LEGAL UPDATE 43 | SAKURA LAW OFFICE
Initial research date: 9 October 2026
Legal analysis and final revision: 26 October 2026
SAKURA Law Office | Managing Partner Kenshiro Michishita
Introduction
The assets that determine an enterprise's competitive position are not necessarily registered rights or items recorded on its balance sheet. Manufacturing parameters, negative research results, source code, algorithms used to set prices, non-public customer histories and methods of resolving production defects may be valuable precisely because rivals cannot readily reproduce them. Yet that advantage can disappear without the transfer of any physical property: an employee may copy a database during an ordinary working day; a joint-development partner may deploy process information for a project never contemplated by the parties; or a post-acquisition migration may expose a target company's confidential files to a much wider group than the original disclosure arrangements permitted.
For Japanese and international businesses, treating those events merely as breaches of a nondisclosure agreement is an inadequate starting point. Japan's Unfair Competition Prevention Act (Act No. 47 of 1993, as amended; the “UCPA”) creates civil and criminal protections for qualifying trade secrets, but the statutory category is narrower than whatever a commercial contract calls confidential. Conversely, material falling outside the statutory definition may still be subject to contractual duties, personal-data regulation, intellectual-property rights or other legal constraints. A coherent legal strategy must distinguish the source of protection, the conduct constituting a violation and the remedy actually available against the particular actor.
The framework has developed materially. Amendments principally effective on 1 April 2024 refined aspects of damages assessment, the statutory presumption concerning use of technical trade secrets and the handling of certain international infringement claims. The Ministry of Economy, Trade and Industry (“METI”) revised its Management Guidelines for Trade Secrets on 31 March 2025; an English reference version was made available in June 2026. METI's Technology Leakage Prevention Guidance, Version 2, released on 27 April 2026, adds substantive treatment of joint research and technical coordination in procurement. The UCPA, court decisions, non-binding government guidance and obligations voluntarily undertaken in contracts must nevertheless be kept in their respective legal categories. [2‑4, 7‑8, 10‑12]
This Legal Update follows the information through its commercial life rather than presenting trade-secret law as a disconnected catalogue of prohibitions. It considers how a company identifies information worth protecting, translates secrecy into daily operations, accommodates lawful employee mobility, structures research and supply-chain arrangements, conducts a defensible investigation following suspected leakage, seeks civil or criminal relief and preserves the value of information in international transactions and M&A. The central governance task is not to designate everything as secret. It is to make the boundary between protected information and permissible use identifiable, proportionate and provable.
Executive Summary
Article 2(6) of the UCPA defines a trade secret by three cumulative attributes: it is technical or business information useful for business activities; it is managed as secret; and it is not publicly known. These are not interchangeable requirements. In particular, secrecy management concerns whether the holder's intention to keep identifiable information confidential is made recognisable to those dealing with it. The adequacy of measures depends on context, including who can access the information, how it is labelled or classified and what practical restrictions apply. METI's March 2025 Management Guidelines explain the minimum level of measures relevant to statutory protection; they are not a certification scheme and cannot guarantee the outcome of litigation. A contractual confidentiality designation is relevant but does not itself establish the statutory elements. [1‑3]
Trade-secret protection should also be distinguished from a general prohibition on changing employers. A former employee may not misuse protected information merely by resigning, but Japanese law does not treat a move to a competitor or the use of properly acquired general skills as inherently wrongful. Contractual post-employment non-compete clauses raise a separate question of enforceability, assessed in light of the employer's legitimate interests, the employee's role, duration, geographic and occupational scope, and the existence or absence of compensation. The same separation matters when recruiting talent from competitors: the new employer should seek evidence of experience, not confidential files from the previous workplace. [20‑22]
Collaboration requires a further distinction between protecting information from disclosure and authorising its use. Permission to inspect manufacturing conditions for product testing does not necessarily license a customer to transfer them to another supplier. A joint-development agreement should address pre-existing know-how, inventions and data generated during the project, improvements, publication, patent filings, permitted subcontractors and post-termination use. Contractual access, legal rights to control and exploit information, export-control questions and personal-data rules should be assessed separately. The April 2026 technology-leakage guidance assists corporate risk assessment; it does not independently create an additional criminal offence or expand an agreed licence. [10‑14]
When leakage is suspected, the priority is to identify the information, preserve reliable evidence through lawful means, contain further disclosure and then select the appropriate claim. Injunctions under Article 3, damages under Articles 4 and 5, the limited presumption of use under Article 5-2, confidentiality orders in litigation and criminal offences have different prerequisites. The cross-border provisions introduced in Articles 19-2 and 19-3 do not extend Japanese law automatically to every dispute involving a Japanese company. Sustainable protection requires continuity between the records made when information is created, the permissions granted during legitimate business and the proof available when a dispute arises. [1, 8]
1. What qualifies as a trade secret: the boundary between commercially important information and statutory protection
An enterprise's characterisation of a document as “highly confidential” does not settle its status under the UCPA. Article 2(6) requires secrecy management, usefulness for business activities and non-public character. Valuable product designs and databases may fail the statutory test if the circumstances do not indicate that the holder actually managed the information as secret. At the same time, usefulness is not confined to independently marketable inventions or information for which a third party would pay a separate licence fee. Unsuccessful experimental results, a production method abandoned after testing or a history of manufacturing defects can provide considerable commercial utility by enabling a competitor to avoid costly trial and error. The analysis must focus on the concrete informational content, rather than the label attached to the file or whether the latest project ultimately succeeded. [1‑3]
Secrecy management is commonly the pivotal issue. METI's revised guidance locates the purpose of this requirement in making the holder's intention to keep particular information secret recognisable to persons who handle it. The law does not invariably require an expensive encryption product, certification or segregated physical facility. Nor does a general statement in staff rules that employees must keep company affairs confidential automatically protect every piece of information held anywhere within the business. An assessment must consider the holder's operations, the forms in which the information is stored, the population of permitted users, the circumstances in which those users encounter it and the actual operation of the adopted controls. The existence of a written policy and the way staff work with the files may point in different directions; both matter. [2‑3]
