Crime of Disclosing Trade Secrets: Employee Data Theft & Rights

Are client lists, pricing policies, and portfolio information legally considered trade secrets?

In today's business world, one of a company's most valuable assets is undoubtedly its data and information. But are customer lists, pricing policies, and profitability figures, painstakingly compiled over years, simply "information," or do they have the status of a legally protected "secret"? The legal nature of this information forms the basis of processes such as the crime of a former employee sharing company secrets or unfair competition lawsuits.

The Supreme Court's jurisprudence defines the concept of a trade secret as "information that is not publicly known, that enables a commercial enterprise to gain an economic advantage over its competitors, and that the business owner has a legitimate interest in keeping confidential." In this context, although the concepts of trade secret, banking secret, and customer secret have technical differences within themselves, the fundamental focus is on "confidentiality and economic value." Banking secrets directly protect the private financial data of financial institutions' customers, while customer secrets encompass customers' personal or commercial preferences.

A common problem in business lies in the answers to the question of what constitutes a trade secret . Customer contact lists, specific profit margins, special discount rates, supplier agreements, and production techniques that are not publicly accessible are legally considered trade secrets. For example, a dealer list publicly published on a website cannot be considered a trade secret; however, an Excel file containing the monthly purchase quotas, special discounts, and payment terms of those dealers, accessible only to authorized internal personnel, clearly answers "yes" in discussions about whether a customer portfolio constitutes a trade secret . Therefore, the unauthorized copying, theft, or transfer of such information to a competitor by a former employee is an action with serious legal consequences.

What does this mean?

Names in your directory or company names easily found online don't, by themselves, constitute trade secrets. However, confidential information that is not public knowledge, unknown to your competitors, and that generates revenue for your company—such as who buys goods from you and at what price, the special discounts you offer them, the payment terms you use, your profit margins, and secret agreements with your suppliers—is a trade secret that must be protected under the law. When a former employee takes these files, legally speaking, they are not stealing simple information, but your company's "trade secret."

The Crime of Disclosure Trade Secrets and Penalties under Article 239 of the Turkish Penal Code

For a former employee to leak company data is not only a breach of employment contract but also a serious criminal offense punishable by imprisonment under the Turkish Penal Code. Unauthorized access to and sharing of sensitive company data with third parties falls under Article 239 of the Turkish Penal Code, which criminalizes the disclosure of trade secrets .

According to Article 239 of the Turkish Penal Code, a person who, by virtue of their position, duty, profession, or trade, discloses or reveals to unauthorized persons information or documents constituting trade secrets, banking secrets, or customer secrets, shall be punished, upon the complaint of the victim, with imprisonment from one to three years and a judicial fine of up to five thousand days . The article further stipulates that obtaining this confidential information through unlawful means such as coercion, threat, or unauthorized access to information technology, transferring it to a competing firm, or using it for the purpose of gaining unfair advantage in commercial activity, is subject to the same penal sanctions. The crime of stealing customer information by copying company data to flash drives, transferring it to cloud storage accounts, or sending it to personal email addresses falls directly within the scope of this article.

From a criminal law perspective, another critical aspect of the process is its connection to other types of crimes:

• Article 136 of the Turkish Penal Code (Unlawfully Disclosing or Obtaining Data): If the stolen customer lists contain personal data such as names, surnames, phone numbers, or email addresses of natural persons, in addition to information about legal entities, the act also constitutes a crime under Article 136 of the Turkish Penal Code. Article 136 of the Turkish Penal Code is not subject to complaint; it is investigated ex officio and carries a prison sentence of 2 to 4 years.

• Article 244 of the Turkish Penal Code (Damaging, Destroying, or Altering Data in an Information System): If a departing employee not only copies data but also deletes or renders inaccessible files on the company server with the intention of concealing evidence, the crime of obstructing an information system and destroying data arises.

• Concurrent Offenses: If the perpetrator, with a single act, both discloses a trade secret and obtains personal data, the rules of concurrent offenses regulated in Article 44 of the Turkish Penal Code come into play, and as a rule, punishment is determined based on the offense requiring the most severe penalty. However, if it is determined that the acts were carried out through multiple independent actions (for example, both the theft of data and the deletion of original records in the company), the perpetrator is punished separately for each offense.

