A trade secret case is won or lost in the first 48 hours

When a sales manager downloads the customer pipeline before resigning, a developer copies source code to a private account, or a supplier begins using an unreleased formula, the immediate instinct is to accuse the person of “stealing company information.” That description is too broad to guide a Kenyan court. The business must identify the particular information, explain why it was confidential, show how the defendant obtained or used it, and connect that conduct to a legal duty and a practical remedy.

The first response should therefore be controlled preservation, not a public confrontation. Suspend only the access that presents a real risk; preserve server, device and cloud logs; record who made each preservation copy; and stop automatic deletion. Do not remotely wipe a device before forensic advice, circulate allegations to customers, or ask an employee to unlock a personal account without considering privacy and employment-law consequences. A hurried act can destroy the evidence needed for an injunction or create a separate claim.

Kenya does not operate a general trade-secret registration system. Protection usually depends on contract, the law of confidence, employment duties, property or intellectual-property rights in particular materials, data-protection duties and, where the facts fit, computer-misuse law. The route must be matched to the evidence instead of treating “trade secret” as a self-proving statutory label.

Name the information precisely before alleging misuse

Prepare a confidential information schedule. It might list the source-code repository and commit range, a dated pricing model, a formula version, named customer records, a tender strategy, manufacturing tolerances or a supplier rebate table. For each item, identify its owner, creator, location, permitted users, commercial use, protection controls and the date on which the suspected access or disclosure occurred. A whole server, “all business methods” or everything learned during employment is rarely a useful description.

Separate secrets from an employee’s general skill and experience, public information, material lawfully received from another source and information independently developed. A customer name visible on a public website is not secret merely because it also appears in a CRM. The non-public buying history, decision-maker notes, negotiated margins and renewal date attached to that customer may present a different issue. The useful question is what confidential combination the defendant could exploit without repeating the claimant’s work.

Real secrecy measures matter. Record role-based permissions, password controls, download restrictions, confidentiality clauses, contractor terms, document labels, visitor rules, training, device policy and exit procedures. In Style Industries Ltd v Kasumba, the Employment and Labour Relations Court emphasised the need to identify the confidential information and prove that it was safeguarded. A label applied after the dispute began is weaker than evidence of controls used while the information was commercially valuable.

Build an access-to-use timeline, not a folder of suspicions

A defensible timeline starts before the disputed event. Capture the person’s normal role, usual access and ordinary download pattern; then map the exceptional activity. Relevant material can include authentication records, VPN logs, repository events, USB activity, print jobs, forwarding rules, cloud-sharing invitations, file hashes, audit trails and messages. Record the time zone and system clock because apparent contradictions often arise when platforms store timestamps differently.

Keep original exports and document the collection method. A screenshot may illustrate a message but usually provides less technical context than a native export. If a laptop or phone may be examined, use a competent forensic process and preserve the device state. Section 106B of the Evidence Act addresses admissibility of electronic records and the accompanying certificate. The litigation team should plan that foundation during collection, not after authenticity is challenged.

Access alone does not prove misuse. A finance employee may legitimately export a report at month-end; a developer may clone a repository as part of assigned work. Look for a change in volume, destination, timing, permissions or later conduct. Compare the alleged secret with the competing product, proposal or solicitation at a technical level. If similarity can arise from public standards or common methods, the expert must distinguish those features from the claimed confidential contribution.

Identify the duty that made receipt or use wrongful

Start with signed instruments: employment contract, confidentiality agreement, consultancy terms, licence, joint-development agreement, due-diligence NDA, procurement conditions and settlement documents. Read the definition, purpose restriction, permitted recipients, return obligations, survival clause, governing law and dispute clause. A clause that prohibits disclosure may not clearly prohibit the recipient’s own competitive use; a clause tied to one project may not cover information obtained elsewhere.

Waweru v Optimise Outsourcing Limited illustrates why the actual confidentiality clause and the employment process both matter. A company dealing with a current employee must not assume that a genuine information-security concern removes the need for a fair disciplinary process. Preserve the evidence, give the employee the allegation and material necessary for a meaningful response, and keep the employment decision distinct from the later civil claim.

Where the defendant received information during a negotiation or trusted commercial relationship, the circumstances can support a duty of confidence even if the paperwork is imperfect, but the facts require careful proof. Show what was disclosed, why the recipient knew the limited purpose, and how the disputed use departed from it. If copyright subsists in copied code, manuals or drawings, consider the separate copyright route; confidentiality can protect information or know-how that copyright does not, while copyright protects qualifying expression without proving secrecy.

Choose a response that preserves the business

A targeted preservation and cease-use letter can be more effective than an inflated demand. It should identify the materials closely enough to be understood, require preservation of relevant devices and accounts, request confirmation of recipients and copies, propose secure return or deletion, and reserve rights. Avoid demanding deletion before evidence is preserved. If the facts remain uncertain, propose a neutral forensic protocol that limits inspection to agreed search terms and protects unrelated personal or third-party data.

Commercial containment may include revoking tokens, rotating credentials, changing an exposed process, informing a cloud provider, isolating a repository or contacting a recipient under confidentiality. Notify customers only where the legal and operational reason is clear. An accusation sent to a new employer, investor or market can create defamation, interference or confidentiality risk if it goes beyond what can be proved.

Do not use a police report as leverage in an ordinary contract dispute. The Computer Misuse and Cybercrimes Act creates offences concerning conduct such as unauthorised access, access with intent to commit another offence and unauthorised interference, but the elements must fit the digital conduct. A person who once had authorised access may still breach contract or confidence without every later act constituting a cybercrime. If criminal exposure is genuinely in issue, coordinate the civil preservation plan with specialist advice and the separate cybercrime guide.

