Trade Secrets Protection Under the GeschGehG

Trade secrets protection in Germany: the starting point

Trade secrets protection in Germany rests on the Trade Secrets Act (Gesetz zum Schutz von Geschäftsgeheimnissen, GeschGehG), which implemented the EU Trade Secrets Directive (EU) 2016/943 in April 2019. The Act protects information only if it meets a statutory definition — and that definition includes a requirement many companies overlook: the holder must have taken reasonable secrecy measures. Without them, there is no trade secret, and therefore no claim against a former employee, a supplier or a competitor who uses the information. For businesses, trade secrets protection is therefore as much an organisational task as a legal one.

Know-how, customer lists, pricing models, recipes and formulas, source code, process parameters, supplier terms and business plans are typical trade secrets. They are often more valuable than registered IP, especially in the Mittelstand, where much innovation is kept secret rather than patented. The Act provides injunctions, damages and information claims, confidentiality in court and criminal sanctions — but all of them depend on the information qualifying in the first place.

The definition: three requirements

Under § 2 no. 1 GeschGehG, a trade secret is information that:

1. is not generally known or readily accessible, as a whole or in the precise arrangement and assembly of its components, to persons in the circles that normally deal with this kind of information, and therefore has economic value;
2. is subject to secrecy measures that are reasonable in the circumstances, taken by its lawful holder; and
3. is information in whose confidentiality there is a legitimate interest.

The holder is whoever lawfully controls the information (§ 2 no. 2). The economic-value element is usually satisfied for genuinely confidential business information. The legitimate-interest element excludes information whose secrecy the law does not recognise as worth protecting, for example information about the holder's own unlawful conduct; it rarely causes problems in ordinary commercial cases. Disputes centre on the second element, because courts expect the holder to prove the measures it actually took.

Reasonable secrecy measures in practice

What is "reasonable" depends on the value of the information, its nature, the size of the company and the costs of protection. There is no single standard, but courts look for a coherent system rather than isolated steps. Typical measures include:

• Classification: identifying categories of confidential information and labelling documents accordingly.
• Access control: need-to-know access, role-based IT permissions, physical access restrictions to labs and production areas.
• Contracts: confidentiality clauses in employment contracts, non-disclosure agreements with suppliers, customers and partners, and confidentiality obligations in licence and collaboration agreements.
• IT security: encryption, logging, data loss prevention, restrictions on private devices and cloud uploads.
• Training and policies: confidentiality policies, onboarding and exit procedures, and reminders when employees leave.

Permitted acts: reverse engineering and independent discovery

The Act does not create an exclusive right comparable to a patent. Acquiring a trade secret is lawful through independent discovery or creation, and through observing, studying, disassembling or testing a product that has been made available to the public or that is lawfully in the possession of the person doing so, provided that person is not under a duty to limit acquisition of the trade secret (§ 3(1) GeschGehG).

Reverse engineering is therefore permitted unless excluded by contract. Companies that supply machines, devices or software to customers should consider contractual reverse-engineering prohibitions where legally possible, and should rely on patents or copyright where secrecy cannot be maintained once the product is on the market.

Employee rights to information and consultation, and works councils' participation rights, also justify acquiring trade secrets (§ 3(1) no. 3). Disclosure is further permitted to protect legitimate interests, notably freedom of expression and the press, and to reveal unlawful acts or professional misconduct where this serves the general public interest (§ 5 GeschGehG). Whistleblowers reporting under the Whistleblower Protection Act are protected; see our page on whistleblowing under the HinSchG.

Employees, departures and non-competes

Most trade secret disputes involve departing employees. During employment, employees owe confidentiality and loyalty. After employment ends, they may use their general skills, knowledge and experience, but not specific trade secrets of their former employer. The line between general know-how and specific secrets is often contested.

Employers have three tools:

1. Confidentiality obligations that continue after the employment ends, limited to identified trade secrets rather than all information.
2. Post-contractual non-compete covenants, valid only if the employer pays compensation of at least half the employee's last contractual remuneration for each year of the restriction (§ 74(2) of the Commercial Code, HGB) and limited to two years; see our insight on post-contractual non-compete clauses.
3. Exit procedures: return of devices and documents, IT forensic checks for unusual downloads, written reminders of confidentiality duties.

When a key employee joins a competitor, the new employer should also take care: hiring an employee who brings confidential files exposes the new employer to claims, because using a trade secret that one knows or should know was unlawfully obtained is itself prohibited.

