How can confidential business information be protected?
Before sharing company information, distinguish trade secrets from general confidential data and agree the purpose, access, retention and return conditions.
What should be agreed before confidential data is shared?
When handing over company data to an external research institute, advisor, or partner company, you must first select only the necessary amount and leave a record of the fact that it has been managed confidentially with a confidentiality mark, confidentiality agreement, and viewing records. This is because the law only protects information that is kept confidential as a trade secret. If customer personal information is mixed, prepare a separate consignment document, and prove the point of possession of key technical data by original proof or deposit of technical data.
What information does the law protect as a trade secret?
Article 2 of the 「Unfair Competition Prevention and Trade Secret Protection Act」 defines a trade secret as something that is not publicly known and has independent economic value, and is managed as a secret production method, sales method, or other technical or management information useful for business activities. Management information frequently exchanged during the external advisory process, such as cost data, unit prices by business partners, and customer analysis results, is also subject to protection if it meets the requirements. Conversely, information that is widely known in the industry or available to anyone as public information does not become a trade secret even if it is bound by a contract.
Three requirements for trade secrets and what to do when handing over data
| Requirements | meaning | What to do when turning over data |
|---|---|---|
| unknown | not publicly known | Listed separately from already disclosed data |
| economic value | Has independent economic value | Record the reasons why you will be at a disadvantage if your competitors find out |
| secret management | Maintained as a secret | Privacy marks, access restrictions, contracts, viewing history |
Among the three requirements, the one that a company can meet on its own is confidentiality management. Even if information that has been poorly managed is leaked after being passed over, it may be difficult to recognize it as a trade secret.
How do we show that we have managed to keep it secret?
Mark files and documents as private, decide who can view them, and keep a record of who opened them and when. In a confidentiality agreement with an external organization, the scope of confidentiality, purpose of use, number of people to view, storage period, and method of return and destruction after the contract ends are specified. It is easier to keep records by using a shared space where you can give access rather than sending materials by email. If all data is visible to all employees within the company, it is difficult to claim that it has been kept confidential. Check internal access rights before handing them over to an external party, and retrieve the rights of employees who have left the company or completed a project in a timely manner.
What relief can I receive if the submitted data is leaked?
The same law defines acts of acquiring trade secrets through illegal means or using or disclosing such acquired trade secrets as acts of trade secret infringement. There are provisions for estimating the amount of damages when a party who has suffered damage due to infringement claims compensation, and if the infringement is recognized as intentional, the court may set the amount of compensation not to exceed five times the amount recognized as damages. At this time, the court considers the superior status of the infringing party, the amount of damage, the profits gained from the infringement, and the period and number of infringements.
Redress is an afterthought, and litigation takes time and money. Having confidentiality controls in place before handing over data is a good starting point for receiving this relief. When a leak is suspected, damage can be reduced by establishing an initial response sequence in advance to preserve evidence and request the other party to stop using it.
What more do you need to do if customer personal information is mixed up?
Handing over customer lists or purchase records to an external organization for analysis may constitute an entrustment of personal information processing. Article 26 of the 「Personal Information Protection Act」 stipulates that when entrusting, a document containing prohibition of processing other than the purpose of entrustment and technical and managerial protection measures, etc. must be made and the entrusted work and trustee must be disclosed so that the information subject can easily identify them. The consignor must train the consignee and supervise that it is handled safely, the consignee cannot use it beyond the scope of its duties, and must obtain the consignor's consent to re-entrust it. First consider whether names and contact information are absolutely necessary for analysis, and skip any unnecessary items. A checklist of the stages of designing a customer survey can be viewed with Customer survey sample size.
How do we prove when we have the data?
Pursuant to Article 9-2 of the same Act, holders of trade secrets may register electronic fingerprints, which are unique identification values extracted from electronic documents containing trade secrets, with an original document certification agency. When an original certificate is issued, it is presumed that the information contained in the document was held at the time of registration. Since only the identification value is registered, not the document itself, the contents are not revealed to the outside world. If you are a small or medium-sized business, it is also worth looking into support for utilizing the technical data escrow system established in Article 9 of the Act on Small and Medium Enterprise Technology Protection and Support. If you deposit technical data before handing it over to your partner, it will become the basis for a dispute over which party got it first. For joint research with universities, also check out Performance Attribution Agreement.
What alternatives are there for data sharing?
Comparison by data sharing method
| way | If it fits | protection level | limit |
|---|---|---|---|
| Raw data provided | Precise analysis is essential | Leaning on contracts and management | High damage in case of leak |
| Providing summary/processed data | The purpose is to identify trends and structures | relatively high | Detailed analysis is difficult |
| Provided after pseudonymization | Customer-level analysis is required | Reduced risk of personal identification | Processing standards and administrative burden |
| In-house viewing only allowed | extremely sensitive data | highest | Reduced work efficiency of external organizations |
For most assignments, it is sufficient to start with summarized and processed data and supplement only the necessary parts with raw data. If you keep a list of what materials are being handed over and why, it is easy to confirm their return and destruction after the assignment is completed.
What are the confidentiality principles of external research institutes?
Korea Research Institute of Business & Branding's operating principles are to clarify the basis for research and consultation and to manage the conditions of confidentiality of request relationships, interests, and data. When choosing an external organization, first ask who will store the materials where, and what will be done with them once the assignment is completed. Check out Research independence and confidentiality for the positions to which this principle is applied, check out Effects of Management Consulting for what remains in the company when entrusted with advice, and check out Management Research Methods for the entire research method.
Trade secret protection Frequently asked questions
Is it enough to just sign a confidentiality agreement?
A contract is an important basis, but it is easy to show that it has been kept confidential if it is accompanied by usual confidentiality indications, access restrictions, and viewing records.
Can I manage materials that have already been turned over from now on?
Organize a list of the materials handed over and check with the other organization about the storage status and return/destruction plan. It is a good idea to mark and record the materials you will be turning over in the future.
What is the difference between original certification and technical data escrow?
Original authentication is a method of registering an electronic fingerprint of an electronic document to prove the point of possession, and escrow is a system that entrusts the technical data itself to a third party.
Can analysis results reports also be trade secrets?
If you meet the requirements, you can be protected as management information. Write down in the contract who can write the report, to what extent, and whether it can be quoted externally.
References
- National Legislation Information Center, Article 2, Article 9-2, and Article 14-2 of the Unfair Competition Prevention and Trade Secret Protection Act, effective May 28, 2026. https://www.law.go.kr/법령/부정경쟁방지및영업비밀보호에관한법률
- National Legislation Information Center, Article 26 of the Personal Information Protection Act, effective September 11, 2026. https://www.law.go.kr/법령/개인정보보호법
- National Legislation Information Center, Article 9 of the Act on Small and Medium Business Technology Protection and Support, effective July 1, 2026. https://www.law.go.kr/법령/중소기업기술보호지원에관한법률