Lawyer for trade secret protection – know-how, NDAs & GeschGehG
For companies with sensitive know-how – protective measures under the GeschGehG (Geschäftsgeheimnisgesetz, German Trade Secrets Act), NDAs and action in the event of trade secret theft. ITMR is your lawyer for companies that want to protect trade secrets and know-how under the GeschGehG.
How companies effectively secure know-how, access and confidentiality
ITMR Rechtsanwälte advises companies on trade secret protection, from identifying protectable know-how through protective measures and contracts to preservation of evidence and injunctive relief in a conflict.
For companies, trade secret protection is rarely just a matter of legal definition. In practice, robustness is usually decided where sensitive information has to be identified, distributed internally, framed in contracts, disclosed in projects and later proven in a conflict. Effective information protection therefore combines capturing know-how, drafting contracts and technical as well as organisational measures.
Anyone who commercially uses source code, product roadmaps, pricing logic, training and evaluation data, technical parameters, customer and supplier structures, negotiation patterns, data room documents or internal decision models needs more than a general assertion of confidentiality. What is required is a protection architecture that holds up legally, works operationally and can be explained concretely in a dispute.
We advise companies, entrepreneurs, founders, start-ups, agencies, platform operators, investors, executives and other professional market participants on building exactly this protection architecture. This ranges from identifying protectable know-how through organisational and contractual measures to access control, preservation of evidence and injunctive relief in a conflict.
This page is right for you if the commercial value lies mainly in internally controlled knowledge, parameters, project states, access structures, data rooms or processes that are not readily visible. If the focus is on registered protection, trade mark strategy or pure contract drafting, industrial property protection, NDA / confidentiality agreement, IT contract / software contract or data law & Data Act are often the more appropriate starting point.
Responsible for content: Jean Paul P. Bohne, Fachanwalt für IT-Recht (certified specialist lawyer for IT law), Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law), AI Officer (DEKRA), reviewed on 23 October 2026 (German version)
Quick start: what is your matter about?
Identify and protect know-how
Define information categories, protection levels and access.
NDA and contract architecture
Regulate purpose limitation, recipients, return and deletion.
Employee changes and service providers
End access, document handovers, separate know-how.
Leak, evidence and injunction
Secure evidence and assess claims early.
Your contact: Jean Paul P. Bohne, LL.M., MM
Rechtsanwalt (lawyer), partner, Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law) and Fachanwalt für IT-Recht (certified specialist lawyer for IT law).
What happens after your enquiry?
After your enquiry, we get back to you within 24 hours on working days. The first contact is free of charge. Before any costs arise, we tell you so explicitly.
- A short description is enough. Helpful are a brief description of the situation, the categories of information affected, the persons or service providers involved, the current project or conflict status and an indication of whether it is mainly about prevention, contract structure or already a dispute.
- Receipt and initial sorting. We assess the enquiry on the basis of the project described, the documents and the apparent goal. Deadlines and dates should be clearly recognisable.
- Suitable starting point and cost range. We clarify whether an initial consultation, a service package or a specific mandate is the next step. As soon as the scope of the review is clear, we tell you the cost range – before work begins.
In brief
Secret protection only becomes robust when information, access, contract chain, documentation and responsiveness fit together. A single non-disclosure agreement does not replace a protection concept.
Typical cases from our trade secret protection practice
Data roomDisclosure before due diligence
- Starting point
- A start-up opens a data room before an investor round.
- Key difficulty
- It has not been defined which information is shown, released in stages or kept internal.
- Our work
- We structure disclosure levels, groups of recipients, logging and return mechanisms.
- Work result
- A documented disclosure with clear purpose limitation.
Simplified example.
DisputeSuspected leak
- Starting point
- A former project partner is apparently using confidential pricing logic.
- Key difficulty
- Access and disclosures are only partially documented.
- Our work
- We secure logs and the contract chain and assess injunctive relief and interim legal protection.
- Work result
- A robust factual line for further action.
Simplified example.
Typical constellation from practice
Departure of a developer
- A scenario that comes up regularly:
- An administrator with access to repositories and cloud accounts leaves the company.
- The actual problem:
- Open access, private storage locations and unclear return obligations jeopardise the strength of evidence.
- Our contribution:
- We manage revocation of access, return, documentation and the separation of general experience from know-how.
