Trade Secret Theft in Tennessee: How to Tell If an Employee Took Your Confidential Information, and How to Prove It
Short answer: Trade secret theft happens when someone takes and uses confidential business information, such as customer lists, pricing, formulas, source code, processes, or strategic plans, without permission. Most cases involve a departing employee or business partner. In Tennessee, owners can sue under the Tennessee Uniform Trade Secrets Act and the federal Defend Trade Secrets Act, but they must prove the information was a trade secret, that they took reasonable steps to keep it secret, and that it was misappropriated. A private investigation builds that proof: preserving devices and accounts for forensic examination, reconstructing what was taken and when, identifying where the information went, and documenting its use by a competitor, all through lawful methods that hold up in court.
Last updated October 2026 · Birds Eye Investigations, Nashville
Key takeaways
The first priority is preservation. Do not wipe, reissue, or let anyone "check" the departing employee's laptop or phone before it is forensically imaged.
Information qualifies as a trade secret only if it has value from being secret and the owner took reasonable steps to protect it.
Most proof comes from digital forensics combined with field investigation into where the information went and how it is being used.
Investigators must stay within the law: no accessing personal accounts without authorization, no pretexting, no hacking.
Speed matters. Courts can grant injunctions and, under federal law in extraordinary cases, civil seizure, but only with evidence.
What counts as a trade secret?
Under both Tennessee and federal law, a trade secret is information that derives independent economic value from not being generally known or readily ascertainable, and that the owner has taken reasonable measures to keep secret. Examples include:
Customer lists with contacts, buying history, pricing, and preferences.
Pricing models, bid strategies, and margin data.
Manufacturing processes, formulas, and recipes.
Source code, algorithms, and technical designs.
Supplier terms, business plans, and acquisition strategies.
Information that is public, generally known in the industry, or easily figured out is usually not a trade secret. Neither is information the company never bothered to protect.
What does "reasonable measures to keep it secret" mean?
Courts look at what the company actually did. Strong measures include confidentiality and invention assignment agreements, need-to-know access restrictions, password protection and multifactor authentication, marking sensitive documents confidential, exit procedures that recover devices and remind departing employees of obligations, and policies on personal email and cloud storage. Investigators document these measures early because the other side will challenge them.
How does trade secret theft usually happen?
A departing employee emails files to a personal account in the weeks before resigning.
Large downloads or USB transfers occur right before a resignation.
Files are synced to personal cloud storage or photographed with a phone.
A salesperson exports the CRM or customer database.
A business partner or contractor keeps access after a relationship ends.
A competitor recruits a team and suddenly bids with uncannily similar pricing.
What should a business do the moment it suspects theft?
Preserve devices and accounts. Collect company laptops, phones, and storage media, keep them powered as they are, and do not let IT reimage them. Suspend but do not delete accounts.
Preserve logs. Email, VPN, file server, cloud, badge, and print logs often have short retention periods.
Call counsel. A trade secret attorney can direct the investigation so findings are protected and can move quickly for relief.
Engage a forensic examiner and investigator. Forensic imaging documents what happened on devices with a defensible chain of custody, and investigators follow the trail outside the company.
Limit internal discussion to avoid tipping off the people involved.
How do investigators prove misappropriation?
Digital forensics
Qualified examiners image company devices and analyze file access, USB connection history, email forwarding, cloud sync activity, deleted files, and browser history. The output is a timeline showing what was accessed, copied, or sent, and when.
Field investigation
Investigators identify the new employer or venture, research its formation, ownership, and staff, and document how it is competing. They may conduct lawful surveillance of business activity, monitor public filings, websites, job postings, and marketing that mirror the client's confidential materials, and interview former employees and customers.
Customer and market evidence
When customers report being contacted with the client's exact pricing, or when a competitor's proposal contains the client's language or formatting, investigators document those facts and their sources.
Asset and entity research
For damages and collectability, investigators map the defendants' companies, affiliates, and assets.
What legal remedies are available?
Under the Tennessee Uniform Trade Secrets Act and the federal Defend Trade Secrets Act, remedies can include injunctions against use or disclosure, damages for actual loss and unjust enrichment or a reasonable royalty, and, for willful and malicious misappropriation, enhanced damages and attorney's fees. The federal statute also permits civil seizure orders in extraordinary circumstances. Claims are subject to limitation periods measured from when the misappropriation was or should have been discovered, so delay is costly. Your attorney will evaluate which claims and remedies apply.
What can't an investigator do?
An investigator cannot log in to a former employee's personal email or cloud accounts, obtain phone records by pretext, install tracking devices on vehicles the client does not own, or misrepresent themselves to obtain confidential information. Evidence gathered unlawfully can be excluded and can expose the client to liability. Personal accounts and devices are reached through litigation discovery and court orders.
Frequently asked questions
How do I know if a former employee took company files?
A forensic examination of their company devices and accounts usually shows downloads, transfers, email forwarding, and cloud syncing in the period before departure. Preserve devices before anyone uses them.
Is a customer list a trade secret?
It can be, if it contains non-public, compiled information with competitive value and the company protected it. A list of names anyone could find online usually is not.
Do I need a non-compete to sue for trade secret theft?
No. Trade secret law protects qualifying information regardless of whether there is a non-compete, although confidentiality agreements strengthen the case.
Can I get an injunction quickly?
Courts can issue temporary restraining orders and injunctions on an expedited basis when there is evidence of misappropriation and the risk of irreparable harm. Fast preservation and investigation make that evidence available.
How much does a trade secret investigation cost?
It depends on the number of devices, the scope of field investigation, and urgency. A focused investigation is far less expensive than losing major customers.
Does Birds Eye handle intellectual property cases?
Yes. See our intellectual property investigations and corporate investigations.
Protect what makes your business valuable
When confidential information walks out the door, the first days decide what you can prove. Birds Eye Investigations works with business owners and their attorneys in Nashville and across Tennessee to preserve evidence and trace stolen information. Contact us confidentially.
