Trade secret regime

vs

Company regimes

Law or holder's decision

PD: by law for every operator (152-FZ)

trade secret: by the holder's decision with all 98-FZ measures

professional secrecy: by law, e.g. banking, medical, advocate

IUI: by the holder's decision (Art. 6(3) of 149-FZ)

State regimes

Only by law

state secrets: Law "On State Secrets", work only with a licence and clearance

official secrecy: authority data marked DSP (Government Resolution No. 1233)

Rule: a secret rests on three legal elements: a list of data, access restriction measures and liability. Self-labelling as a secret in an internal document creates no regime

Inside

Staff and owners

employees and former employees with lawful access

company owners and top managers

Nearby

Counterparties, authorities, media

counterparties who received data under contract

authorities, whose requests are met only under a legal rule

mass media

Against

Competitors, raiders, criminals

competitors

raiders

organised criminal groups

Internal violator: a bank employee with access by position photographed a client's statement and passed it to an outsider. One episode, two offences, Art. 183(2) and Art. 272(3) Crim. Code: lawful access does not excuse it

Laws

• 1
• Civil Code, Part One, of 30.11.1994 No. 51-FZ

• 2
• Civil Code, Part Four, of 18.12.2006 No. 230-FZ

• 3
• Federal Law of 27.07.2006 No. 149-FZ On Information, Information Technologies and Information Protection

• 4
• Federal Law of 29.07.2004 No. 98-FZ On Trade Secrets

• 5
• Federal Law of 06.12.2011 No. 402-FZ On Accounting

Decrees, resolutions, methods

Presidential Decree of 06.03.1997 No. 188 on the list of confidential information

RSFSR Government Resolution of 05.12.1991 No. 35 on data not constituting trade secrets lapsed on 26.07.2025

Methodological recommendations on technical protection of trade secret information (FSTEC, 25.12.2006)

Manual on organising technical protection of trade secret information (FSTEC, 25.12.2006)

STR-K, special requirements and recommendations for technical protection of confidential information (State Technical Commission order of 30.08.2002 No. 282)

Note: FSTEC methods describe technical protection, but the regime arises only from 98-FZ measures. Technology implements measures and does not create their legal basis

A trade secret holder is a person who lawfully holds the data, has restricted access to it and has introduced a trade secret regime (Art. 3(4) of 98-FZ)

set, change and cancel the trade secret regime in writing under 98-FZ and a civil-law contract

use trade secret data for own needs, without breaching the law

allow or deny access to trade secret data, set access procedure and conditions

require persons with access and authorities given the trade secret to keep it confidential

require confidentiality from persons who gained access by chance or error

defend its rights against disclosure, unlawful acquisition or use of the trade secret by third parties, including claiming damages

Condition: a person becomes a holder only once the regime is in place. Without all five Art. 10 98-FZ measures there is no holder and no such rights

01

Aim 1

Minimise damage

from loss of information confidentiality

measures are reasonably sufficient if they bar access without holder's consent (Art. 10(5), 98-FZ)

a short list gets followed, a broad one gets bypassed

the core of valuable data goes under trade secret, the rest under IUI

02

Aim 2

Defend rights in court

recover damages, dismiss for disclosure, raise criminal liability

a dispute starts with proof of the regime, not of disclosure

all five measures are checked as of the breach date

a chain of documents from the data list to export logging works

A trade secret never arises alone: banking or medical secrecy arises by law from the activity, but the holder introduces a trade secret through measures. Without them, no regime

vs

Before 01.10.2014

Know-how only under the trade secret regime

data of any nature, including results of intellectual activity, counted as a production secret

protection arose only if the holder set up the regime

From 01.10.2014

Know-how split from trade secret

know-how is data of any nature on results of intellectual activity in the scientific and technical field and on ways of carrying out professional activity (Art. 1465(1) Civil Code)

the holder takes reasonable confidentiality measures, including a trade secret regime

data the law requires to be disclosed or forbids to be closed cannot be know-how (Art. 1465(2) Civil Code)

the trade secret regime applies to all data valuable for being unknown to third parties, not just production secrets

Result of the amendments: a production secret holder gained a wider set of protection methods, not limited to the trade secret regime

Art. 11(3)(3)

Employee

pays damages if guilty of disclosing a trade secret learned through work; the non-disclosure duty lasts for the whole term of the regime (Art. 11(3)(2))

Art. 11(4)

Former employee

is liable likewise if he disclosed data while the trade secret regime was in force

Art. 11(7)

Manager

compensates the organisation for losses caused by his culpable acts in breach of trade secret law

Art. 11(5)

Exemption

the employee does not pay if disclosure resulted from the employer's failure to apply regime measures, third-party acts or force majeure

Caveat: Art. 238 Labour Code bars recovering lost profit from an employee; under the labour approach direct actual damage is recovered, in full (Art. 243(1)(7)). Whether Art. 11 98-FZ damages include lost profit is disputed

• Feature
• Production secret (know-how)
• Business information

• What it protects
• data of any nature on results of intellectual activity in science and technology and on ways of professional activity
• other data valuable for being unknown to third parties

• Example
• technologies, drawings, source code, formulas
• client base, deal terms, costs, strategy

• Provision
• Civil Code Arts. 1465-1472, 98-FZ
• Arts. 3, 10 of 98-FZ

• Method of protection
• exclusive right while confidentiality lasts (Art. 1467 Civil Code), reasonable measures including a trade secret regime
• only the regime with all Art. 10 measures