- Tangible result:
- Clean proof of the offboarding.
Typical scenario for illustration, not a specific mandate.
What you will have at the end
| Service | Concrete result | Next step |
|---|---|---|
| Know-how mapping | Information map with categories, protection levels and access | Name information categories |
| Protective measures | Coordinated organisational and technical measures with evidence | Send existing rules and rights |
| Contract architecture | NDA, project contracts and data room rules matching the disclosure situation | Describe contracts and project situation |
| Dispute | Preservation of evidence, assessment of claims and line for urgent and main proceedings | Communicate situation and deadlines |
Where trade secret protection is really decisive in companies
Mandates in this field rarely begin with an abstract definition. Usually there is already a situation in which disclosure, access, exit or conflict is commercially pressing.
Before pitch, demo, data room or due diligence
Before investors, acquirers, strategic partners or customers gain insight, it must be clear which information may be shown at all, which is only released in stages and which is better kept internal. Especially in transaction and growth phases, trade secret protection, start-up advice, IT law and clean chains of title closely interlock.
In development, software, SaaS and cloud projects
The more external developers, agencies, providers or integrators are involved, the more important purpose limitation, support access, subcontractors, further developments, export rules and documented approvals become. Otherwise confidential know-how quickly turns into ordinary project material with a weak protection position. Often relevant in more depth are IT law, IT contract / software contract and contract management.
When using artificial intelligence, cloud and open source
When confidential content ends up in external models, workspaces, support environments or build processes, it is about more than efficiency. Questions arise about purpose, access, training use, exit and provability. Then AI law, open source law, data law & Data Act and cybersecurity also move into the background of the protection architecture.
When key people change
Trade secrets come under pressure particularly quickly when administrators, developers, sales managers, founders or project leads leave the company. Open access, private storage locations, unclear return and deletion obligations or blanket catch-all clauses then become a problem of attack and evidence.
When leakage, use or disclosure is already at issue
Then general references to confidentiality are no longer enough. What matters is preparation of the facts, proof of access, technical securing, contract chains, clean communication and a robust line between out-of-court response, preliminary injunction and main proceedings. For the overarching dispute strategy, litigation & litigation PR is the next connection.
When the subject of protection is misclassified
Not every asset belongs on the same axis of protection. Sometimes secret protection is stronger than early disclosure; sometimes a property right or market positioning strategy holds up better. For drawing this line, the overarching page industrial property protection is often helpful.
When information legally qualifies as a trade secret
Trade secrets arise through a concrete legal and factual protection status. Labels alone are not enough. That is why the first question is never just whether information is internally sensitive. It is about whether it meets the statutory requirements and was actually protected.
Official starting points: Decisive are in particular Section 2 GeschGehG (opens in a new tab) and Directive (EU) 2016/943 (opens in a new tab), on the basis of which the German act was created.
Four requirements that must be met together
- The information must not be generally known or readily accessible outside the authorised circle.
- It must have commercial value precisely because it is secret.
- Reasonable confidentiality measures must be in place.
- There must be a legitimate interest in secrecy.
What companies often overestimate
Not everything that is internal, valuable or would be embarrassing is automatically a trade secret. Often overestimated are, for example, customer lists named in general terms, unsegmented project folders, generally accessible process descriptions and broad team chats. The same applies to data sets for which it was never properly defined who may see and use what. Likewise, a single non-disclosure agreement does not yet replace a protection concept.
Why documentation is so important
In a conflict, a company must be able to do more than assert that something was secret. It must regularly be able to explain which specific information is affected, why it was commercially relevant, which protective measures applied and who had access. Added to this is on what contractual basis a disclosure took place and how deviations were detected or limited.
The more commercially significant a piece of information is and the greater the pressure of disclosure or leakage, the less symbolic confidentiality suffices. Protection only becomes robust when information, access, contract chain, documentation and responsiveness fit together.
Identifying know-how before it is distributed
Many companies lose protection in advance and not only in a dispute. The reason: they never properly defined which information actually requires secrecy. Anyone who treats everything as “strictly confidential” often ends up protecting nothing convincingly. You can provisionally check whether your information meets the protection requirements of the GeschGehG with the trade secret check.
