India has no trade secrets law today, and that is exactly why founders keep getting hurt. Your customer list, pricing model, source code and unpatented process are protected only by a patchwork: your NDAs, your employment contracts, a few court precedents on breach of confidence, and the Indian Contract Act, 1872. In September 2026 the government signalled it wants to change that. DPIIT is consulting on a dedicated trade secrets statute, or on amending the Contract Act instead, and one idea on the table is a government-run digital timestamp repository that proves you held a secret on a given date without showing anyone what it says. Nobody knows when a law will arrive, or what it will say. You can still get ready now, and this guide shows you how: what protects you today, what the new law may change, and a practical way to audit and document your confidential information. If you have read my piece on the Zetwerk-Ayr Energy trade secret case, think of this as the follow-up on what to do about it.
The Short Version on Trade Secrets Law in India
- India still has no statutory definition of a trade secret. Courts protect “confidential information” case by case.
- Your best protection right now is a good paper trail: tight contracts, restricted access, and proof of what you kept secret and when.
- A post-employment non-compete is usually void under Section 27 of the Contract Act. A confidentiality clause is not. Use the right tool.
- The proposed law is still at the consultation stage. There is no bill, no timeline and no text.
- Whatever the final form, “reasonable measures to keep it secret” will almost certainly be the test. Start building that evidence this month.
What Actually Happened on the Trade Secrets Law in September 2026
Let me be careful here, because the headlines ran ahead of the facts. A report dated 26 September 2026, attributed to the Economic Times, says DPIIT has begun consultations on a dedicated trade secrets law. It quotes an unnamed official and an unnamed IP expert, so there is no named minister and no draft. What the report does say is useful.
- Two options are being weighed. One is a separate statute. The other is to amend the Indian Contract Act, 1872, because some officials reportedly feel no separate law is needed to make sure contracts are honoured.
- Three worries came up in consultation. Startups fear a heavier compliance burden. Established firms have questions about how contracts will be enforced. And people want a balance between protecting secrets and protecting whistleblowers.
- A timestamp repository was floated. An expert described a system where a digital timestamp would show that the owner and the regulator held a specific piece of confidential data at an exact date and time, without revealing the data. The government would keep the repository.
- There is no timeline. The report gives no deadline for consultations and no date for a bill.
So when someone tells you a trade secrets law is “coming”, the accurate version is: the government is thinking about one, and has not decided its shape. That is still worth acting on, because the groundwork you do for the likely version also helps you in court today.
How Trade Secrets Are Protected in India Right Now Without a Trade Secrets Law
There is no single Act. Lawyers stitch together several, and the stitching is where cases get won or lost. A recent practice note puts it plainly: protection is piecemeal and reactive, with no statutory definition and no uniform test for what counts as “reasonable measures” to keep something secret.
1. Contract: Your First Line of Defence
Most real-world protection starts on paper. Confidentiality and non-use clauses in employment contracts, consultancy agreements, vendor contracts and licences are what you will actually sue on. If you want a refresher on drafting one, our NDA guide with a free template walks through it. The point I repeat to founders: an NDA protects what it describes. A vague NDA that says “all information” invites a judge to ask what you were really protecting.
2. Equity: Breach of Confidence
Where there is no contract, courts fall back on equity. If someone received information in confidence, they may not take unfair advantage of it. This is how Indian courts have restrained misuse by former staff and business partners for decades. A leading practice chapter on trade secrets in India puts the idea in one line, and it is the principle behind most orders you will see.
3. Criminal and Cyber Law
Depending on the facts, Section 316 of the Bharatiya Nyaya Sanhita (criminal breach of trust) can apply. The IT Act, 2000 adds Section 43, which gives compensation for unauthorised access to or extraction of data, and Section 66, which criminalises it when done dishonestly or fraudulently. A copied database or a downloaded code repository can fall in here. Our guide on cybersecurity legal requirements for founders covers the security duties that sit next to this.
4. Copyright and Patents, When They Fit
Source code and documents may carry copyright, and a patentable invention can be protected through a patent instead of secrecy. These are different choices with different trade-offs: a patent requires disclosure, a trade secret depends on secrecy. See patent filing in India and copyright registration if you are deciding.
What Courts Can Do for You
- Interim injunctions to stop use or disclosure. You generally need to show the information is confidential, that the other side had access, and that misuse is reasonably apprehended. Delay hurts, so do not sit on it.
- Anton Piller-type orders to preserve evidence. These are granted only in exceptional cases and need full and frank disclosure.