• On breach
• damages under Art. 1472 Civil Code and liability for disclosing a trade secret
• disciplinary, civil, administrative and criminal under Art. 14 of 98-FZ

Link: the exclusive right to know-how lasts while the data is confidential. Disclosure ends both the right and the regime, so know-how is kept on the trade secret list

Orders

• 1
• approving the Regime Regulation and appointing a responsible person

• 2
• approving the list of units and positions with access to trade secrets

• 3
• approving the trade secret data list

Core of the package

Trade Secret Regime Regulation

handling procedure, access, records, stamp, control and liability

approved by the first order

staff sign for it (Art. 11 of 98-FZ)

Standard forms

non-disclosure agreement

log of physical media

log of persons given access

log of persons to whom data is provided or transferred

media transfer act

media destruction act

Expert grouping: the minimum regime fits three documents: a handling Regulation, a data list and confidentiality agreements with employees and counterparties. Completeness is checked by their consistency and by all five measures being carried out

1

Survey

company documents, systems and units involved in trade secret circulation

2

Regime scope

list of trade secret data categories, list of systems holding them and list of categories of recipients

3

Regulation

rules for handling and protecting trade secrets in internal acts, employment and counterparty contracts

4

Mapping and stamp

matching trade secret categories to documents and databases, identifying employees with access, stamping media

• Stage results
• map of trade secret circulation
• lists of data, systems and recipients

internal regulations, employment contracts and NDAs

access records and stamp on media

Project result: a confidentiality regime brings court protection. Without a finished project, disputes over damages or dismissal are often lost for lack of a regime, not on the substance

Step 1

Data

company technology, clients, finance and plans

Step 2

Designation as secret

the trade secret list picks out the data meeting the Art. 3 98-FZ criteria

Step 3. Trade secret confidentiality measures

Trade secret stamp

on media and in document details, with the holder's name and location

Access control

data handling procedure and compliance control

Authorised staff

records of persons given access and recipients of the data

Acknowledging the rules

signed for the list, regime and liability (Art. 11)

Protection measures, DLP

technical measures under Art. 10(4) count in assessing reasonable sufficiency

Control: a dispute first checks the completeness of measures at the breach date, so dates of acts, receipts and stamping are documented

Protected areas

separate storage for trade secret data

Multi-factor authentication

multi-factor access to trade secret data

Permission separation

access by listed positions

Document access limits

read, copy and print rights

Dynamic rule setting

rules change with the list and the authorised staff

Continuous audit

logs of access to trade secret data

Report generation

for the regime officer and internal investigations

Rollout order

first the Regulation, list and NDAs, then technology. The stamp is applied automatically in templates and exports

Definition

DLP

technologies preventing leaks of confidential information from an information system to the outside, and software or hardware-software devices for such prevention

Channels

• gateway mail
• HTTP traffic
• messengers
• IP telephony

• social networks
• search queries
• P2P networks
• FTP

Devices and workstations

• removable media
• printing and scanning
• wireless networks

• clipboard
• workstation scanning

Storage and integrations

• databases and network storage
• archives and documents

• integration with EDMS, LDAP and proxy
• work in virtual environments

Setup: the system logs events, and content is opened when a rule triggers. DLP legalisation: Section 36

Civil, Labour, CAO

Civil Code Art. 15

damages to a protected secret's holder

Civil Code Art. 1472

damages for unlawful use or disclosure of know-how, unless law or contract provides otherwise

Labour Code Art. 81(1)(6)(c)

dismissal for disclosing a legally protected secret learned through work

Labour Code Art. 243(1)(7)

full financial liability of the employee for disclosing a legally protected secret

CAO Art. 13.14

disclosure of legally restricted information by a person who obtained it through service: officials ₽40-50k or disqualification up to 3 years, legal entities ₽100-200k

Art. 183

• Part
• Offence
• Penalty

Part 1

collecting trade secret data by stealing documents, bribery, threats or other unlawful means

up to 2 years' imprisonment, fine

Part 2

disclosure or use of a trade secret without the owner's consent by someone entrusted with it or told of it at work

up to 3 years, fine up to ₽1m, bar on holding posts

• Part 3
• the same acts with major damage or for mercenary motives
• 2 to 5 years' imprisonment, fine up to ₽5m

• Part 4
• acts under part 2 or 3 causing grave consequences
• 3 to 7 years

Trade secret and PD

Both regimes apply

a client base with citizens' data is a trade secret and covered by 152-FZ. A trade secret neither widens PD powers nor replaces processing grounds

IUI and PD

IUI does not replace 152-FZ

regulations and HR materials with employee PD stay under the PD regime; an internal regime cannot be more liberal than the law

Trade secret and IUI

Valuable data in trade secrets, the rest in IUI

sensitive data not valuable for its secrecy goes to the internal regime, relieving the trade secret list

Tool: keep the regime map by data category, not by document: for each category state whether it is PD and which secret applies

01

Continuity

internal regulation is kept and brought to a modern legal level

02

Systematic approach

areas of regulation are delimited from the existing PD and trade secret regimes

03

Savings

an optimal set of legal, organisational and technical measures does the job at no extra cost

04

Counterparties

relations are settled where trade secret/PD regimes are impossible or excessive

Price of the regime: IUI gives no protection of a specialised law or a criminal rule, but does not require the full set of measures. A breach after proper acknowledgement is grounds for disciplinary liability