A departing employee downloads your customer database, forwards account notes to a personal email address, or starts contacting clients from a competing business. Your first response can affect both the damage and the evidence available later. If you suspect an employee stole client list information, focus on securing company systems, preserving records, and determining what legal protection the information actually has. This guide explains the first 72-hour priorities for California businesses without assuming that every client list is a trade secret or every competing employee broke the law.
Hours 0–6: Secure access and preserve evidence
Start with access control, not accusations. Coordinate with your IT provider to revoke the former employee’s company credentials, terminate active sessions, and review shared passwords. Preserve relevant records before routine deletion, account closure, or device reassignment removes them.
- Save CRM export logs, email forwarding records, cloud download activity, and relevant access logs.
- Preserve company laptops, phones, external drives, and backups without resetting or wiping them.
- Keep the employee’s confidentiality agreements, policies, job description, and departure communications.
- Record when the suspected activity occurred, who discovered it, and what each person observed.
Ask counsel whether a litigation hold is appropriate. If a dispute is reasonably anticipated, relevant evidence should be preserved, including records that may weaken your position. A qualified forensic professional can collect data while preserving metadata and documenting the process. Do not access personal accounts or devices merely because you know a password; authority and privacy restrictions matter.
Hours 6–24: Determine whether the client list is protected
Under California Civil Code § 3426.1, a trade secret must derive actual or potential independent economic value from not being generally known to others who can obtain economic value from its use or disclosure. It must also be subject to reasonable efforts to maintain secrecy. A client list can qualify, but the label “confidential” does not settle the question.
A spreadsheet of publicly advertised business names presents a different case from a restricted database containing decision-makers, negotiated pricing, buying history, renewal dates, and nonpublic customer preferences. Evaluate the information as a whole and how your business protected it.
- Was access limited to employees who needed the information?
- Were confidentiality obligations communicated and documented?
- Could competitors readily obtain the same information from public sources?
- What time, expense, or research produced the useful compilation?
An attorney assessing business litigation options can distinguish potentially protected information from ordinary industry knowledge. Weak secrecy practices may limit a claim, even when an employee’s conduct seems unfair.
Hours 24–48: Verify what happened and assess exposure
Separate confirmed facts from assumptions. A large download may reflect unauthorized copying, but it may also relate to assigned work. A client’s move to another provider does not, by itself, prove misuse. Build a timeline connecting access, copying, departure, and any subsequent use or disclosure.
Identify the exact files involved, their contents, where they went, and whether copies remain outside your control. Preserve customer reports and relevant communications in their original form. If a customer describes a solicitation, ask for the date, wording, and any messages rather than suggesting what the customer should say.
Also check whether the exported records include personal information, financial details, or login credentials. A suspected trade secret incident can raise separate privacy and security obligations. California Civil Code § 1798.82 may require notification when covered personal information is acquired, or reasonably believed to have been acquired, by an unauthorized person; not every copied client list triggers notice. For covered breaches discovered on or after January 1, 2026, notice generally must be provided within 30 calendar days of discovery or notification of the breach, subject to statutory exceptions, including specified law-enforcement delays and measures necessary to determine the breach’s scope and restore system integrity. If notice is required for more than 500 California residents as a result of a single breach, the business must submit a sample notice to the California Attorney General within 15 calendar days after notifying affected residents. Obtain a prompt assessment rather than assuming notification is always required or never necessary.
Hours 48–72: Choose proportionate legal action
With the evidence preserved, counsel can evaluate a targeted demand, negotiated return of information, or state or federal court action. A qualifying trade secret may support a claim under California’s Uniform Trade Secrets Act and, when federal requirements are met, the federal Defend Trade Secrets Act, 18 U.S.C. § 1836. The federal law requires the trade secret to relate to a product or service used in, or intended for use in, interstate or foreign commerce. A demand should identify the protected material and request preservation, cessation of unauthorized use, and an appropriate return or deletion process. Do not demand immediate destruction of the only evidence showing what happened.
California Civil Code § 3426.2 permits injunctions against actual or threatened trade secret misappropriation. Under Civil Code § 3426.6, a California misappropriation action generally must be brought within three years after the misappropriation is discovered or, through reasonable diligence, should have been discovered; continuing misappropriation constitutes a single claim. The federal statute likewise provides a three-year discovery-based limitations period and treats continuing misappropriation as a single claim. Emergency relief requires evidence supporting the request; a missing spreadsheet alone does not automatically justify a temporary restraining order. Timing, ongoing use, secrecy measures, and the specific harm all matter.
- Identify the information you want protected with enough specificity to support relief.
- Document actual losses and ongoing risks without inflating projections.
- Consider whether a preservation agreement or restricted-use undertaking can address the immediate concern.
Contract claims or other remedies may also be relevant, but counsel should assess their factual basis and interaction with trade secret law.
Do not confuse client protection with a noncompete
California Business and Professions Code § 16600 broadly voids contractual restraints on engaging in a lawful profession, trade, or business, subject to statutory exceptions. Section 16600.1 also makes it unlawful to include a noncompete clause in an employment contract or require an employee to enter a noncompete agreement unless a statutory exception applies. A confidentiality agreement is not permission to prohibit a former employee from working for a competitor or contacting every customer.
Likewise, remembering a customer’s name, using public information, or accepting unsolicited business does not automatically establish trade secret misappropriation. The central questions are what information is legally protected and whether it was improperly acquired, used, or disclosed.
Avoid public allegations, threats to the employee’s new employer, or blanket demands that customers stop doing business with someone. Keep communications factual and limited to people who need the information. Protecting confidential material and restricting lawful competition are different objectives, and your response should reflect that distinction.
Talk to a California business attorney
If a departing employee copied your client list, a free consultation can help you assess preservation steps, trade secret protection, and whether urgent action is appropriate. Schedule a free consultation or call (424) 603-8888.
This article is attorney advertising and provides general information only. It is not legal advice and does not create an attorney–client relationship. The law changes, and this article reflects the law as of its publication date. Every situation is different — contact us to discuss how the law applies to your exact circumstances. See our full disclaimer.