- Confidentiality clubs. Courts can limit who sees sensitive documents during the case, so that suing to protect a secret does not leak it. Delhi High Court rules allow this at any stage.
- Damages after a breach is proved, which is slower and harder to quantify.
The Section 27 Trap Almost Every Founder Falls Into
It is one of the most common questions founders ask me. “Can’t I just add a two-year non-compete so my engineer cannot join a rival?” Usually, no.
Section 27 of the Indian Contract Act makes agreements in restraint of trade void. Indian courts have applied it strictly to post-employment restraints. In Superintendence Company v. Krishan Murgai, the Delhi High Court held that a post-employment injunction is valid only if it is limited to stopping disclosure of trade secrets, not stopping the person from joining a competitor. More recently, in Varun Tyagi v. Daffodil Software (2025), the Delhi High Court set aside an order that had restrained an employee under a clause barring work with the employer’s business associate for three years after leaving. It held post-termination restrictions void unless they protect confidential information or a real proprietary interest, and it found none there, since the IP and source code for the project belonged to the client. Restraints during employment are treated differently and can be enforced, as in Niranjan Shankar Golikari.
The practical lesson is to draw the line between skill and secret. A court will not stop a person from using the general knowledge and experience they picked up. It will stop them from using your specific files, formulas and client data. Write your contracts to protect the second. Our article on non-compete agreements in India goes deeper, and the freelance agreement clauses piece covers contractors.
Where the Current System Fails Founders
From the disputes I have seen and the cases I have read, here is where founders tend to lose or struggle:
- No clear definition. You are arguing from precedents, so the outcome depends on the judge and the facts you manage to prove.
- Proving what you had, and when. If a former partner claims the idea was theirs, how do you show you held that pricing model or algorithm on a specific date, without handing it to the court?
- “Reasonable measures” is a guess. No one can tell you for certain what security steps are enough.
- Speed. A secret disclosed is a secret gone. Interim relief helps only if you move fast and have your evidence ready.
- Employee mobility confusion. Founders over-draft non-competes, courts strike them down, and the company has no fallback.
- Whistleblowers. Current law gives employers and employees little clear guidance on when disclosing wrongdoing is protected.
What the Proposed Trade Secrets Law in India Could Look Like
We do not have a trade secrets bill from DPIIT. We do have a useful reference point: the Law Commission’s 289th Report (March 2024), which proposed a draft Protection of Trade Secrets Bill, 2024. The government has not adopted it, but it shows the shape a statute could take, and the new consultation may well reuse parts of it. Treat what follows as the likely shape, not the final word.
| Feature | Law Commission draft, 2024 |
|---|---|
| Definition | Information that is not generally known, has commercial value because it is secret, and is subject to reasonable steps to keep it secret (modelled on TRIPS Article 39). One summary adds that disclosure must cause damage |
| Lawful acquisition | Independent discovery and reverse engineering are not misappropriation |
| Employee skills | Skills and experience gained in ordinary work are not trade secrets (Section 2(f)) |
| Whistleblowers | Disclosure exposing unlawful acts or misconduct, or made in good faith in the public interest, is not misappropriation (Section 5) |
| Remedies | Civil only: interim, ex parte and permanent injunctions, plus damages. Criminal remedies were dropped after consultation |
| Public interest | Government may authorise use in a public emergency, with compensation |
| Forum | Commercial Courts under the Commercial Courts Act, 2015 |
| Other remedies | Section 13 preserves common law breach of confidence |
The Registry Idea Was Rejected Before. Why Is a Repository Back?
This is the detail that interests me most. The Law Commission’s process looked at a mandatory trade secret registry, and, according to one commentary on the report, all stakeholders rejected it because a central registry risks leaking the very secrets it is meant to protect. The 2026 timestamp idea, as reported, is different: it records proof that you held something on a date, not the something itself. My reading, and it is only a reading, is that this works like a fingerprint of a document, a hash, rather than a copy. The ET report does not say how it would work, whether it would be voluntary, or who could see it. Until those answers come, do not rely on it, and do not assume a mandatory registry is coming.