In its judgment of 13 February 2025, Osaka District Court, Civil Division 21 (Case No. 2023 (Wa) 5749), declined to find adequate secrecy management in respect of the prospective-customer information before it. Approximately 1,700 employees could broadly view that information after logging into an internal system, including from privately owned computers and smartphones, while sufficiently specific measures communicating its confidential status, beyond general employment rules, had not been demonstrated. The court also noted that information about actual contracting customers was subject to access restrictions. The two datasets should not be conflated. This is not a numerical rule under which access by all employees invariably defeats protection; it is a contextual assessment of whether the holder made its intention to manage the particular information as secret objectively recognisable. [15]
The Intellectual Property High Court, Second Division, reached a different conclusion on the evidence in its judgment of 25 March 2025 (Case No. 2023 (Ne) 10057), concerning data and programs used to calculate indices for horse-racing information. It examined internal confidential treatment, user ID and password controls and password changes following employee departures, and recognised trade-secret status and particular improper use. Its reasoning also addressed access by all employees where that access served the business. Read alongside the Osaka judgment, the decision supports neither a rule that a password always suffices nor a rule that workforce-wide access invariably defeats protection. The information, operational need, recognisability of confidentiality and measures actually implemented must be assessed together. [16‑17]
The non-public element likewise calls for more than checking whether a document appears in an internet search. Patent publications, publicly accessible operating manuals, scientific papers, standard industrial techniques and material that persons in the trade can ordinarily obtain may all affect the analysis. A particular selection, compilation or combination of public elements may nevertheless be non-public when the whole is not generally known or ordinarily readily obtainable. Time and cost required to assemble it can be relevant, but investment or originality alone does not establish secrecy. Where a company seeks to protect manufacturing know-how, it should be capable of specifying whether its claim concerns an entire drawing, certain operating tolerances, a sequence of processing steps or the combination of identified parameters. Precision at that stage also determines whether an eventual claim can be pleaded and proved. [1‑3]
Contractual confidentiality remains important but plays a different role. An NDA may lawfully restrict the use or disclosure of unpublished commercial plans, transaction documents, personal information and materials entrusted by third parties, even where those items do not satisfy the UCPA trade-secret definition. In contrast, a statutory trade-secret claim against a person with no contractual obligation depends on the relevant information and conduct satisfying the UCPA. The Act separately protects qualifying “shared data with limited access”: information accumulated in substantial quantity and electronically managed for provision to specified persons as a business. The 2024 amendment changed the exclusion in that definition from information managed as secret to trade secrets. Subscription access alone therefore establishes neither all the trade-secret requirements nor all the conditions for this separate category. Civil Code remedies, personal-data duties and patent or copyright rights may also arise, but they should not be assumed to follow from a single confidentiality designation. [1, 8‑9]
The resulting management choice is foundational. A company that indiscriminately labels all of its business information secret may obstruct ordinary cooperation while failing to create persuasive evidence for a dispute. A more effective process establishes what precise information is owned or controlled by which group company, how it came into existence, who needs it for legitimate work, under what authority outsiders have received it and which legal or contractual protection applies. These records are the basis for rational access controls, employment documentation, licensing and eventually any injunction or damages claim.
2. Making secrecy management provable: governance, access privileges, cloud systems and employment transitions
Assigning the entire subject of trade secrets to the information-technology department can create a gap between the information the business values and the data its systems are designed to restrict. A research team may view prototype settings as highly sensitive while retaining broad folder permissions for former project participants. A sales team may regard its customer negotiation histories as proprietary while allowing every user of a customer-relationship-management system to export the entire dataset. Neither the legal label nor the access-control configuration is sufficient in isolation. Employees must be able to recognise which information requires protection, and the firm's actual permissions and practices should reflect that decision.
An information register should identify more than document names. For significant categories it is useful to record the business owner, entity holding the information, originating team, location of the authoritative version, permitted purpose, persons or functions with access, relevant third-party disclosures and applicable confidentiality obligations. Technical classes might include product specifications, unreleased source code, test results, pricing models or sets of training data; customer material might distinguish publicly available contact details from independently accumulated purchasing preferences, transaction history and non-public commercial plans. Identifying versions, file hashes and the circumstances of creation may later matter not only to secrecy management but to the proof that a defendant acquired or used the very material alleged to have been misappropriated.
Technical controls should be calibrated to exposure and value, rather than selected to create a superficially impressive compliance checklist. Least-privilege access, restrictions on bulk exports, controlled external sharing, sign-in records, durable audit trails and monitoring for exceptional downloads can contribute to recognisable secrecy management. Access should be tied to a live business need, not permanently inherited from an employee's title or participation in an old project. Changes in role, secondment, leave, outsourcing arrangements and termination should prompt a proportionate permissions review. Yet employee monitoring also needs a lawful basis and appropriate transparency: the enterprise cannot assume that an interest in preserving secrets entitles it to collect or inspect every private communication without regard to employment rules, privacy obligations or data-retention limits. [5, 25‑26]
Cloud systems and service providers modify the practical boundary of the organisation. Shared group drives, external source-code repositories, third-party analytical environments, offshore support teams, recorded video conferences and the use of generative AI tools may introduce new recipients or processing purposes. Disclosure to a supplier does not necessarily destroy secrecy, but the company must know what was disclosed, to whom and under what controls. Contracts and procedures should address permitted purposes, onward sharing, approved users, subcontractors, locations of processing, logs, security measures, incident escalation and the treatment of live data and backups at the end of the engagement. A group-wide technology policy cannot override restrictions accepted under a particular research or customer contract.
