How to Protect Trade Secrets When Employees Leave: A Checklist

The most dangerous window for your business opens the moment an employee gives notice. Knowing how to protect trade secrets when employees leave comes down to what you do in the first hours, not the first lawsuit. Cut access and preserve their devices before anything can move to a personal account. A departing employee who copies your customer list or pricing model can hand a rival years of work in a single afternoon. This checklist sequences the offboarding so the leak never happens, and so the law can help you if it does.

Why the first day of departure decides everything

Most trade secret theft is not a heist. It is a resignation followed by a quiet download. The pattern is consistent enough that lawyers who defend these matters treat the notice period and the termination meeting as the highest-risk moment of the entire employment relationship. During a layoff, counsel advise moving fast precisely because departing staff have both motive and a shrinking window of legitimate access (Bloomberg Law).

The exposure scales with what the employee could reach. Courts have described the harm from a misappropriated file set in plain terms: it can give a competitor a roadmap. When a departing manager forwards a pricing spreadsheet and a client list to a personal inbox, a rival does not have to rebuild your strategy. It can just read yours.

The stakes are not reserved for large companies. The federal racketeering case against Huawei, which opened for trial in Brooklyn in September 2026, turns partly on alleged trade secret theft from six U.S. firms (Global Investigations Review). A small business faces the same legal test with a smaller budget. That is why a repeatable protocol beats improvising under pressure.

The trade secret offboarding checklist, in sequence

Order matters here. Revoking email while leaving code repositories open buys you nothing. Work down the list from the systems that hold the most concentrated value to the ones that hold the least, and start the instant a departure is known.

• Revoke access to the crown jewels first. Cut credentials for source code, customer databases, and design files before you touch anything else. Then email and the collaboration suite. Then disable the API keys and single sign-on that quietly reach everything (Fish & Richardson).
• Freeze the account, do not delete it. Deleting a mailbox or user destroys the evidence you may need later. Suspend the account and reset the password instead.
• Audit access logs for the notice period. Pull download and export activity for the days around the resignation. A spike of late-night activity is the single most useful fact you can hand a lawyer.
• Inventory every device and repository the person could reach. Company laptop, phone, personal devices used for work, cloud storage, and shared drives all belong on one written list, so nothing is quietly missed (King & Wood Mallesons).
• Reinforce the confidentiality obligation in writing. Remind the employee, on paper, of the non-disclosure terms they signed and that company information may not leave with them.

Preserve the device before you reassign it

Here is the mistake that quietly kills cases. A laptop comes back. IT wipes it and hands it to the next hire within the week. The evidence of what was copied is gone, overwritten by someone else’s work.

Do not wipe or reassign a departing employee’s key devices until preservation is scoped. A forensic image, taken before anything changes, can show whether files were copied to a USB drive or uploaded to a personal cloud folder (National Law Review). That record is often the difference between a provable claim and a suspicion.

Time the exit interview and the reminder

The exit interview is not a formality. It is your best chance to establish, in the employee’s own words, what they took and where it still lives. Someone trained to ask should run it, and the questions should be specific: personal devices used for work, files retained at home, documents in personal cloud accounts, and communication on off-platform apps.

Then send a follow-up. A short written reminder, sent shortly after departure, restates the confidentiality duty and asks for confirmation that no company materials were retained. It closes the “I forgot I still had it” excuse and creates a dated record of notice. Keep it factual and calm. You are building a paper trail, not picking a fight.

When the files are already gone

Sometimes you find the download after the fact. The law still gives you real tools, and the strongest of them reward speed.

Congress passed the Defend Trade Secrets Act in May 2016. It gave owners a federal cause of action for the first time. Under the DTSA, a business can sue in federal court for misappropriation and ask for an injunction to stop the use or disclosure of the information (18 U.S.C. 1836). In extraordinary cases, the statute even allows an ex parte seizure of property to prevent the secret from spreading. To win any of this, you must show the information qualifies as a trade secret, which means proving you took reasonable measures to keep it secret in the first place (18 U.S.C. 1839). The offboarding steps above are those measures, documented in real time.

Move quickly for a second reason. A DTSA claim carries a three-year statute of limitations that runs from when the misappropriation was discovered, or reasonably should have been (18 U.S.C. 1836(d)). A judge weighing an emergency injunction also reads delay as a signal that the harm was not urgent. The employer who acts within days looks credible. The one who waits months looks like an afterthought.

This is where an ounce of preparation pays for itself. If you have already run a pre-litigation trade secret audit, you can name the exact secret that walked out the door and show the access controls it lived behind. Layered protection, on a need-to-know basis, is the baseline that trade secret regimes expect (WIPO).

Close the door before it opens

The employee who leaves cleanly is the norm. The one who does not can cost you a market. A written offboarding protocol, followed the same way every time, is cheap insurance against a loss that is nearly impossible to reverse once the data is out.

Two habits make the rest easier. Know which of your assets are actually trade secrets, versus what a patent or trademark should protect instead, so you guard the right thing the right way. And treat every outside party that touches your confidential materials, including a law firm’s own data security, as part of the same perimeter. If a key employee is on the way out and you are unsure whether your protections would hold, that is the right moment for a short conversation with counsel, before the checklist becomes a lawsuit.