Statute or Contract Act Amendment: What Each Route Might Mean
| Separate trade secrets statute | Amend the Contract Act | |
|---|---|---|
| What it would likely give you | A definition, a cause of action, set remedies, whistleblower and employee carve-outs | Stronger enforcement of confidentiality contracts, with less new machinery |
| Who gains most | Companies without perfect contracts, including those facing outsiders | Companies with good paper |
| Compliance burden | Higher, if “reasonable measures” must be shown (the startup worry) | Lower |
| Risk | Over-broad definitions could hit employee mobility | Contract-only fixes may leave third-party thieves outside the net |
That table is my analysis of the two routes described in the report, not anything DPIIT has published. The honest summary is that the contract-only route helps those who already have solid contracts, while a statute is the only route that could reach someone who never signed anything with you.
The Concerns Everyone Raises
Commentators on the Law Commission draft worry that broad definitions could lock in employees, that whistleblower cover must clearly extend to disclosures made to regulators and courts, that “reasonable measures” should scale with company size, that seizure powers need judicial oversight, and that any law must fit with the DPDP Act and the Competition Act. Several of those points overlap with what is being raised in the 2026 consultation. If you want a voice in it, send comments through the industry bodies or DPIIT’s consultation when it opens.
Your Trade Secrets Audit: A Practical Plan You Can Start Today
This is the part that will matter whether a statute arrives next year or never. Courts already ask the same questions: what was confidential, who had access, what did you do to protect it, and can you prove it?
Step 1: Build a Trade Secret Register
Sit down with your co-founders and your tech lead for two hours and list every piece of information whose loss would hurt you. Be specific. “Source code” is too vague; “the matching algorithm in the pricing engine, repo X” is useful. A simple table is enough.
| Asset | Why it has value | Where it lives | Who has access | Protections in place | Owner |
|---|---|---|---|---|---|
| Pricing model v3 | Drives margin; competitors do not have it | Private repo, finance drive | Founders, one analyst | NDA, MFA, no external sharing | CFO |
| Top 50 client list with terms | Took three years to build | CRM | Sales team | Role-based access, exit checklist | Head of Sales |
Step 2: Sort Real Secrets From Things That Merely Feel Secret
Not everything deserves the same fence. A secret a court will protect is information that is not public, has commercial value because it is secret, and that you have actually protected. If your pitch deck is on LinkedIn, it is not a secret. Tier your register: crown jewels, important, internal. Spend your effort on the first tier.
Step 3: Fix the Contracts
- Employment agreements. Confidentiality that names categories of information, survives termination, and requires return of materials. Do not rely on a blanket non-compete after exit.
- Contractor and freelancer agreements. Same, plus clear IP ownership. See IP assignment agreements and the founders agreement template, because a co-founder who leaves with the code is a very common dispute.
- Vendor and partner contracts. Confidentiality, security obligations, audit rights, and a clause on what happens to your data when the contract ends. The limitation of liability article shows why the cap on liability matters for leaks.
- Investor and data-room access. Share on a staged basis and log who sees what. Our notes on term sheets and MOUs help here, because an MOU with no confidentiality clause protects nothing.
Step 4: Control Access and Mark the Good Stuff
Need-to-know access, multi-factor authentication, and offboarding that revokes accounts the same day. Mark sensitive files “Confidential” so no one can say they did not know. If you share documents externally, strip hidden data first; our guide on how to legally redact a PDF explains how to do that properly.
Step 5: Handle Joiners and Leavers Properly
On the first day, have people sign an acknowledgement of your confidentiality policy. On the last day, collect devices, revoke access, remind them in writing of their continuing obligations, and keep a record. If you hire many contractors, watch out for status disputes, which we cover in worker misclassification in India.
Step 6: Keep Dated Proof of What You Had
This is where the timestamp idea shows up in real life. You cannot wait for a government repository. Today, you can keep your own: use version control with signed commits, keep dated, locked copies of key documents, and record a hash of each important file with the date in a log that more than one person can verify. Treat that as my practical suggestion, not a legal requirement, and do not put the secret itself in the log. A court will not treat your log as conclusive, but dated, consistent records make your account far easier to believe.
Step 7: Decide What You Will Not Put Into AI Tools
Pasting source code or client data into a public AI tool can be an own goal if it breaks your own “reasonable measures”. Write a one-page rule on what employees may and may not enter. Our piece on whether AI can draft a contract covers a related caution, and the DPDP and funding due diligence guide covers personal data you might also be feeding in.
Step 8: Write a Whistleblower-Safe Policy
Every draft of the proposed law I have seen tries to protect good-faith disclosure of wrongdoing. Get ahead of it. Give staff a clear internal route to raise concerns, and make your confidentiality clauses say that nothing stops lawful reporting to a regulator or the police. It protects you from a clause being struck down for overreach.