METI's Handbook for Protection of Confidential Information, revised in February 2024, supplies practical examples of layered controls aimed at reducing the incentives and opportunities for leakage. Its Technology Leakage Prevention Guidance, Version 2, published in April 2026, discusses risks connected with personnel, overseas production, joint research and coordination with suppliers. Their value lies in helping executives choose effective measures for real operational risks. They are administrative guidance, not independent statutes requiring every enterprise to buy identical systems or to adopt a single fixed budget. The minimum measures relevant to legal protection and additional measures justified by an enterprise's strategic risk appetite should be identified distinctly. [5, 12]
A frequently overlooked asset is evidence of the controls themselves. Dated records of classification decisions, acknowledgements of confidentiality policies, onboarding training, permission requests, management approvals, internal inspections and remediation following a detected gap can show what the organisation actually did at the relevant time. A carefully written policy introduced after a departure will not necessarily establish the manner in which information was controlled when the alleged copying took place. Boards and general counsel should therefore receive more than incident counts: they need reliable information about overdue permission reviews, exceptional disclosures, contractor compliance and unresolved findings, with sufficient granularity to decide whether existing practices remain defensible.
The risk is not limited to external hacking. A person may have legitimate rights to view or handle information for one purpose and nonetheless copy or retain it for a distinct, unauthorised purpose. Tokyo District Court, Civil Division 47, in its judgment of 25 April 2024 (Case No. 2023 (Wa) 70462), considered the particular information and conduct where copying by a person with legitimate system access was at issue, and ordered specified restraints on use and disclosure and disposal of relevant data, among other relief. That judgment does not make every operation performed by a credentialled employee lawful, nor does it turn every unusually large download into a completed criminal offence. A defensible conclusion requires attention to the scope and purpose of authorisation, the precise acts of acquisition or use and the statutory requirements applicable to the person concerned. [18]
3. Employee mobility and lawful competition: confidentiality, restrictive covenants and recruitment
Staff movements expose a tension that compliance policies must acknowledge rather than conceal. Workers bring accumulated skill and experience to new jobs, and firms legitimately compete for talented engineers, sales professionals and executives. General professional know-how, public industry knowledge and independently developed skill are not automatically the former employer's perpetual property. But mobility does not confer a right to take manufacturing specifications or strategically significant customer data that are legally protected and subject to duties of confidence. The issue is how the law protects identified information against specified conduct without making ordinary competition or career development unlawful.
Article 2(1) of the UCPA differentiates categories of improper acquisition, acquisition followed by improper use or disclosure, use or disclosure of information originally received legitimately but subsequently exploited with the legally specified improper purpose, and conduct by subsequent recipients in relevant circumstances. The classification depends upon how and when the person obtained the information, what that person knew and did, and whether particular statutory mental elements were present. It follows that possession of information after resignation, employment with a rival or increased sales at the new employer cannot, without more, prove every component of a statutory misappropriation claim. Investigation must identify the secret, the acts, the relevant time, the authority originally conferred and the manner and purpose of subsequent use or disclosure. [1]
Post-employment confidentiality obligations must also be distinguished from covenants not to compete. A properly framed confidentiality clause ordinarily addresses the prohibited use or disclosure of particular information. A non-compete covenant can restrict an employee's choice of employer, activity or market even without proof that any secret has actually been used; its effect on occupational freedom is consequently more intrusive. Japanese courts assess enforceability by reference to the employer's legitimate protectable interest, the employee's position, the duration, geographical and professional reach of the restriction, any compensatory arrangements and other circumstances. A clause drafted to prohibit competition across all industries and territories for an extended period is not enforceable merely because an employee signed it. Depending on the circumstances, an excessive restraint may be invalid as contrary to public policy under Article 90 of the Civil Code. [20‑22]
Osaka District Court, Civil Division 26, illustrated this distinction in its judgment of 31 October 2024 (main claim: Case No. 2023 (Wa) 2681; counterclaim: Case No. 2024 (Wa) 585), concerning a former employee responsible for purchasing. The court found the particular agreement invalid under Article 90 of the Civil Code, noting a uniform five-year restraint without geographical limitation or countervailing arrangements. The judgment does not invalidate every post-employment non-compete. It calls for scrutiny of the relationship between the interest protected and the necessity, scope and compensatory features of the particular restraint. [20‑22]
A multinational group should not apply one universal restrictive covenant indiscriminately to its Japanese workforce. The interests implicated by a chief researcher with access to a unique fabrication process differ from those affecting a branch employee with no access to comparable information. Restrictions should be drafted by reference to the information and exposure concerned, with a considered period and scope appropriate to the business and the speed of technological change. The availability of compensation is relevant, but payment alone does not necessarily cure a restriction that is otherwise excessive. Confidentiality, return of property, assignment or licensing of inventions, customer solicitation, non-competition and post-termination cooperation should be articulated as different obligations serving different functions.
Operational care is at least as significant as contract drafting. Transfers between divisions, international secondments, changes in project teams, temporary leave and outside appointments may leave old permissions in place after their original need has expired. Once an employee gives notice, the company should preserve continuity of required handover work while reviewing privileged exports, storage media, device returns and synchronisation with personal cloud accounts. That is not a licence to search privately owned devices or inspect personal correspondence without an appropriate legal basis. The employment contract, device-use policies, consent, necessity and applicable privacy duties all affect how a lawful investigation may proceed.