What typically qualifies as a trade secret
- source code, build and deployment logic, architecture decisions and migration paths
- pricing logic, margin models, offer and negotiation patterns
- training and evaluation data, internal prompt libraries, model parameters and rating systems
- roadmaps, product strategies, unpublished features and roll-out planning
- supplier and customer structures, terms models, due diligence documents and data room documents
- manufacturing or testing processes, technical tolerances, process parameters and know-how from pilot projects
What must be separated from this
- general experience of individual employees
- material that can be traced anyway from the product, market presence or publicly accessible sources
- vaguely mixed project communication without separation between open working knowledge and core know-how
- personal data, for which data protection law is primarily the leading axis of protection
- constellations in which trade mark, design, patent or competition questions are more relevant
Practical mistake: Information in need of protection is often only named once a conflict has already escalated. At that point, delimitation, proof and prioritisation are often much more difficult because approvals, access and disclosures can no longer be cleanly reconstructed.
An early information map is therefore advisable: which categories exist, who owns them commercially, where are they stored and who needs access? Which disclosure levels apply and which contractual or technical limits take effect? Especially in digital business models, this mapping is the prerequisite for setting up confidentiality agreements, project contracts, data rooms and exit processes in a targeted way at all.
Organisational protective measures that hold up when it matters
Reasonable confidentiality measures are neither a purely IT issue nor a purely contractual issue. Protection becomes strong where roles, processes, systems and evidence work together.
Information classes and responsibility
Every critical category of information should be assigned a protection level, a business owner and clear approval rules. This makes it traceable which data or documents may only be disclosed internally, only to defined project partners and only in controlled data rooms.
Need-to-know instead of full access
The broader the circle of access, the more difficult it later becomes to demonstrate that something was actually protected. Role-based permissions, clean user groups, segmented project folders and controlled admin or support access are therefore often more important than symbolic warning notices.
Approval, export and upload logic
Besides the question of who may read, what also matters is who may pass on, export, mirror, train, upload or store locally. This applies to classic data rooms as well as collaboration tools, code repositories, external workspaces and artificial intelligence systems.
Training, control and lived routine
Protective measures must be understood and lived in the company. This includes onboarding new team members, clear communication channels in case of uncertainty, documented approvals, regular review of existing rights and an emergency system for suspected cases.
Official and judicial points of reference: For the legal assessment, besides the GeschGehG in its official version (opens in a new tab), guidance from recent case law also helps, such as the judgment of the Bundesarbeitsgericht (Federal Labour Court) of 17.10.2024 – 8 AZR 172/23 (opens in a new tab). Practical guidance is also provided by the Industrie- und Handelskammer Gießen-Friedberg (Chamber of Industry and Commerce) (opens in a new tab).
Where technical protection logic, incident structures and permission questions become particularly deep, close integration with cybersecurity and compliance makes sense. As soon as personal data is affected, it must also be examined how trade secret protection and data protection law are properly organised side by side.
Contract architecture instead of clause reflex
Many companies react to secret protection reflexively with a single confidentiality clause. That is often too little. The contractual side only becomes viable when it matches the real project and disclosure situation.
Non-disclosure agreement as a starting point, not an end point
A non-disclosure agreement and a confidentiality agreement are often advisable, for example before pitches, transactions, development cooperations or exploratory talks. On their own, however, they usually do not solve the real core questions: who may use what for which purpose, pass it on to whom, feed it into which systems, keep it for how long and return or delete it in what form?
Project contracts and scopes of work
Especially in development, SaaS, cloud and integration projects, the confidentiality logic must be combined with the scope of work, rights of use, duties to cooperate, subcontractors, support access, change processes and exit rules. For this, IT law, IT contract / software contract and contract management must regularly be considered.
Data rooms, due diligence and investor communication
Before disclosure to investors, acquirers or financing partners, tiered data rooms, clear groups of recipients, logging, return mechanisms and clean purpose limitations are needed. Anyone who discloses too much, too early or in too unstructured a way here often creates later problems of evidence and negotiation themselves.
AI, data access, open source and support rights
As soon as external AI tools, platforms, open source components or data-driven service models are involved, it must be examined which rights of use, support, training, audit or further development third parties receive. At this point, AI law, data law & Data Act and open source law often interlock.
What contracts on secret protection often come down to: definition of the subject of protection, purpose limitation, group of recipients, subcontractors, support access, onward transfer, export, audit, return and deletion. Added to this are evidence precautions, responsibilities at the end of the cooperation and a commercially sensible escalation line for breaches.
