The German Trade Secrets Act in plain English
Officially titled the Act on the Protection of Trade Secrets, the law has been in force since April 2019. It transposes Directive (EU) 2016/943, the EU Trade Secrets Directive, into German law. Among other things, it defines when information qualifies as a trade secret, what others may not do with it, and what claims companies have in the event of an infringement.
In practice, one rule is especially decisive. In the past, it was essentially enough for a company to make it clear that it wanted to keep information secret. Today, it must be able to show that it actively protected that information. Without appropriate protective measures, there is no protection as a trade secret.
A comparison: a company site with a fence, a gatehouse, and visitor badges makes it obvious to everyone that unauthorized persons are meant to stay out. If, on the other hand, the gate is always open and anyone can come and go, it will be hard to prove later that access was prohibited. The same goes for company know-how.
What the GeschGehG regulates
- Definition (Section 2): A trade secret must meet three conditions. The information is not generally known and therefore has economic value. It is protected by appropriate confidentiality measures. And there is a legitimate interest in keeping it secret.
- Prohibitions (Section 4): It is prohibited to acquire, use, or disclose a trade secret without authorization – for example, by secretly copying documents or breaching a confidentiality obligation.
- Permitted acts (Section 3): It is permitted to discover a secret independently or to examine and take apart a publicly available product (reverse engineering). For items that someone merely possesses lawfully – such as a prototype they were given – this applies only if no obligation stands in the way, for example under a contract.
- Exceptions (Section 5): Under certain conditions, disclosure is permitted, for example for journalistic reporting or to expose unlawful conduct.
- Claims (Sections 6 et seq.): Those affected can demand, among other things, injunctive relief, information, the recall of infringing products, and damages.
- Criminal liability (Section 23): Anyone who intentionally infringes a trade secret – for example, for personal gain or for competitive purposes – faces a fine or imprisonment of up to three years. If the offender acts on a commercial basis, or if the secret is to be used abroad, the maximum rises to five years.
What counts as “appropriate” is not spelled out in detail in the law. It depends on the circumstances, such as the value of the information. A mix of organizational, technical, and contractual measures is common.
A practical example
Here’s a typical scenario: A manufacturer of specialty valves notices that a competitor is suddenly offering a strikingly similar product. Suspicion falls on a former design engineer who is said to have downloaded large numbers of drawings before changing jobs. In the legal dispute that follows, everything hinges on one question: did the company adequately protect its design data?
The answer is sobering: all employees had access to the entire drawing archive, there were no confidentiality rules, and downloads were not logged. That makes proving the case difficult. The company then introduces a permissions model based on the need-to-know principle – each person sees only what they need for their work. It also labels confidential documents and puts confidentiality obligations into its contracts.
Why does this matter for businesses?
Especially in small and mid-sized businesses, a company’s value often lies in its know-how: in processes, formulas, cost calculations, or customer relationships. If you don’t protect this knowledge in a way you can prove, you may not be able to rely on the law when it really counts.
The threat doesn’t only come from within. In ransomware attacks, criminals often steal data first and then threaten to publish it. Stolen documents and credentials are traded on the dark web. And with social engineering, attackers try to manipulate employees into handing over confidential information. Once a secret is out, the damage can hardly be undone. That makes IT security a form of legal precaution, too.
What businesses should do now
- Identify your secrets: Determine which information truly deserves protection and classify it.
- Restrict access: Grant permissions on a need-to-know basis and review them regularly.
- Secure it technically: Use encryption, multi-factor authentication (sign-in with a second factor), and access logging.
- Put it in writing: Sign non-disclosure agreements (NDAs) with employees, partners, and service providers. If you give partners prototypes or samples, rule out reverse engineering contractually.
- Label and train: Mark confidential documents and make your team aware of social engineering.
- Manage departures: Revoke access immediately when someone leaves and document the return of documents and devices.
- Keep evidence: Document your measures, because in a dispute what counts is proof. For a legal assessment of individual cases, it’s advisable to consult a lawyer.
How Rootsektor can help
Our Dark Web Monitoring automatically searches relevant sources for indications concerning your company – such as leaked credentials or company data being offered for sale – and notifies you when something is found. We then support you individually with countermeasures. A penetration test shows whether your technical safeguards hold up in practice; you can request a quote via our Pentest Quote page. For any other questions, feel free to contact us.