The recruiting enterprise bears its own exposure. Hiring a skilled employee from a rival is ordinarily legitimate; asking the candidate to bring their former employer's confidential customer list, code repository or designs may implicate the new employer in wrongful acquisition. Interviewers should request descriptions of responsibilities and achievements without asking for protected source documents. Subsequent development work should, where material, be documented to show an independent source of technical decisions. If possibly misappropriated material is received inadvertently, it is often safer to quarantine it and obtain legal instructions about preservation and return than to circulate it among engineers, incorporate it into a product or delete evidence impulsively. Finally, confidentiality obligations should not be invoked indiscriminately to suppress legally protected whistleblowing, required disclosures or appropriate communications with authorities. The legitimate goal is to prevent improper exploitation of secrets, not to conceal misconduct or punish employee rights. [27]
4. Joint research, manufacturing outsourcing and data collaboration: integrating confidentiality into transaction design
A modern innovation project commonly connects universities, start-ups, established manufacturers, software developers, testing laboratories and overseas facilities. The company that supplies know-how may need to disclose it to a partner in order to create a marketable product, yet that disclosure can give the recipient an opportunity to apply the information beyond the intended project. The contractual challenge is not solved by adopting an NDA and expecting every question of ownership and permitted use to follow automatically. It is to distinguish the information disclosed for a limited purpose from the separate commercial and intellectual-property rights needed to exploit what the parties produce together. METI's April 2026 guidance pays particular attention to leakage arising from joint research and from the technical coordination often involved in ordinary procurement; the legal risk may arise in routine discussions long before anyone signs a technology-transfer agreement. [10‑12]
Consider a components supplier that reveals proprietary production settings to a major customer during efforts to improve yield and quality. The customer may require enough access to evaluate whether the supplier can meet contractual specifications. That limited evaluation permission is not necessarily permission to send the same settings to a competing supplier for the manufacture of functionally identical components. Whether the second use is lawful depends on the parties' agreed purpose, information rights, any applicable licence, the existence of a protected trade secret and the circumstances of acquisition and use. An agreement dealing only with confidentiality, without any intelligible definition of authorised exploitation, leaves the core commercial question unanswered. The same issue can arise where software source code is provided to a systems integrator for debugging and later used to develop a competing offering.
Research agreements should identify background technology contributed by each participant, foreground results generated within the collaboration, improvements to pre-existing material, patentable inventions, non-patentable know-how and operational data produced during testing. Disclosure of background information should not be treated as an unlimited transfer of ownership or a royalty-free licence for all future activities. Equally, the recipient may reasonably need a limited licence to perform its assigned work, evaluate results, integrate deliverables or exploit an agreed commercial outcome. These rights should be expressed in a structure that addresses the term of access, permitted products and markets, use by affiliates, sublicensing where relevant and the fate of licences on termination. When research moves towards patent filing, publication, investor diligence or an academic paper, a practical pre-publication review mechanism can prevent the inadvertent loss of confidential know-how while respecting legitimately negotiated publication rights.
The patent-versus-secrecy decision is similarly commercial as well as legal. Patents can supply enforceable exclusive rights but involve disclosure and have a finite term; a properly maintained trade secret can remain protected while its secrecy persists but does not ordinarily prevent a third party from using information that it developed independently. A manufacturing process may be difficult to observe from a finished product, making secrecy attractive, while proof of unauthorised use may be complicated because the alleged infringer's internal production records are not readily accessible. Management should consider reverse-engineering risk, employee mobility, the number of necessary collaborators, the cost of confidentiality controls, the feasibility of litigation and the expected life of the technology. One portfolio may appropriately combine patent filings for externally discernible innovations with carefully managed know-how for process parameters. [1, 28]
The network of persons entitled to see information often extends beyond the immediate signatories. Subcontract manufacturing, outsourced quality assurance, cloud hosting, analytical services, professional advisers and foreign affiliates can create additional disclosure pathways. A broad permission to subcontract does not necessarily specify whether a downstream supplier may train its models on uploaded data, transfer files to another jurisdiction or involve its own subcontractor. The principal agreement should define the classes of protected material, permissible recipients and uses, equivalent confidentiality duties, security and audit obligations, incident notification, assistance with investigation and the treatment of data and backups on exit. Where the information belongs to another party, the contracting entity must also ensure it has authority to confer the requested permissions rather than promising disclosure beyond its own rights.
Standard NDA exceptions require equal care. Information already known to the recipient, independently developed, lawfully obtained from another source, entering the public domain without breach or required to be disclosed by law may be excluded or dealt with through controlled processes. Exceptions drafted too broadly can swallow the operative obligation. Conversely, a perpetual restriction on using any information touched during a project may unreasonably obstruct ordinary learning and independently developed work. Agreements should be sufficiently specific that the parties can later reconstruct what was disclosed, when it was provided, what purpose justified access and whether subsequent development genuinely had an independent origin. Documentation should support legitimate innovation rather than become an administrative substitute for innovation itself.
METI and the Japan Patent Office's Open Innovation Model Agreements, including the April 2025 Version 2.2 materials, provide a useful starting point for coordinating NDAs, proofs of concept, research contracts and licences. They should be adapted, not copied as an assumed statutory safe harbour. In a collaboration between a major industrial group and a technology start-up, the economic balance may depend on whether narrowly granted evaluation access can expand into commercial exploitation without a further licence or payment. The drafting exercise therefore has two complementary aims: preserving information that must remain confidential and enabling the parties to develop and monetise it under rights that they deliberately agreed to grant. Inconsistent provisions across a chain of NDAs, research agreements, purchase orders and licence instruments are a recurring source of both leakage and later disputes. [14]
5. The first response to suspected leakage: lawful evidence preservation and prevention of further harm
A suspected loss of information creates pressure for immediate confrontation. A company may wish to demand a former employee's phone, require an explanation from a competing business or threaten criminal proceedings before it knows exactly what has left its systems. This instinct can compromise the very claim the company hopes to bring. Investigative actions taken without adequate authority can generate separate privacy or employment disputes; premature accusations can expose the company to reputational and civil claims; and poorly planned system changes may destroy logs needed to establish what happened. The first legal task is disciplined fact-finding, not the choice of emphatic language for a demand letter.