Managing exits, employee changes and service providers properly
In the end, many proceedings revolve around changeover and transition situations rather than new product launches. That is exactly where it becomes clear whether secret protection existed only on paper or was thought through operationally.
When key people leave
Particularly relevant are the return and securing of devices, revocation of admin and cloud access, clean-up of private storage locations, checking of local copies and ticket and repository access. Added to this are documentation of documents handed over and clean proof of offboarding. Anyone who takes these steps too late or in a disorderly manner often loses strength of evidence.
Distinguishing between general experience and protected know-how
Not everything a person still knows after leaving is prohibited. The critical point often lies in separating general experience on the one hand from specifically protected information, files, parameters, customer allocations, calculations or project documents on the other. This separation must be prepared early.
Service providers, freelancers and agencies
In practice, external parties often receive broader access than is actually intended internally. Particularly sensitive are shared folders, support accounts, test environments, chat histories, data exports, further developments, subcontractors and the question of which knowledge may remain with whom after the end of the project.
Onboarding into your own company
Companies must protect their own secrets. At the same time, they should avoid newly hired employees or external staff bringing other companies' trade secrets into projects. This side of the protection logic also belongs in training, contract drafting and project management.
Typical risk in exit situations: The substantive legal position may be solid but loses impact if access is not ended in time, handovers are not documented and suspicious circumstances are not properly secured. Then a protection case quickly becomes a factual problem.
Dispute, access, evidence and injunction
When trade secrets have already leaked or improper use is at issue, the reaction should be structured and calm. Anyone who communicates too much too early or secures evidence too late often weakens their own position unnecessarily.
What should be secured immediately
- access and export logs, ticket states, approvals and communication histories
- devices, repositories, workspaces, local copies and data room access
- the specific delimitation of what is said to be affected as a trade secret
- contract chain, allocation of roles and authorisation status of the persons involved
- a coordinated internal communication path between management, technology and the legal function
What must be legally assessed early
- injunction, removal, destruction, recall, surrender, information or damages
- do not play out-of-court response, urgent court action and main proceedings against each other
- consider confidentiality in the proceedings from the outset
- coordination with litigation & litigation PR, privacy litigation or preliminary injunction where adjacent escalation situations are affected
Official points of reference for enforcement: For claims and procedural protection, important starting points are in particular Section 6 GeschGehG (opens in a new tab), Section 7 GeschGehG (opens in a new tab), Section 16 GeschGehG (opens in a new tab) and Section 273a Zivilprozessordnung (German Code of Civil Procedure) (opens in a new tab).
In a dispute, it is often more important for companies than a loud appearance that information, facts, motions and internal communication are properly coordinated. Anyone who can coherently demonstrate protectability, measures, access and disclosures starts much stronger than a company that has outrage but no robust factual line.
Key terms of trade secret protection
- Trade secret
- Information that is not generally known or readily accessible, has commercial value because it is secret, is protected by reasonable measures and in whose secrecy there is a legitimate interest.
- Reasonable confidentiality measures
- Interplay of roles, processes, systems and evidence that supports the protected status of information.
- Need-to-know
- Access only for persons who actually need the information for their task.
- Non-disclosure agreement (NDA)
- Confidentiality agreement, often advisable before pitches, transactions or cooperations. It does not replace a protection concept.
- Information map
- Early mapping of information categories, commercial allocation, storage locations, access and disclosure levels.
- General experience
- General knowledge of a person, which must be separated from specifically protected information.
These terms explain the language used on this page. What matters is always the specific individual case.
Provisions and reliable external sources
The following sources are cited on this page.
| Provision | Content | Practical significance |
|---|---|---|
| Section 2 GeschGehG (opens in a new tab) | Definitions | Requirements for a trade secret. |
| Section 6 GeschGehG (opens in a new tab) | Removal and injunction | Basis of claim in a dispute. |
| Section 7 GeschGehG (opens in a new tab) | Destruction, surrender, recall | Further claims in the event of infringement. |
| Section 16 GeschGehG (opens in a new tab) | Confidentiality in proceedings | Procedural protection for trade secrets. |
| Section 273a Zivilprozessordnung (opens in a new tab) | Secret protection in civil proceedings | Confidentiality in proceedings. |
| Directive (EU) 2016/943 (opens in a new tab) | Protection of confidential know-how | EU law basis of the GeschGehG. |
| BAG, 17.10.2024 – 8 AZR 172/23 (opens in a new tab) | Case law | Guidance for the legal assessment. |
Frequently asked questions on trade secret protection
The following questions come up particularly often in due diligence situations, development projects, exits and contentious proceedings.