Trade secrets protection with suppliers, customers and partners

Trade secrets often have to leave the company: drawings go to suppliers, process data to customers, source code to development partners. Each transfer is a test of whether secrecy measures are reasonable. NDAs should define the protected information precisely, limit use to the agreed purpose, restrict onward disclosure to named persons or subcontractors with equivalent obligations, require return or deletion at the end, and allow audits where justified. Generic "everything is confidential" clauses are weaker in court than targeted definitions.

Joint ventures and R&D collaborations need rules on background and foreground know-how: who owns what, who may use jointly developed know-how after the collaboration ends, and how improvements are shared. In M&A, data rooms must be organised so that competitively sensitive information is disclosed only in a controlled way — through clean teams where necessary to comply with competition law. Our insight on technology transfer and patent licensing covers licence terms for know-how.

AI tools and trade secrets

Generative AI creates a new leakage route. Employees who paste source code, formulas or customer data into public AI tools may disclose trade secrets to the provider and, depending on the terms, allow their use for training. Companies should therefore define which AI tools are approved, configure enterprise versions that exclude training on inputs, and include AI use in confidentiality policies and training. A clear AI policy is now part of reasonable secrecy measures for many businesses, and it overlaps with AI literacy measures under the AI Act.

Responding to a suspected leak

Speed matters. When a company suspects that a departing employee or a partner has taken confidential information, the first steps are to preserve evidence — logs, emails, device images — without breaching data protection or employment law, to assess which information is affected and whether it meets the statutory definition, and to decide between a warning letter, an application for a preliminary injunction, an inspection order or a criminal complaint. German courts expect applicants for preliminary injunctions to act urgently, typically within a few weeks of learning of the infringement. Effective trade secrets protection therefore includes an incident response plan agreed in advance between legal, HR and IT.

Remedies for trade secret infringement

The holder can bring claims against an infringer for an injunction, for destruction, return or recall of infringing documents and products, for information about the infringement and for damages. Damages can be calculated on the basis of the holder's loss, the infringer's profits or a reasonable licence fee (§ 10 GeschGehG). Owners of a business are liable for infringements by employees and agents. Claims can be excluded where enforcement would be disproportionate (§ 9) or abusive (§ 14).

Regional courts have exclusive jurisdiction regardless of the value in dispute (§ 15(1)), and the court where the defendant has its general place of jurisdiction is competent. Preliminary injunctions are available in urgent cases. To protect the secret during proceedings, courts can classify information as confidential and restrict access under §§ 16–20 GeschGehG; since April 2025 these tools are available in all civil proceedings under § 273a ZPO. See our insight on confidential information in litigation.

Criminal liability

Intentional violations can be criminal. Under § 23 GeschGehG, acquiring, using or disclosing a trade secret contrary to the Act to promote one's own or another's competition, out of self-interest, for the benefit of a third party or with intent to harm the business owner is punishable by imprisonment of up to three years or a fine, with higher penalties in aggravated cases. Criminal complaints can be strategically useful because public prosecutors can search premises and seize evidence, but they also reduce the holder's control over the case. Our internal investigations team supports clients in such situations.

Trade secrets protection checklist

• Map your key trade secrets, where they are stored and who is responsible for each category.
• Implement and document reasonable secrecy measures for each category.
• Use tailored NDAs with business partners, specifying the protected information.
• Review employment contracts, confidentiality clauses and non-competes.
• Monitor data flows, approve AI tools and set up exit procedures for departing staff.
• Prepare an incident response plan for suspected leaks, including evidence preservation and urgent injunctions.

Cross-border aspects

Because the GeschGehG implements an EU directive, the core definitions are similar across the EU, which helps groups apply consistent policies. Outside the EU, standards differ, and enforcement in some jurisdictions is difficult. Groups should therefore combine contractual protection, technical measures and, where possible, registered rights for their most important technology. Choice-of-law and jurisdiction clauses in NDAs should be chosen with enforcement in mind, and export control rules may additionally restrict where certain technical information may go.

How TRW & Co helps with trade secrets protection

We help companies build trade secrets protection programmes that stand up in court: identifying critical information, designing proportionate secrecy measures, drafting NDAs, employment clauses and non-competes, and training staff. When leaks occur, we act quickly — securing evidence, coordinating IT forensics, applying for preliminary injunctions and conducting proceedings with confidentiality measures. We also defend companies and individuals accused of misusing trade secrets. To discuss your situation, contact us or see our IP and patents overview.