The response team should distinguish the information at issue, its location and legal holder, the individuals with legitimate access, the scope of their authorisation, the suspected act of acquisition or disclosure and the degree of ongoing exposure. These are different questions and should not be collapsed into an assumption that a suspicious export necessarily proves theft. At the outset, the team may need to preserve authentication records, relevant device images, cloud-sharing history, file-transfer logs, contract permissions, data-classification records, original or versioned documents and termination notices before routine retention policies overwrite them. A reliable record of who obtained each item, how it was copied, at what time and with what verification of integrity can be critical when events are contested in court.
Forensic assistance may be necessary, but an external investigator should not be granted unstructured access to every company and third-party dataset. The engagement must address the purpose and scope of collection, confidentiality obligations, safeguards for personal and client information, possible international transfer, access to the investigation material and the format in which findings will be reported. Hash values, time stamps and a documented chain of custody can help explain integrity; they do not themselves prove that conduct satisfied the UCPA. Legal and information-security teams should agree on the sequence in which evidence is secured and compromised access is disabled, because remedial steps can alter the factual record. The aim is to act promptly without making future reconstruction impossible.
Investigating an employee brings a distinction between corporate and personal property. A company may have lawful access rights in relation to its own managed systems and devices, but that does not create an unlimited right to inspect a personal smartphone, a private email account or communications with third parties. Employee agreements, system-use policies, notice, consent where relevant, proportionality, privacy and the facts giving rise to reasonable suspicion all require assessment. When an executive or board member may be involved, the company must also address authority to direct the inquiry, conflicts of interest and the independence of those assessing the evidence. Where voluntary cooperation is unavailable, a court-supervised preservation mechanism may be preferable to unauthorised self-help. Private investigators cannot exercise powers reserved to courts or law-enforcement authorities. Evidence preservation under Article 234 of the Code of Civil Procedure addresses circumstances in which taking evidence in advance is necessary to avoid difficulty in using it later; it is not an unrestricted search of another party’s devices. It must be distinguished from a provisional injunction directed at stopping use, which serves a different purpose and has separate conditions. [23‑24, 26]
Containment should proceed alongside preservation. Permission reviews, suspension of external sharing links, replacement of compromised credentials, restrictions on further distribution and appropriate instructions to service providers may prevent additional exposure. The company should document what was changed, why, by whose authority and whether copies are believed to remain outside its control. It should not attempt to access a competitor's systems without authorisation or remotely destroy material located there in the belief that the information ultimately belongs to the company. Such actions can create independent liability, frustrate proof and undermine the credibility of otherwise valid claims. If the alleged use is time-sensitive, counsel can consider a narrowly framed application for provisional relief rather than conduct that bypasses legal process.
The level of confidence in the facts should govern external communications. A written inquiry to the former employee or new employer may reasonably seek preservation, non-use and an explanation of identified transfers, but its allegations should distinguish verifiable events from legal inferences. Announcing that a named person has committed a crime before the elements of an offence are established may produce defamation or other disputes. Disclosure to customers, insurers, securities-market authorities or regulators requires a separate examination of the applicable obligations, contractual commitments and degree of certainty. If the material contains personal data or export-controlled technology, the Personal Information Protection Act or the Foreign Exchange and Foreign Trade Act may create independent reporting, use or transfer issues not resolved by a trade-secret analysis. [26, 29]
The inquiry should be capable of identifying facts unfavourable to the company. An open folder, unclear contractual permissions, ignored control failures or a supplier's reasonable understanding that reuse was permitted may affect both secrecy management and the appropriateness of proposed relief. Concealing those facts from internal decision-makers or developing a litigation strategy on an assumption the available records refute is hazardous. At its conclusion, the investigation should be able to identify the evidence and remaining uncertainty for each proposed defendant: the person who acquired the information, another person who used it and any downstream recipient whose state of knowledge may be legally material. The board or authorised executives can then compare containment, negotiated undertakings, injunctive relief, damages, possible criminal referral and remedial improvements against realistic probabilities, costs and effects on the business.
6. Injunctions, damages, evidentiary presumptions and criminal proceedings: choosing remedies that the facts support
Once the facts have been stabilised, the company must decide what result it actually requires. Recovering copies, stopping current use, preventing future disclosure and obtaining compensation for past economic harm are related but not identical goals. Japan's UCPA does not replace them with one all-purpose right to “recover a trade secret.” Article 3(1) provides for injunctions where unfair competition infringes or threatens a business interest; Article 3(2) permits necessary disposal or other associated measures when seeking that injunction. Article 4 separately addresses damages for intentional or negligent infringement, subject to the statutory requirements. A contractual claim, an application for interim relief and a possible criminal complaint may add different routes. Each requires a distinct legal and evidentiary analysis, and a cause of action under one route should not be assumed to establish the others. [1, 23]
An injunction requires a sufficiently identifiable protected subject matter and a coherent account of the alleged acts and risk. A demand to prohibit the use of all the claimant's technical information or all of its customer information can be difficult to enforce if neither the court nor the defendant can ascertain what it encompasses. Depending on the facts, specific information, media, copies or acts of use may be capable of description without exposing more than is necessary. An application for a provisional injunction may be considered where rapid commercial deployment threatens irreversible harm, but the applicant must substantiate the asserted right and the need to avoid substantial damage or imminent danger under Article 23(2) of the Civil Provisional Remedies Act and the applicable procedural requirements. The timing of product launches, the strength of the available documentary evidence, the scope of the requested order and the potential consequences for the other party's operations may become decisive. Provisional relief should not be represented as automatic whenever an employee download is identified. [23]