Is a non-disclosure agreement alone sufficient?
In many cases, no. A non-disclosure agreement is often advisable but does not replace a protection concept. Protection usually only becomes robust through identified secrets, tiered access rights, lived approval processes, suitable contract architecture and documentable exit and response procedures. ITMR Rechtsanwälte builds this protection concept with you.
Are source code, pricing logic, customer data or prompts automatically trade secrets?
No. Such information can be trade secrets, but it does not have to be. Decisive are secrecy, commercial value, reasonable protective measures and a legitimate interest in secrecy. For personal data, data protection law must also be considered. ITMR Rechtsanwälte reviews the protection status.
What must be clarified before a pitch, demo, due diligence or opening a data room?
Before any disclosure, it should be clear which information may actually be shown, who may see it and for what purpose it may be used. It must also be clarified which subcontractors or platforms are involved and how access, return, deletion and logging are secured. ITMR Rechtsanwälte structures the disclosure.
What is particularly sensitive in employee changes and with service providers?
Particularly sensitive are open admin access, private storage locations, unclear return and deletion obligations, missing documentation of information handed over and confidentiality clauses that are too broad or too general. In a conflict, this quickly becomes a problem of evidence. ITMR Rechtsanwälte manages such transitions.
How do trade secret protection, data protection and industrial property protection differ?
Trade secret protection protects non-public, commercially valuable information. Data protection law protects personal data. Industrial property protection mainly concerns registered and market positions such as trade marks, designs, technical property rights and competition issues. In practice, these areas can overlap but remain legally distinct. ITMR Rechtsanwälte determines the axis of protection.
What is more important first in a dispute: the legal position or the evidence?
Both. In practice, however, cases often fail due to a lack of preparation of the facts and less often because of the abstract provision. Anyone who cannot show what was secret, which protective measures applied, who had access and how the leak occurred considerably weakens their own position. ITMR Rechtsanwälte secures the factual line.
Further entry points at ITMR
Depending on the situation, the same follow-up page is not always the right one. These entry points are particularly close to trade secret protection.
NDA / confidentiality agreement
When a specific confidentiality agreement is to be drafted, reviewed or restructured.
IT law
When the focus is on software, SaaS, cloud, API or project structures.
Data law & Data Act
When data access, data use, the data economy or governance are in the foreground.
AI law
When artificial intelligence, the AI Act, allocation of roles and AI governance form the main question.
Open source law
When open source software, licence chains and disclosure risks shape the conflict.
Litigation & litigation PR
When urgent measures, main proceedings and commercial dispute strategy steer the mandate.
Reviewing trade secret protection in a structured way
Whether information is merely sensitive internally or really legally protected as a trade secret is usually decided by the protection architecture. Early classification is often cheaper than major repairs later after a pitch, data room opening, team change or leak.
Typical reasons for an initial review
- a pitch, demo, due diligence or investor round is coming up
- a development, SaaS, cloud or AI project is being opened up to external parties
- key people are leaving the company
- support, admin or data room access is too broad
- a breach, data leak or use by third parties is already emerging
Responsible lawyers at ITMR
Rechtsanwalt (lawyer) | Partner | Wirtschaftsmediator (business mediator) | Fachanwalt für Urheber- und Medienrecht (certified specialist lawyer for copyright and media law) | Fachanwalt für IT-Recht (certified specialist lawyer for IT law) Jean Paul P. Bohne, LL.M., MM is your contact for trade secret protection at the interfaces of IT projects, data and process questions.
In these constellations, Andreas Buchholz and Dominik Skornia, LL.B. are also obvious points of contact at ITMR. View the ITMR team
Trade secret protection – lawyer for know-how protection at ITMR.
Legal status: 23 October 2026. This overview provides initial orientation and does not replace a review of the specific case.
Responsible for content: Jean Paul P. Bohne, Fachanwalt für IT-Recht (certified specialist lawyer for IT law), AI Officer (DEKRA), reviewed on 23 October 2026 (German version)