Furthermore, prosecution of the crime under Article 239 of the Turkish Penal Code is, as a rule, dependent on a complaint, and the 6-month complaint period begins to run from the date the company management learns of the act and the perpetrator; not missing this period is vital for criminal prosecution.

What does this mean?

Employees who secretly copy and keep company information will not only be fired; they can also be directly prosecuted in criminal court with a potential prison sentence of 1 to 3 years following a prosecutor's investigation. Furthermore, if the leaked data includes customers' personal contact information, or if the employee deleted company files to avoid leaving a trace, then the penalties for data theft and cybercrime come into play, significantly increasing the employee's punishment.

Business and Commercial Law Aspects: Duty of Loyalty and Violation of Non-Compete Clauses

While employees leaking company data is investigated under criminal law as the crime of disclosing trade secrets , it also directly violates fundamental principles of labor and commercial law in private law. The compensation and sanction mechanisms that the employer can resort to in this process are based on three fundamental legal grounds: duty of loyalty, non-compete agreements, and unfair competition.

1. Obligation of Loyalty While the Employment Contract Continues

According to Article 396 of the Turkish Code of Obligations (Law No. 6098), an employee is obligated to protect the legitimate interests of the employer and to refrain from any conduct that could harm the employer. Copying the employer's client portfolio, establishing clandestine contacts with competing firms, or preparing the infrastructure for a future business during working hours while the employment relationship continues constitutes a clear breach of the employee's duty of loyalty . This situation, in accordance with Article 25/II of the Labor Law (cases that do not comply with moral and good faith rules), gives the employer the right to terminate the employment contract immediately and without compensation.

2. Obligation not to compete after the termination of the employment contract.

The duty of loyalty generally ends when an employee leaves their job; however, protection continues if there is a valid non-compete agreement (or a non-compete clause in the employment contract) between the parties.

According to Articles 444 et seq. of the Turkish Code of Obligations, certain conditions must be met for a non-compete clause to be deemed valid in court:

• The employee being in a position that allows them to access the employer's customer network or trade secrets,

• The use of this information has the potential to cause significant harm to the employer,

• The ban must be reasonably limited in terms of duration (as a rule, a maximum of 2 years), geographical area (only the region where the company actually operates), and the subject matter of the business (only the area directly related to the business being conducted).

If a contract exists that meets these conditions, the provisions of the law of obligations regarding non-compete clauses and penalties come into effect. If the former employee breaches the contract by starting work for a competing firm or establishing a company in a similar field, the employer may demand the amount of the penalty stipulated in the contract without having to prove actual damages; if the damages exceed this amount, the employer may also claim the excess as compensation.

3. Unfair Competition under the Turkish Commercial Code (Articles 54-55)

Even without a non-compete clause in employment contracts, companies are not unprotected. Articles 54 and subsequent articles of the Turkish Commercial Code define commercial acts that violate the principle of good faith as unfair competition. According to Article 55 of the Turkish Commercial Code:

• Former employees contacting customers and slandering the company,

• The employee lures existing customers to their new company or a competitor they have an agreement with, using fraudulent or deceptive methods.

• Using production, cost, and price information that he obtained without authorization,

This constitutes direct unfair competition. The employer may request the commercial court to determine the nature of the action, to prohibit (stop) it, and to claim compensation for any resulting material and non-material damages, in accordance with unfair competition provisions.

What does this mean?

Even if an employee leaves the company, they cannot circumvent your established customer network and transfer it to themselves or a competitor; if the contract includes a non-compete clause, they will be obligated to pay predetermined hefty compensation (penalty clauses). Even without a specific clause in the contract, using your confidential data to entice your customers constitutes unfair competition, and they will be liable to compensate your company for all financial damages through legal action.

GDPR Obligations: Company Responsibilities in Employee-Related Data Leaks

The process of a former employee stealing data is not limited to the crime of disclosing trade secrets in the context of criminal law or non-compete clauses in the context of private law. If the stolen files contain customer information such as name, surname, phone number, address, Turkish national identity number, or email address, the matter falls directly under the scope of the Law No. 6698 on the Protection of Personal Data (KVKK), creating a serious legal liability for the company.