Damages present a separate proof problem. A copy of confidential material may have left the company, yet identifying the resulting loss can be much harder than showing that a file was exported. Article 5 contains mechanisms for determining or presuming damages in qualifying circumstances, and the amendments effective on 1 April 2024 extended Article 5(1) to business secrets and services and provided for adding licence-fee-equivalent amounts for qualifying quantities beyond supply capacity or otherwise excluded from the lost-profit calculation. That additional component is excluded where the claimant could not have granted the relevant permission. This does not create a fixed royalty payable whenever a secret is accessed without permission. The applicable category of misconduct, the relationship between the information and the allegedly competing product, the defendant's gain, the claimant's likely economic position, causal issues and the available evidence remain important. Contemporaneous product development records, research expenditure, licensing practice and profit models can be more valuable than a general assertion of substantial lost corporate value. [1, 8]
Article 5-2 provides a conditional presumption of improper use for specified technical secrets, including qualifying production-method information, where the prescribed acquisition, appropriation or possession and subsequent production or other specified activity capable of being carried out using that secret are established. The 2024 amendment added categories involving prescribed continued possession after later awareness of improper acquisition or disclosure, and appropriation of legitimately disclosed secrets in breach of duty for an improper purpose, among others. It does not deem every removal of technical or customer information to be use. The three trade-secret requirements, the facts required by the relevant paragraph and the connection with the subsequent activity still matter. Research histories, production changes, instructions and version-controlled programs can support invocation of the presumption or rebuttal of it. [1, 8]
Timing is also material. Article 2(2)–(4) of the supplementary provisions to Act No. 51 of 2023 excludes the newly added categories of presumptions in specified cases involving possession continuing from before commencement or appropriation before commencement. Production after 1 April 2024 alone therefore does not make all the expanded presumptions applicable. Acquisition, knowledge, appropriation, possession and use should be placed on a separate, evidenced timeline. [8]
Litigation has its own confidentiality problem. To establish a claim, a plaintiff may need to disclose the very technical detail it wishes to protect. The UCPA contains procedural devices including an obligation to clarify the specific manner of an alleged infringement in relevant litigation under Article 6, document-related procedures under Article 7 and protective orders for secrets under Article 10 and the closing of certain party examinations to the public under Article 13. These mechanisms can mitigate exposure; they are not blanket secrecy over any document labelled confidential. The company should discuss with litigation counsel and technical experts which information genuinely must be placed before the court, what orders are available, who may inspect it and how the scope of the proposed order will be specified. The design of an evidentiary record therefore begins long before a claim is filed. [1, 6]
The outcomes of individual cases illustrate the range and limits of remedies. Tokyo District Court, on 25 April 2024 (Case No. 2023 (Wa) 70462), ordered restrictions on use or disclosure, disposal of relevant files and copies and certain monetary relief in connection with the information and conduct established in that case. The Intellectual Property High Court's judgment of 25 March 2025 (Case No. 2023 (Ne) 10057) addressed trade-secret status and particular improper use, with conclusions concerning restraints and related remedies grounded in the record before it. Neither decision is authority for a proposition that deletion, a full damages award or a broadly worded order must follow every discovered transfer. The precise injunction and the proof supporting it remain central. [16‑18]
Criminal liability is a further, distinct inquiry. Articles 21 and 22 of the UCPA establish offences and associated corporate liability in specified circumstances. A criminal trade-secret allegation may require the statutory information attributes, prescribed forms of misappropriation or use, and the relevant improper purpose or other mental elements. In the judgment pronounced on 25 February 2025, Tokyo District Court, Criminal Division 8 (Case No. 2023 Toku (Wa) 1278), recognised secrecy management of research know-how in light of rules governing ownership and confidentiality of research output, locked facilities, individual passwords and mandatory training. The court rejected the proposition that the institution’s specific awareness of each individual research result was necessarily a prerequisite in those circumstances. Its reasoning is case-specific, not an automatic rule for all research institutions. Companies should also recognise that a report to police, acceptance of a complaint or commencement of an investigation does not itself establish civil liability or loss. Criminal process must not be used merely as a threat to coerce a commercial concession. The appropriate combination of civil, interim, contractual and criminal avenues depends on what protects the information and achieves a legally sustainable business outcome. [19]
7. Cross-border transactions, M&A and board responsibility: preserving non-public information as enduring enterprise value
A Japanese company may suffer leakage outside Japan even when the underlying know-how was created, managed and economically exploited principally at home. Files can be accessed from a foreign research office, manufacturing parameters applied in an overseas factory, joint-development results reused after an international project ends, or information moved into a foreign parent's infrastructure following a buyout. In such circumstances, the location of the right holder, the place of management, the location and category of the alleged conduct, the contractual governing law and the requested remedy are not necessarily the same. A forum clause in an NDA does not by itself decide every question of jurisdiction and applicable law for a statutory tort or other non-contractual claim.
Articles 19-2 and 19-3, introduced with effect from 1 April 2024, address different aspects of international trade-secret claims. Article 19-2 permits proceedings in Japan for specified misconduct involving a trade secret of a holder doing business in Japan where the secret is managed in Japan. Article 19-3 extends Chapters I, II and III of the UCPA to specified foreign conduct with the same connecting factors; it is not a blanket rule on extraterritorial criminal liability. Both provisions are limited to the four categories in Article 2(1)(iv), (v), (vii) and (viii), and exclude secrets used exclusively for business outside Japan. The holder’s nationality is not itself the statutory test. [1, 8]
Japanese ownership alone does not establish Japanese jurisdiction or application of Japanese law to every foreign act. Conversely, where these special provisions are unavailable, the ordinary international-jurisdiction rules in the Code of Civil Procedure, the Act on General Rules for Application of Laws and any relevant contractual dispute-resolution agreement still require separate assessment. The availability of a forum and the law governing the merits are distinct questions. [24, 30]
The reforms can be commercially significant because they make certain connections between domestically managed information and international misconduct legally explicit. They do not eliminate practical questions of foreign service of process, access to records abroad, the recognition or enforcement of a Japanese judgment in another jurisdiction, or restrictions imposed by foreign secrecy and data laws. Export-control rules can affect the provision of technical information to overseas counsel, experts and affiliates; personal-data law may separately regulate the movement of employee or customer material. Arbitration agreements and contractual cooperation duties may offer additional tools, but they should be drafted with an awareness of which disputes can realistically be addressed in the selected forum and which orders will need enforcement where assets or information are located.