An urgent injunction requires a remedy the court can supervise

If disclosure or use is imminent, delay can be decisive. An application under Order 40 of the Civil Procedure Rules may seek temporary protection while the claim is determined. The evidence should address the recognised injunction principles, but it must also define what the proposed order restrains. An order against using “any company information” may prevent lawful work and be difficult to police; an order tied to identified repositories, documents, customers or technical features is more workable.

Prepare a court-ready bundle before filing: agreements, the confidential information schedule, proof of ownership or control, access records, the forensic statement, correspondence, examples of the competing use and an explanation of the threatened harm. Explain why damages alone would not adequately address release of the particular secret. If the claim concerns customer solicitation, distinguish relationships developed through the employer’s confidential records from contacts based on the employee’s own reputation or public sources.

Without-notice relief is exceptional and carries duties of candour. Disclose important adverse facts, including prior circulation, weak controls, delayed action or disputed ownership. Plan how materials filed in court will remain protected: redact where appropriate, request suitable confidentiality directions and avoid reproducing the secret in an open affidavit more widely than necessary. The litigation process should not become the disclosure event.

Measure loss through the misuse actually proved

A damages claim needs a causal model. Lost profit may be relevant where identified opportunities moved because the defendant used the secret, but total revenue decline is not proof. Track the affected customers or products, the counterfactual probability of winning, avoided costs, contribution margin and mitigation. If the defendant saved development time by copying a process, expert evidence may compare the work avoided with legitimate independent development.

Keep ordinary commercial causes in view: price, service, staff relationships, market change and the claimant’s own performance. A customer choosing to follow an employee does not automatically prove use of a secret. The case becomes stronger when the claimant can link copied fields or internal timing to a solicitation, demonstrate reproduction of a non-public error or feature, or show access followed by a materially shortened development cycle.

Other relief may include delivery up or verified deletion, undertakings, a limited non-use order, return of devices owned by the claimant, contractual relief, interest and costs, depending on the pleaded basis and proof. Coordinate overlapping claims through the IP enforcement process so the same conduct is not described inconsistently across confidence, contract, copyright and computer-access allegations.

Personal data inside the secret creates a second compliance problem

Customer and employee databases often contain personal data as well as commercially sensitive information. The Data Protection Act applies its own principles, security obligations and breach-response requirements. The business must assess the effect on data subjects rather than treating the incident only as loss of corporate property. A forensic investigation should collect what is necessary, limit access and record the lawful purpose for processing.

Determine whether personal data was accessed, copied, disclosed or merely put at risk; what categories and how many people are affected; whether the data was encrypted; who received it; and whether it can be contained. Preserve the breach assessment and the reasons for any notification decision. Do not insert personal data unnecessarily into a demand letter or public filing in an effort to prove the commercial case.

If a contractor processed the data, review the controller-processor agreement, incident duties and subprocessor chain. Trade-secret return or deletion language should allow legally required retention and a secured evidential copy, but prohibit operational reuse. The same deletion certificate can record locations checked, copies removed, backups quarantined and any retained material with its legal basis and access restrictions.

Employee exits and vendor offboarding are the best prevention points

For high-risk roles, map access to the job rather than granting permanent administrator rights. Use repositories that log export and sharing, separate production from development, restrict bulk download, and review access when duties change. Confidentiality training should use examples from the business and explain where work files may be stored. A clause hidden in an old handbook cannot substitute for operational controls.

Before an announced departure, preserve relevant corporate records lawfully, recover company devices, revoke tokens at the appropriate time, change shared credentials, transfer accounts and remind the person of specific continuing duties. Ask for confirmation about company data on personal devices or accounts through a proportionate process. Do not prevent the employee from retaining payslips, statutory records or material needed for a bona fide employment claim.

Apply the same discipline to developers, laboratories, manufacturers, agents and cloud vendors. Contract for purpose-limited access, security, audit trails, incident notice, subcontractor control, verified return, backup treatment and transition assistance. If confidential know-how is deliberately shared for commercial use, allocate that permission in a precise IP licence agreement rather than relying on a non-disclosure clause to define the entire relationship.

Bring a fact pack to the first legal review

Collect the agreements, information schedule, ownership records, access matrix, security policy, training acknowledgements, exit documents, system logs, native messages, device list, chronology, known recipients, suspected competing material, customer communications, loss records and data-breach assessment. Mark what is verified and what remains an inference. That distinction helps counsel decide whether to seek an undertaking, negotiate a forensic protocol, commence proceedings or investigate further.

Request a Kenyan trade secret dispute review before sending allegations or altering the evidence. Provide the exact information at risk, how it was protected, the recipient’s duty, the suspected act, the present threat and the outcome the business needs. A useful first strategy should preserve admissible evidence, contain the disclosure, protect affected people and frame a remedy narrow enough to obtain and enforce.

Frequently asked questions

What must a business prove in a Kenyan trade secret dispute?

The business should identify the specific information, show why it was confidential and commercially important, prove the defendant received it under a contractual or factual duty, and connect the alleged copying, disclosure or use to evidence and loss. Access alone is not the same as misuse, and broad descriptions such as all company information are usually unhelpful.

Can a Kenyan court urgently stop disclosure of confidential information?

A party may seek temporary injunctive relief under the Civil Procedure Rules where the legal and evidential requirements are met. The proposed order should identify the information and prohibited acts closely enough to be fair and enforceable, and the applicant should explain the immediate threat, preservation steps and why damages would not be an adequate answer.

Should a company delete copied files as soon as it discovers them?

Not before preserving evidence. A premature wipe can remove logs, timestamps, metadata and proof of destination. The safer sequence is to contain access, preserve original records and devices through a documented process, obtain forensic advice, and then use an agreed or court-supervised return and deletion protocol.