A security pledge alone does not make information a trade secret in Korea

This guide is for employers in Korea, including foreign-invested companies and their HR staff, who want to protect company information when employees leave. The rule: information is a trade secret only if the company actually kept it secret, and a signed security pledge alone does not show that. When a departing employee takes files, criminal complaints mostly stall at the same point: the finding that the material was not a trade secret.

What counts as a trade secret

The Unfair Competition Prevention and Trade Secret Protection Act (부정경쟁방지 및 영업비밀보호에 관한 법률), Article 2, item 2, defines a trade secret as a production method, a sales method or other technical or managerial information useful for business activities that meets three requirements:

1. It is not publicly known.
2. It has independent economic value.
3. It has been kept secret (비밀로 관리된).

The company can control only the third requirement, known as secrecy management (비밀관리성). In practice, the third requirement is also the one that breaks down.

A pledge is a document, secrecy is a state

Having employees sign a security pledge (보안서약서) does not by itself establish secrecy management. The pledge identifies the information and imposes duties on the employee. Whether that information was actually managed as a secret is judged separately.

You need to build up several elements that show how the information was handled: access rights, confidentiality marks, records and exit procedures. The full list of measures is in the checklist at the end of this guide.

The measure companies skip most often is a separate non-disclosure agreement (NDA, 비밀유지계약) with partners and outsourcers. Some companies take pledges from their own staff but give an outside development agency or a freelancer only one line in the service contract. From the moment the information leaves the company's control in this way, the claim that it was kept secret becomes weaker.

Penalties under Article 18

Article 18 of the Act sets the criminal penalties.

Fines can go higher. If ten times the financial gain from the offence exceeds the fine cap, the fine is between two and ten times that gain.

The acts listed in Article 18(1), item 1, are broad. They are the following acts, done to obtain an improper benefit or to cause damage to the trade secret holder:

• acquiring or using a trade secret, or disclosing it to a third party;
• taking a trade secret outside a designated place without permission;
• continuing to keep a trade secret after the holder has asked for it to be deleted or returned.

The third act is the one that works in practice when an employee leaves. Intent at the moment the files were copied can be hard to prove. Continued possession after a return request can be proven with a single email. That is why you should ask a departing employee in writing to return or delete the material, and keep proof that they received the request.

Items 2 and 3 target the acquiring side. Item 2 covers obtaining a trade secret by theft, deception, threats or other improper means. Item 3 covers acquiring or using a trade secret while knowing that such an act was involved. A company that hires experienced staff and then receives and uses files from their former employer may fall under item 3.

What to put in the pledge

• List the types of information covered (technical, customer, management, R&D, business plan and partnership information, and so on).
• Write duties during employment and duties after leaving as separate items.
• State the ban on taking information out and the duty to return or delete it.
• Put the duty to comply with the company's return request in its own clause.
• Prohibit use for any other purpose.
• Prohibit disclosure to third parties and set a procedure for exceptions.
• Link breaches to damages and to the grounds for disciplinary action.
• If you include a non-compete clause, limit its period, region and job scope.
• Make sure it does not conflict with the employment contract signed at hiring.
• Decide whether to combine it with the personal data protection pledge or keep the two separate.

When to collect pledges

The most common practice is to collect one pledge at hiring and stop there. Information created during employment then falls outside the pledge's scope. Examples are project files or customer data that did not exist when the employee joined.

Collecting pledges at three points closes this gap:

1. a general pledge at hiring;
2. an individual pledge when you grant access to a specific project or to information with a confidentiality grade;
3. a return and deletion confirmation (반납·삭제 확인서) at exit.

If you tie the individual pledge to your procedure for granting access, these pledges build up automatically without extra admin work.

In the exit confirmation, list the returned assets and the scope of deleted accounts and files in specific terms. If you later demand that material be returned, this document defines what you are demanding.

Non-compete clauses need separate review

No statute sets general rules on whether a non-compete agreement (경업금지 약정) is valid. Courts decide case by case, weighing the period, the region, any compensation, the employee's position and other factors together. Putting a non-compete in the pledge does not by itself guarantee that it can be enforced. The valid scope in each case needs a separate review.

Checklist

• Define the protected information by document or folder.
• Grant access rights by job role and keep a register of who has access.
• Keep records of when access is granted and withdrawn.
• Mark documents and files as confidential (대외비).
• Separate shared folders from confidential folders, physically and logically.
• Control or log the ways information can leave the company: email attachments, USB drives, cloud uploads.
• Set rules for printed copies and run a shredding procedure.
• Hold regular security training during employment and keep a signed attendance sheet.
• Run a return and deletion check at exit and collect a written confirmation.
• When you give information to partners or outsourcers, sign a separate NDA.