes involve a mix of materials: a few documents may qualify as trade secrets, others may be confidential under contract, and still others may reveal improper access patterns even if the content itself is not protectable.
It also matters because the law around restrictive covenants remains unsettled and state-specific. The FTC announced a nationwide noncompete rule in April 2024, but the agency has publicly stated that on August 20, 2024, a federal district court stopped the FTC from enforcing that rule, and on September 5, 2025, the FTC moved to dismiss its appeal. Even in that changing environment, the FTC has pointed to alternatives such as trade secret law and confidentiality protections as tools businesses may use to protect sensitive information. In other words, many disputes involving former employees are now framed less around broad noncompete theories and more around actual misuse of protected information.
Step 6: Be Careful With Self-Help Tactics
When a company suspects theft, it can be tempting to go further than the law allows. Examples can include logging into a former employee’s personal email, remotely accessing a personal cloud account, seizing a personal device without a clear legal basis, or contacting the new employer with accusations before the facts are developed.
Those moves sometimes create new problems:
- privacy disputes
- counterclaims
- evidentiary challenges
- employment-law issues
- reputational damage
- avoidable motion practice
A more measured response often involves preserving the company’s own systems first, then evaluating whether a demand letter, negotiated forensic protocol, expedited discovery, or emergency motion would fit the facts.
This is one reason these cases often benefit from lawyers who have handled highly similar matters before. The strategy is rarely just “file a lawsuit.” It may involve coordinating IT, HR, executives, outside forensics, and litigation counsel in a way that preserves options instead of narrowing them.
Step 7: Think About The New Employer Early
Many cases are really about three actors, not two: the former employee, the former employer, and the new employer.
Questions that often matter include:
- Did the new employer know about the restrictions?
- Did it receive the files?
- Did it ask for them, ignore red flags, or quarantine them?
- Did it preserve devices and accounts once notified?
- Did the employee bring company documents into a shared environment?
Sometimes the new employer becomes part of the solution. Sometimes it becomes part of the dispute. If there is evidence that sensitive information landed inside a competitor’s systems, timing may matter a lot. A fast preservation notice can help frame the issue before logs roll off or devices are reimaged.
Our sibling topic on the questions businesses often ask when proprietary information leaves with an employee is especially relevant at this stage, because leadership teams are usually trying to balance litigation risk, business continuity, and internal communications all at once.
Step 8: Don’t Ignore The Possibility Of Criminal Exposure
Most former-employee data disputes remain civil matters. But not all of them. DOJ has continued to prosecute theft of trade secrets in cases involving source code, formulas, chip designs, and other sensitive business information taken for personal benefit or to aid competitors. Those cases do not mean every suspicious download becomes criminal. They do show that, in more serious scenarios, trade secret theft can move beyond private litigation.
That possibility may affect how a company documents events, preserves devices, communicates internally, and decides whether to contact law enforcement. It may also affect how quickly outside counsel is brought in, especially where export-controlled technology, national security issues, customer PII, or regulated data are involved.
What Companies Often Get Wrong
A lot of preventable damage happens after discovery, not before it. Common missteps include:
Treating The Issue As Purely An HR Problem
Once data movement is involved, HR, IT, security, and legal usually intersect. A siloed response can miss key evidence.
Overstating The Claim
Calling every internal document a trade secret can dilute credibility. Precision usually helps more than outrage.
Waiting Too Long
Delay can weaken emergency arguments and increase the chance that logs disappear or devices change hands.
Failing To Preserve ESI
Under Rule 37(e), lost electronically stored information can lead to serious consequences when reasonable preservation steps were not taken.
Contacting The Competitor Too Aggressively
An unsupported accusation may create unnecessary risk. A lawyer-guided preservation approach is often cleaner.
Forgetting To Prove Reasonable Secrecy Measures
Trade secret law often asks what the company did before the departure, not just after.
If you want a broader explanation of the underlying doctrine, this guide to trade secret disputes involving departing employees and emergency court action provides useful context.
What Evidence Often Matters Most
In many disputes, the most persuasive evidence is not dramatic. It is technical, timestamped, and boring in the best possible way:
- access-control records
- file download logs
- USB insertion logs
- cloud sync activity
- email forwarding rules
- sent-mail metadata
- printer logs
- chat messages
- badge access records
- exit interview notes
- confidentiality acknowledgments
- screenshots of repository permissions
- forensic images of company devices
NIST’s work on data confidentiality and insider-related exfiltration risk also highlights the role of logs in identifying what data was accessed, printed, or moved, and in supporting recovery efforts after a breach. In legal disputes, that same information often becomes the backbone of the narrative.
When To Involve A Lawyer
In general terms, companies often bring in counsel quickly when any of the following is present:
- source code, formulas, technical drawings, or product roadmaps were taken
- customer lists include nonpublic intelligence or strategic pricing data
- a competitor is involved
- there is evidence of mass download, forwarding, or USB use
- a personal cloud account or personal email appears in the trail
- regulated data or export-controlled information may be involved
- the company is considering a TRO, injunction, or forensic protocol
- there is concern about spoliation or counterclaims
An attorney may help determine whether the facts line up better with a demand letter, negotiated return-and-delete process, forensic preservation agreement, civil complaint, emergency injunction request, or some combination of those options.
Just as important, an attorney with documented experience in highly similar matters may be able to spot issues that a general commercial litigator might miss, including how courts in the relevant jurisdiction view secrecy measures, employee mobility, customer lists, and emergency relief.
A Practical Closing Thought
When a former employee takes files, lists, or sensitive data, the central question is rarely “Can we sue?” A more useful question is often: What happened, what proof exists, what was actually protected, and what response preserves leverage without creating new problems?
That is why these matters often move on two tracks at once: technical containment and legal positioning. The companies that respond effectively tend to focus on evidence, speed, and fit. They identify exactly what was taken, preserve digital records before they disappear, evaluate whether the information was genuinely protectable, and work with counsel familiar with trade secret and employee-departure disputes.
Visit ReferU.AI to get matched with an attorney who has demonstrable experience in cases like yours — for free.
