When an employee leaves with customer records, internal pricing, product plans or proprietary spreadsheets, a company faces two immediate questions. What information has been taken, and what legal obligations were breached in obtaining or retaining it? The answers determine whether the response should involve a contractual demand, urgent injunctive relief, a cybercrime complaint or a combination of remedies.
The business risk is often urgent. But legal action taken before the electronic record is secured can undermine the very case the company wishes to bring.
Confidentiality is an enforceable obligation only when its content is established
A well-drafted confidentiality provision identifies the categories of protected information and the purposes for which it may be used. It may include pricing arrangements, source code, internal forecasts, customer data, product strategy and non-public technical documentation.
Not every piece of information accessible to an employee is automatically confidential in law. The company's position improves where the material is demonstrably non-public, commercially valuable, disclosed for employment purposes and subject to reasonable access controls. The employment agreement, confidentiality undertaking, information-security policy and actual handling of the material should be reviewed together.
A company must also distinguish confidential information from knowledge and skill the employee legitimately acquired. A demand prohibiting a former employee from using any knowledge of the industry is different from a demand to return identified proprietary files.
Civil contractual remedies
A breach of a confidentiality covenant may give rise to contractual damages. The Contract Act, 1872 governs compensation for loss caused by breach. The company must still establish the relevant obligation, breach, causation and recoverable loss; the existence of a confidentiality clause does not relieve it of proving what occurred.
Where disclosure or exploitation is imminent, damages may be inadequate. A carefully framed application under the Specific Relief Act, 1877 and Order XXXIX CPC may seek to prevent unauthorised use or further disclosure, preserve material or restrain specific acts pending proceedings.
The relief must remain proportionate. An injunction directed at identified customer databases or confidential price sheets may be defensible; a request to prevent a person from ever working in the same industry raises materially different issues.
A non-compete covenant should therefore be assessed separately from confidentiality. Section 27 of the Contract Act restricts agreements in restraint of trade, subject to its statutory exception. Confidentiality protection should not be made dependent on an overbroad restraint that may itself be disputed.
When PECA may apply
The Prevention of Electronic Crimes Act, 2016 creates offences relating to unauthorised conduct involving information systems and data. Section 4 concerns unauthorised copying or transmission of data carried out with the dishonest intention required by the provision. Section 3 addresses unauthorised access, subject to its own constituent requirements.
Whether an employee's conduct falls within either offence cannot be inferred simply because information was downloaded. The relevant issues include the employee's authorised access, the permitted purpose, the scope of any consent, the nature and timing of the copying, the dishonest-intention requirement and the system evidence.
A person may have had legitimate access to a work device or database but have exceeded the authority granted to use it. Conversely, a download that was routine and authorised while employment continued is not made criminal retrospectively merely because the relationship later deteriorated. The legal and factual distinction must be addressed.
The 2025 amendments to PECA and the operative investigation procedures must also be checked before a complaint is lodged. Statutory powers, evidentiary requirements and institutional jurisdiction should not be assumed from older practice.
The digital record must be preserved, not reconstructed
A company's first task should be preservation. Access logs, email metadata, endpoint activity, cloud audit trails, USB event records, repository histories and file-access timestamps may establish what occurred. Where possible, the company should preserve forensic images and maintain a documented chain of custody.
The investigation should record who collected the evidence, from which device or system, by what method, and at what time. The original files should not be casually edited or opened through processes that change their metadata.
Evidence suggesting that a user downloaded files and subsequently deleted local copies may support an inference about conduct. It does not automatically prove sabotage, destruction of evidence or dishonest intention. The significance of deletion depends on the system behaviour, user permissions, recovery records and surrounding circumstances.
Internal accusations should remain tied to what can be proved. In particular, companies should avoid making serious allegations of operational sabotage unless the evidence supports the necessary acts and mental element.
Board authority and the company's response
A complaint or legal notice issued in the company's name must be properly authorised. The authority of the board, chief executive, general counsel or other signatory should be checked against the constitutional documents, delegations and relevant law.
A sound response sequence may include revoking credentials, preserving systems, securing a factual investigation, demanding return or destruction of specified material, obtaining undertakings where appropriate and preparing civil or criminal proceedings. Each step should account for employment-law duties, privilege, data protection and reputational exposure.
A demand notice should identify the information, the contractual duty and the conduct complained of, and require specific remedial steps by a defined date. Inflated allegations and unsupported legal labels rarely improve the company's position.
Assess the purpose of the proceedings
The objective is ordinarily to prevent use or disclosure, recover information, protect commercial relationships and obtain compensation where loss is proved. Criminal proceedings may be appropriate where the statutory elements are met; they should not be used as a substitute for proving contractual breach or as a threat designed solely to pressure an employee.
For a business considering litigation, it is useful to separate a forensic findings schedule from a schedule of contractual obligations and a schedule of remedies. This allows the legal case to follow the evidence rather than the emotional impact of the incident.
The difference between a credible claim and an aggressive accusation is often the quality of that initial record.
When the issue arises in practice.
Our advice begins with the governing documents, the legal position and the decision that needs to be made.
DISCUSS THIS MATTERThis publication is for general information and does not constitute legal advice on any particular matter.