Step 9: Have an Incident Plan Before You Need One
When you suspect a leak: preserve emails, access logs, download records and repository history straight away, with a clear chain of custody; lock the accounts; get a lawyer to send a notice; and decide within days, not weeks, whether to seek an injunction. Delay weakens an urgent application. Write the plan down now, because panic is a bad drafter.
Step 10: Review Every Six Months
Update the register when you ship a new product, hire a new lead or sign a new vendor. A register that is two years old is nearly as bad as none. Once a consultation paper or draft bill appears, read it against your register and see what you would need to change.
If you would like help reviewing your contracts or building the register, the contact page is the quickest way to reach me. For a broader checklist on company paperwork, see our legal checklist for Indian startups and the startup legal library.
Five Common Trade Secret Mistakes Founders Make
- The “everything is confidential” NDA. It reads as boilerplate and gives a court nothing to enforce.
- The blanket non-compete. It is usually void after employment, and it distracts from the confidentiality clause that would have worked.
- Sharing first, signing later. The pitch happens, the files go over, and the NDA follows a week later, or never.
- No exit routine. The engineer leaves on Friday and still has repo access on Monday.
- Forgetting your own people. Co-founders and early hires know the most and are often under the weakest paper. See bad leaver clauses for one lever, but remember that share forfeiture is not confidentiality protection.
What I Would Do If I Were You
If I ran a startup with real IP and no trade secrets law to lean on, I would not wait for the law. This month I would build the register, fix the three contracts that matter most (employees, contractors, investors), switch off any access that has no reason to exist, and start the dated log. That is perhaps a week of effort spread over a month. If a statute arrives with a “reasonable measures” test, you will already have the evidence. If it never arrives, you are still better protected under the law as it stands. And if the new rules turn out looser than expected, you have lost nothing but some tidy-up time.
Frequently Asked Questions About Trade Secrets Law in India
1. Does India have a trade secrets law?
No dedicated statute exists today. Protection comes from contracts, the equitable doctrine of breach of confidence, some provisions of criminal and IT law, and court decisions. There is no statutory definition of a trade secret.
2. Is a new trade secrets law in India actually coming?
The government is consulting. A 26 September 2026 report says DPIIT has begun consultations on a dedicated law, or on amending the Indian Contract Act. No bill, draft text or timeline has been published, so nobody can say when or whether a law will pass.
3. What is the digital timestamp repository?
An idea an expert described in the report: a government-maintained repository where a timestamp proves you held specific confidential data at an exact date and time, without revealing the data. Details such as whether it is voluntary are not public yet.
4. What did the Law Commission propose in 2024?
The 289th Report proposed a draft Protection of Trade Secrets Bill, 2024 with a TRIPS-style definition, civil remedies, exceptions for reverse engineering, employee skills and whistleblowing, and Commercial Court jurisdiction. It has not been enacted, and criminal remedies were dropped from the draft.
5. Can I stop an employee from joining a competitor?
Usually not after employment ends. Section 27 of the Contract Act makes most post-employment non-competes void, and the Delhi High Court has repeated this, including in Varun Tyagi v. Daffodil Software (2025). You can restrict the use or disclosure of your confidential information.
6. Is an NDA enough to protect a trade secret?
An NDA is necessary but not sufficient. A court will also look at whether you actually kept the information secret, limited access and marked it. Pair the NDA with access controls and records.
7. What remedies can I get if someone misuses my confidential information?
Interim and permanent injunctions, damages, and in rare cases evidence-preservation orders. Criminal provisions such as BNS Section 316 and IT Act Sections 43 and 66 may also apply depending on the facts.
8. How do I prove I owned a secret on a certain date?
Keep dated, locked records: version-control history, signed commits, and a log of file hashes with dates. This is my practical suggestion and not a legal requirement. It makes your evidence stronger even before any government repository exists.
9. Will a trade secrets law in India protect whistleblowers?
Whistleblower safeguards are one of the consultation topics, and the Law Commission draft included an exception for disclosures exposing unlawful acts or made in good faith in the public interest. Write your own policy that lets staff report lawfully.
10. What should a startup do right now before the trade secrets law arrives?
Build a trade secret register, tighten employee, contractor and investor contracts, restrict access, keep dated records, set rules for AI tools, and prepare a leak response plan. These steps help under today’s law and under any future statute.
Want a Second Pair of Eyes on Your Confidentiality Paper?
A short review of your NDAs, employment clauses and register can show where your weak points are. Talk to Advocate Parvez Ali, or read about the author.