A Former Employee Took the Customer List: Trade Secrets and the Paperwork to Have in Place

The core answer

A customer list can be a trade secret, but only if the company can show it treated the list as secret. In most small and mid-sized businesses the list sits in a shared spreadsheet, a LINE group or a salesperson's phone, with no confidentiality terms and no limits on who can copy it. That is the weak point, and it is fixable before anyone leaves.

The rule (Trade Secrets Act B.E. 2545). Section 3 defines a trade secret as trade information that is not generally known or accessible to people who normally deal with that kind of information, that has commercial value because it is secret, and for which the controller has taken appropriate measures to keep it secret. Section 6 makes it an infringement to disclose, take away or use a trade secret without the owner's consent, contrary to honest commercial practice, where the person knew or had reason to know it. Section 8 gives the owner a right to ask a court for a temporary order to stop, and to sue for an injunction and damages.

Our practical view. Winning after the event depends on paperwork made before it: confidentiality terms the employee signed, access that matched their role, logs, and a documented exit. Contacting customers is not unlawful in itself. The case is about what was taken or used, and whether you can prove it.

This guide covers the customer-list problem. For the wider comparison of patents, petty patents and trade secrets, read patent, petty patent or trade secret.

1. Is our customer list really a trade secret?

Go through the three parts of section 3 honestly.

The third part is where most companies fall short, because it describes what the company did, not what the employee did. A bare list of company names is weak. A file combining contacts, order history and negotiated terms is stronger. The Act does not give a number of measures that is "enough". It asks whether the measures were appropriate to the information.

2. When is taking or using it an infringement?

Under section 6, the act is disclosing, taking away or using the secret without consent, in a way contrary to honest commercial practice, and the person must have known or had reason to know that. The same section says this includes a breach of contract and inducing a breach of confidence. In practice this covers:

• exporting the customer database before resignation and using it at a new employer or own business;
• forwarding the file to a personal email or cloud account;
• using it to solicit customers while still employed;
• a new employer who knowingly receives and uses the file.

Section 7 lists acts that are not infringement. We read two of them as relevant here: someone who obtains the secret from another party by a lawful transaction without knowing, or having reason to know, that it had been misappropriated, and independent discovery or reverse engineering of a product. Memory of customers whom the employee served is not clearly covered either way, so do not assume it is an infringement. What the employee carries in their head and what they copy out are different things for evidence.

3. Which documents should be in place before someone leaves?

None of these is a magic shield. Together they show "appropriate measures".

1. Employment contract with a confidentiality clause. Define confidential information (customer list, price lists, supplier terms, margins), state that the duty continues after employment, and say what happens on breach.
2. Work rules. Cover use of company systems, personal devices, copying data, and discipline for breach. Check the employee agency, Facebook page and LINE OA guide for account ownership evidence.
3. Stand-alone confidentiality agreement. For senior sales and account staff, a short separate agreement can be clearer than a clause buried in a long contract. For the same tool used with outside parties, see NDA before business negotiations.
4. Data-classification and access policy. Say which data is confidential, who may see it and how it may be shared. Give each person access matching their role.
5. System controls and logs. Individual accounts, no shared logins, restrictions on export and USB, and logs that show who opened or downloaded what. Logs are the evidence you will want later.
6. Company-owned channels. Customers contacted through company email, a company LINE OA and a CRM, not personal accounts.
7. Exit checklist and acknowledgement (section 5).

For the HR documents themselves, our HR documents service and contracts and documents service cover drafting.

4. Can the contract stop them working with our customers after they leave?

Be careful here. A term that restricts the right to work or to do business is not automatically valid, and it is not automatically void. Under section 5 of the Unfair Contract Terms Act B.E. 2540, if such a term makes the restricted person bear a burden heavier than would normally be expected, it is enforceable only to the extent fair and reasonable in the circumstances. The court looks at factors such as the scope of area and time and the person's ability to earn a living in other ways. The result depends on the facts, so we do not treat a restriction as the main protection.

More targeted tools are usually easier to defend, though they too are judged case by case:

• Confidentiality, which protects the information instead of the person's livelihood.
• A narrow non-solicitation term, limited to customers the employee actually handled and to a short, defined period.
• Returning and deleting company data on exit, with a signed statement.