Trade secrets are also an asset and a risk in M&A. A buyer may value a target because its advantage lies in process know-how rather than registered patents. Legal due diligence should then assess the actual information, who created it, whether contractors or former employees retain rights or copies, what agreements govern contributions by research partners and whether the company's controls support its claims of secrecy. Requests for complete technical disclosure during diligence can themselves create risk, especially in competitive acquisitions or transactions involving multiple bidders. Staged disclosure, need-to-know access restrictions, purpose limitations, appropriate confidentiality undertakings and the use of abstracted technical explanations can allow meaningful valuation without making the transaction process an uncontrolled dissemination channel.
Transaction documentation should allocate rights and uncertainty rather than attempt to manufacture statutory facts through warranties. Relevant representations may address title or legitimate control over material information, compliance with confidentiality obligations, known leakage incidents, third-party claims, employee and contractor assignments, and the status of governance controls. Specific indemnities, closing conditions, remedial measures or purchase-price arrangements may be considered where an identified trade secret is critical to valuation and a particular defect could materially affect post-closing operations. An asset acquisition, corporate reorganisation or business transfer also requires analysis of the contractual rights needed to continue using confidential material; merely transferring physical assets or shares does not ensure that all licences or permissions from external counterparties will remain unrestricted.
Post-merger integration can alter the same permissions that justified the transaction's value. Centralising cloud storage, replacing access directories, pooling development teams internationally, consolidating suppliers or importing protected datasets into group-wide analytics may enlarge the recipient population or change the purpose for which information is used. Confidential information entrusted to the target by a customer, university or former joint-venture partner is not necessarily available for free use by every affiliate after a share acquisition. Contractual transfer and change-of-control provisions, subcontracting limits, privacy obligations, third-party intellectual-property rights and overseas technology controls may all require a separate approval path. Responsibility for these issues should pass deliberately from the transaction team to the post-closing operating teams, rather than disappear upon completion.
The board's oversight responsibility is correspondingly broader than approving an information-security budget. Directors and senior legal officers should be able to identify strategically important information and its legal holder, understand whether access corresponds to business need, receive evidence of contract-aligned disclosures, and obtain timely escalation of material departures from policy. Periodic reports should address unresolved audit findings, control exceptions, permissions retained after role changes, material subcontractor exposure and lessons from investigations, not merely the number of incidents reported. None of this means that every security deficiency automatically establishes personal liability on the part of a director. It does mean that credible management of intangible value is part of a rational system of internal controls and informed corporate decision-making.
Protecting trade secrets is not a case for shutting down innovation, restricting all employee movement or refusing necessary information disclosure. Joint ventures, technology licensing, venture investment and M&A require information to be shared lawfully and deliberately. Effective governance instead identifies the information entitled to protection, authorises legitimate use, records the conditions under which rights and recipients change, and provides defensible evidence if an agreed boundary is crossed. Where statutory requirements, official guidance, private obligations and case-specific judicial findings are kept distinct, non-public information can remain a practical source of enterprise value rather than merely a line in a confidentiality policy.
Frequently Asked Questions
Q1. Must a Japanese trade secret be marked “STRICTLY CONFIDENTIAL” to receive statutory protection?
No particular phrase is universally required. The relevant issue is whether secrecy-management measures make the holder's intention to protect identifiable information recognisable to the persons who handle it, considered in light of the information and working environment. Clear labels and properly applied classifications can assist that showing, but neither a label in isolation nor an expensive security system guarantees that the statutory requirement is satisfied.
Q2. Does signing an NDA automatically make disclosed information a trade secret under Japanese law?
No. An NDA can create enforceable contractual restrictions, but statutory trade-secret protection still requires secrecy management, business usefulness and non-public character under Article 2(6) of the UCPA. Information may be protected by contract even when it fails the statutory test; conversely, liability under the UCPA requires proof of the applicable category of misconduct and its legal elements, not simply proof that a confidentiality clause exists.
Q3. Does customer information lose trade-secret status whenever all employees can access the company's system?
Not necessarily. Access breadth is one of several factors, not an automatic numerical rule. In its 13 February 2025 judgment, Osaka District Court examined the prospective-customer dataset, broad access and a lack of specific measures and declined to find adequate secrecy management on the evidence before it. Different classifications, access practices and employee awareness could lead to a different evaluation. The particular dataset and its actual management must be examined.
Q4. May a departing employee use skills and experience learned at a former employer?
Generally acquired professional skills, experience and information already in the public domain are not automatically prohibited from being used at a new employer. The analysis changes where the conduct involves identified protected trade secrets, breach of a valid contractual duty or a specified form of improper acquisition, use or disclosure. A move to a competitor alone does not establish misappropriation; the specific information and conduct must be proved.
Q5. Is a post-employment non-compete enforceable whenever the employee signs it?
No. The enforceability of a restraint depends upon the employer's legitimate interests, the employee's role, its duration, geographic and occupational breadth, compensation and other relevant circumstances. An excessive covenant may be invalid under the Civil Code's public-policy rule. Confidentiality duties and a restriction on accepting competitive employment should be drafted and assessed as distinct obligations.
Q6. May a Japanese company ask a candidate from a competitor to bring customer lists or development files?
That creates substantial legal risk. Asking for materials belonging to a previous employer can expose the recruiting company to claims based on its own acquisition or use of another party's information. Recruiters should focus on general experience and qualifications without soliciting protected documents. If potentially confidential files are inadvertently received, the company should restrict access, preserve the facts and obtain case-specific legal advice before using or disposing of them.
Q7. Does a confidentiality clause decide ownership of joint-research results?
No. Restrictions on disclosure are distinct from ownership and rights of exploitation. Collaboration agreements should address pre-existing technology, newly generated know-how, patentable inventions, improvements, research data, licences for project performance and commercialisation, publication, outsourcing and rights surviving termination. An NDA alone rarely determines whether one party can use a production method for another customer or licence the resulting work to an affiliate.
