Trade Secrets: What to Mask Before Sharing a Document With a Partner
Prices, formulas, source code and customer lists can be trade secrets. See what EU, French, German, UK and US law require, and what to mask.
A trade secret is not just anything you would rather keep quiet. Under EU, UK and US law it has to pass three tests: it is secret, it has value because it is secret, and you have taken real steps to protect it. Before you hand a document to a supplier, an investor or a consultant, check what inside it meets that bar, then mask it.
What makes information a trade secret in the first place?
Directive (EU) 2016/943 set a common definition for every EU country. The European Commission describes a trade secret as valuable information that a business treats as confidential and that gives it a competitive edge. France, Germany and the UK wrote a similar three-part test into their own law after 2016, each in slightly different words.
- Secret: not generally known to, or easily found by, people who normally work with that kind of information.
- Valuable because it is secret: a competitor could gain an edge from it, or you could lose one.
- Protected by reasonable steps: confidentiality agreements, limited access, marked documents, or a masked copy for people who do not need the full file.
How do the four main jurisdictions define it?
France, Germany, the UK and the US did not just copy Brussels. Each rewrote the same three-part test in its own statute, so the exact wording, and the level of proof a court expects, differs a little by country.
| Jurisdiction | Law | Wording of the "reasonable steps" condition |
|---|---|---|
| European Union | Directive (EU) 2016/943 | Subject to reasonable steps, under the circumstances, to keep it secret |
| France | Code de commerce, art. L151-1 (law of 30 July 2018) | Subject to reasonable protective measures given the circumstances |
| Germany | Geschäftsgeheimnisgesetz (GeschGehG), § 2 | Subject to appropriate confidentiality measures, given the circumstances, by its rightful holder |
| United Kingdom | Trade Secrets (Enforcement, etc.) Regulations 2018, reg. 2 | Subject to reasonable steps, under the circumstances, to keep it secret |
| United States | Defend Trade Secrets Act, 18 U.S.C. § 1839 | The owner has taken reasonable measures to keep the information secret |
Why do reasonable steps matter in court?
Reasonable steps are not a formality. They are part of the legal definition itself. If you cannot show them, a court in the EU, the UK or the US can decide the information was never a protected trade secret. That is true even if a former partner leaked it on purpose. An NDA, short for non-disclosure agreement, is one step. Marking files, limiting access and masking documents are others.
What typically counts as a trade secret in a document?
- Prices and margins: unit costs, discount tiers, target margins.
- Supplier terms: payment schedules, volume rebates, penalty clauses.
- Formulas and specs: exact composition, process parameters, technical drawings.
- Source code: proprietary algorithms, internal API keys, build scripts.
- Customer lists: named contacts, deal sizes, renewal dates.
- Roadmaps: unreleased features, launch dates, budget projections.
Jane Example runs product at a small hardware startup. Before sending a spec sheet to a new factory, she keeps the dimensions and materials, since the factory needs those. But she removes the internal cost model and the name of the current supplier for the rare-earth magnet. Both stay inside the company.
What should you mask for each kind of partner?
A supplier needs enough to build or ship the right thing. An investor needs enough to judge the business. A public tender authority needs enough to check you meet the criteria. None of them need your full internal file. Share a version cut to that one purpose.
| Document | Trade secret inside | What to mask | What the partner needs |
|---|---|---|---|
| Price list or quote | Unit costs, margins | Cost breakdown, discount tiers | The final price only |
| Supplier contract | Payment terms, rebates, penalties | Financial clauses | Delivery dates, quality specs |
| Formula or spec sheet | Exact composition, process steps | Formula, quantities, process detail | Performance specs, certifications |
| Source code or technical file | Algorithms, internal keys | Code blocks, internal endpoints | Public interface documentation |
| Customer list or CRM export | Names, deal values | Individual names and amounts | Aggregate counts or a sample |
| Roadmap or board deck | Unreleased features, launch dates | Future plans, projections | Publicly announced items only |
A masking tool helps apply this inside the browser. ONYRI Sanitize finds amounts with a currency, IBANs, company names followed by a legal form like SAS or GmbH, and web links. It then blacks them out or replaces them with a label. A custom rule can also catch a product code or project name on every page. Its limit: it does not know your secrets, so formulas, prices without a currency and know-how written in plain words need your own rule or a manual mask.
Why doesn't an NDA replace masking the document itself?
An NDA is a promise between two parties. It does not stop a document from being forwarded by mistake, stored on an unsecured laptop, or read by someone at the partner company who never needed to see it. Minimising what you send, by masking numbers and names that are not needed, limits the damage even if the promise gets broken.
A quick checklist before you share a document
- Ask what the partner actually needs to see, not what you happen to have.
- Strip exact costs, formulas and source code unless the partner must verify them.
- Replace named customers with counts or a small sample where you can.
- Mark the file confidential and log who receives each copy.
- Keep the NDA, but do not rely on it alone.
- Send the masked copy, and keep the original safe with a note of what you removed.
Frequently asked questions
Does marking a file "Confidential" make it a legal trade secret?
No. A stamp helps show intent, but a court also checks whether the information was genuinely secret, valuable because of that secrecy, and protected by real steps like limited access or masking. A label alone does not meet the three-part test used in the EU, the UK and the US.
Do I still need an NDA if I mask the document?
Yes. Masking and an NDA do different jobs. Masking limits what the reader can see in the first place. The NDA covers whatever they still see, including anything you had to leave visible, like the price your factory needs to quote.
Is a customer list always a trade secret?
Not automatically. It counts only if it is not easily rebuilt from public sources, gives you a real edge, and you have kept it reasonably protected, for example behind a login. A list anyone could gather from public directories usually will not qualify.
What happens if I send an unmasked document by mistake?
Tell the recipient, ask them to delete or return the copy, and keep a record of when you asked. This does not undo the disclosure, but it can matter later in court and shows you still treated the information as secret.
Sources & references
- Trade secretsEuropean Commission
- Directive (EU) 2016/943, Article 2 - Definitionslegislation.gov.uk (EU legislation)
- The Trade Secrets (Enforcement, etc.) Regulations 2018legislation.gov.uk
- 18 U.S. Code § 1839 - DefinitionsCornell Law School, Legal Information Institute
- § 2 GeschGehG - BegriffsbestimmungenBundesministerium der Justiz (gesetze-im-internet.de)
- Le secretInstitut national de la propriété industrielle (INPI)