Draft each one for the specific role, and have a lawyer check it before you rely on it.

5. What should the exit process look like?

A written checklist, completed and signed, is often the best single document in a later dispute.

• Remind the employee in writing of the continuing confidentiality duty.
• Collect laptops, phones, SIM cards, tokens and keys, and record serial numbers.
• Disable email, CRM, cloud, messaging and shared-folder access on the last day, ideally at the end of the shift.
• Transfer company channels and accounts: LINE OA, social pages, domains, shared mailboxes.
• Review logs for the last weeks for large exports, forwards to personal addresses and unusual downloads. Keep a copy.
• Agree a customer handover: who takes over each account, and a short message to customers.
• Have the employee sign a statement that they returned or deleted company data and keep no copies.
• Keep the signed acknowledgement with the personnel file.

If you suspect wrongdoing, do not wipe or reuse the laptop or phone. Take a forensic copy first, or at least secure the device and log.

6. How does PDPA fit in?

If your list contains information about identifiable individuals, such as names, phone numbers, email addresses or LINE IDs, it is personal data and your company is the controller responsible for protecting it. Copying it out to a personal device is a security failure on your side, not only the employee's. Link the two tracks: employee data duties are in PDPA and employee data for HR, and what to do if a leak happens is in data breach response, first steps. We do not explain PDPA in detail here.

7. What can we do after it happens?

Rough order, and each step needs the facts of your case:

1. Preserve evidence. Logs, emails, the devices, messages with customers, the signed documents. Record who handled them and when. Do not confront the employee before the evidence is secured.
2. Work out what was actually taken or used. A single copied file is a very different case from general competition.
3. Demand letter. A lawyer's letter asking the person to stop, return and delete the data and confirm in writing is often the fastest and cheapest route to a result. See our demand letter service.
4. Civil claim and interim measures. Section 8 of the Trade Secrets Act allows the owner to ask the court for an order to stop the infringement temporarily, which can be sought before the main lawsuit, and to sue for an order prohibiting infringement and for compensation. It requires clear evidence of the infringement or its imminence. Breach of the confidentiality clause and tort under the Civil and Commercial Code may also be pleaded. Check the claims together with a lawyer, because each has its own conditions.
5. Criminal options. The Trade Secrets Act has criminal sections, but the one we read (section 33) concerns spreading another's secret widely to the public with intent to harm the owner's business, so it does not fit the usual "used the list for a competitor" case. The Criminal Code section 324 deals with disclosing or using a secret about industry, discoveries or science learned through a position or occupation of trust, and section 325 makes the offences in that chapter compoundable (settleable). Whether an ordinary sales employee falls within section 324 is an open question we would not assume. If the facts involve dishonest taking of company property, a lawyer should look at other offences as well. Do not file a criminal complaint only as pressure.
6. Time limits. Section 10 of the Trade Secrets Act gives three years from when the owner knew of the infringement and the infringer's identity, and ten years at most from the act. Other claims and complaints have different periods, so take advice early.

Internal fact-finding on an employee suspected of taking data is part of our employee investigations service, and IP strategy sits under our IP practice.

8. Checklist

• Customer list marked confidential, stored in one controlled place
• Access by role, individual logins, logs switched on
• Confidentiality clause in every employment contract, and work rules covering data
• Stand-alone confidentiality agreement for senior sales and account staff
• Personal email, personal LINE and USB export restricted or monitored
• Company-owned channels for customer contact
• Exit checklist, return of devices and data, signed acknowledgement
• Customer handover plan for each departing salesperson
• Evidence preservation steps ready if a leak is suspected
• Any post-employment restriction drafted narrowly and reviewed by a lawyer

Further reading

• Patent, petty patent or trade secret
• Employee agency not returning Facebook page, LINE OA or domain
• PDPA and employee data for HR
• Data breach response, first steps
• NDA before business negotiations

Protect the customer list by treating it as a secret every day, not just when someone resigns: the measures you can prove are what make a trade secret claim possible.

We draft confidentiality terms, work rules and exit documents, and help when a former employee takes company data. For an initial consultation, call +66 92 254 2045 or send us the details. See also HR documents, contracts and documents and employee investigations.

This guide is published by Suwanvara Law Firm — a Khon Kaen law firm established in 1986. General information only, not legal advice on a specific matter.