Q8. Can a company immediately inspect a former employee's personal smartphone when data export is suspected?
Not automatically. The employer's rights concerning its managed devices and systems differ from those concerning private devices and communications. Policies, contractual rights, consent, necessity, proportionality, personal-data protections and the evidence supporting the suspicion all require assessment. Relevant corporate logs and records should be preserved promptly, but the company should not assume that suspected wrongdoing authorises unlimited searches of personal property.
Q9. Can a victim obtain an injunction against use or disclosure and require disposal of copies?
Potentially, where an injunction under Article 3(1) of the UCPA and necessary associated disposal under Article 3(2) are justified. The company must identify the relevant trade secret and particular acts of unfair competition and show an infringement or legally sufficient threat. The available order will depend on the evidence and the scope of relief sought. Neither deletion nor a sweeping ban follows automatically from proof that a document was downloaded.
Q10. Do the 2024 amendments guarantee higher damages awards in trade-secret disputes?
No. The reforms expanded relevant damages-calculation rules and aspects of the statutory presumption concerning use of technical secrets, but each mechanism has defined conditions. A claimant still has to establish the requisite factual predicates, and assessment of loss depends on the particular conduct, information, economic circumstances and proof. Statutory tools assist with evidentiary difficulties; they do not promise a fixed recovery or dispense with causation and other applicable legal requirements. Transitional exclusions concerning pre-commencement possession or appropriation also apply to the expanded presumptions.
Q11. Can every act of trade-secret infringement committed abroad now be litigated in Japan?
No. The special jurisdiction rule in Article 19-2 and the application rule in Article 19-3 require separate attention to business and management in Japan, the four categories in Article 2(1)(iv), (v), (vii) and (viii), and the exclusion for secrets used exclusively in foreign business. Outside those special rules, ordinary jurisdiction, applicable law and contractual dispute-resolution arrangements must still be assessed. Foreign service and enforcement remain separate issues.
Q12. May an overseas parent company freely exploit the trade secrets of an acquired Japanese subsidiary?
Not as an automatic consequence of acquiring its shares. The target's own secrets and information received under third-party restrictions may be subject to different permissions. An acquirer should examine creation and ownership history, confidentiality and licensing agreements, previous leakage issues, rights of research partners and post-closing technical architecture. Group-wide cloud access, personnel integration or cross-border licensing may require additional contractual and regulatory steps.
About the Legal Update Series
SAKURA Law Office and Managing Partner Kenshiro Michishita publish the Legal Update series to examine legal questions that shape significant corporate decisions, including corporate transactions and M&A, private equity, international business and disputes, financial regulation, corporate governance, investigations and crisis management, economic security, artificial intelligence, data protection and intellectual property. The series is grounded in legislation, official government materials and judicial decisions and seeks to distinguish binding legal requirements from administrative guidance, negotiated contractual duties and recommendations for sound practice. Its purpose is to connect substantive legal analysis with the decisions that executives, boards, General Counsel and transaction teams must make. Further information about the firm and the author is available from the official SAKURA Law Office website and the professional profile of Managing Partner Kenshiro Michishita.
Related resources: SAKURA Law Office official website | Profile of Managing Partner Kenshiro Michishita
How SAKURA Law Office Can Assist
Consultations with SAKURA Law Office may address identifying and managing trade secrets; confidentiality, non-compete and employee transition obligations; joint research, development outsourcing and technology licences; lawful evidence preservation and investigation where leakage is suspected; injunctions, damages, interim measures and criminal-law issues; and cross-border information governance, M&A diligence and post-merger integration. The prospects of any particular remedy depend on the precise information, actual controls, conduct and permissions involved, available evidence and the location of the relevant parties and assets. No litigation or enforcement outcome can be guaranteed.
Contact
SAKURA Law Office
Ark Hills South Tower 4F, 1-4-5 Roppongi, Minato-ku, Tokyo 106-0032, Japan
Managing Partner Kenshiro Michishita
Principal References
Bracketed numbers in the text refer to the sources below; numbering and destinations are identical in both language editions. Authoritative Japanese legislation takes precedence over guidance, translations and model contracts. Case references describe the decisions themselves, not their appeal or finality status. Maintained and undated webpages are referenced as of 26 October 2026.
13. METI | Technology Leakage Prevention Measures (maintained official guidance portal)
22. e-Gov Laws | Civil Code (Act No. 89 of 1896; including Article 90, Japanese)
23. e-Gov Laws | Civil Provisional Remedies Act (Act No. 91 of 1989; including Article 23, Japanese)
25. e-Gov Laws | Labor Contracts Act (Act No. 128 of 2007; current Japanese text)
28. e-Gov Laws | Patent Act (Act No. 121 of 1959; current Japanese text)
29. e-Gov Laws | Foreign Exchange and Foreign Trade Act (Act No. 228 of 1949; current Japanese text)
Disclaimer
The legal-analysis and final-revision date of this publication is 26 October 2026; the initial research date was 9 October 2026. It draws on relevant Japanese legislation, METI’s March 2025 Management Guidelines, its April 2026 Technology Leakage Prevention Guidance, Version 2, and published judicial and official materials. It provides general information, not an opinion on a particular matter or a guarantee of a litigation, administrative or criminal outcome. Administrative guidance, model contracts and judicial decisions have legal roles distinct from legislation. English translations are reference materials; authoritative Japanese statutory texts prevail.
Secrecy management, improper acquisition, use or disclosure, contractual validity, loss, criminal liability, international jurisdiction and applicable law depend on the information, controls, conduct, transitional rules and relevant dates. Case discussions are confined to the findings and reasoning of the particular decisions. Current legislation, official materials and case-specific advice should be considered before disclosures, employee investigations, joint research, M&A or enforcement.