Company's Data Security Obligation (KVKK Article 12)

Article 12 of the Turkish Personal Data Protection Law (KVKK) obligates companies (data controllers) to prevent the unlawful processing and access of personal data. The defense, "I didn't allow the data to be stolen; my employee copied it to a flash drive on their own initiative and leaked it," is not legally valid. In the case of an internal data leak, the employer's responsibility stems from technical and administrative deficiencies such as failure to monitor corporate emails, lack of authorization matrices, leaving USB ports open, or not using cybersecurity software like DLP (Data Leakage Prevention). Such an employee-caused data leak constitutes a KVKK violation, and the company faces the risk of liable for financial and non-financial damages to its affected customers.

72-Hour Data Breach Notification Period

In the event of a data breach by an employee, the most critical emergency procedure that companies must follow is reporting the breach to the institution in accordance with Article 12/5 of the Personal Data Protection Law. According to the law, it is mandatory for the company to submit a formal "Data Breach Notification" to the Personal Data Protection Board within 72 hours at the latest from the moment the data breach is detected (learned about).

So how do you report a KVKK (Personal Data Protection Law) data breach ? Companies must submit a report to the Board by filling out the breach notification form on the official KVKK website, detailing when and how the incident occurred, which categories of personal data were stolen, how many people were affected, and what measures they took to stop the breach. During the same process, the relevant individuals (customers) whose data was stolen must also be notified directly or through appropriate means such as a website announcement.

Administrative Fines and Protection Strategy

Companies face administrative fines under the Personal Data Protection Law (KVKK) for data breaches if they fail to meet the 72-hour notification obligation or if the Board determines that the security measures taken are insufficient. These fines can amount to millions of Turkish Lira, depending on the company's annual turnover and the extent of the breach. When examining KVKK Board decisions regarding data theft cases, it is observed that companies that report the breach promptly and have previously provided their personnel with the necessary data security training and signed the required information texts are either not subject to administrative fines or the fines are kept at a minimum level.

What does this mean?

Even if an employee stole the data, the company cannot say "it's not my fault"; if you don't officially notify the state (KVKK) within 72 hours of discovering the leak, your company could face massive administrative fines amounting to millions of liras because of the employee. However, by securing your systems beforehand and managing the process transparently as soon as you discover the incident, you can largely protect yourself from these penalties.

Limits on Evidence Gathering in Company Computer and Corporate Email Investigations

When an employer suspects a former employee of copying data, the first step is usually to examine the employee's computer, company emails, and external storage activity. However, in criminal complaints filed with the prosecutor's office or in compensation lawsuits filed under the crime of disclosing trade secrets, the evidence presented must be obtained "legally." Evidence obtained illegally cannot be used as the basis for judgment in criminal or civil courts, and may expose the employer to charges under the Turkish Penal Code for "violation of the privacy of private life" (Article 134) and "violation of the confidentiality of communication" (Article 132).

Is it legal to review company emails? The limits of privacy.

One of the most frequently asked questions by employers is whether it is legal to monitor company emails and what the legal limits are for monitoring company-owned devices. According to the decisions of the Constitutional Court and the Supreme Court of Appeals, employers have the right to monitor the computers and corporate email accounts allocated to their personnel within the scope of their management rights and property rights.

However, the legitimacy of this oversight depends on certain conditions:

• Prior Notification Requirement: The employment contract signed by employees upon hiring, or the company's internal regulations, must clearly state that "computers and corporate email addresses may only be used for work-related purposes, and that the employer has the right to monitor these systems and review log records."

• Personal Communication Limits: The employer's monitoring authority is limited solely to work-related data. Examining personal email accounts (Gmail, Hotmail, etc.) or private messaging platforms like WhatsApp Web that are left open on a computer directly violates the employee's right to privacy and renders the collected evidence unlawful.

How to Collect Evidence in Data Theft Cases? Log Records and Computing Forensics

Internal data breaches often occur at the end of the workday or in the last few days before leaving the company. Employees who worry about whether sending files from a company computer to their personal email is illegal often send customer lists from their corporate email to their personal email or use portable hard drives.

For these actions to constitute conclusive evidence in court, the following technical and legal procedures must be followed:

1. Preserving the Chain of Evidence (Forensic Imaging): The computer of the suspected employee should be turned off, and company personnel should not tamper with the data on it. Amateurish file opening and closing operations can alter file access dates, compromising the evidentiary value. A "forensic copy" (a one-to-one image with hash values) of the disk should be created by expert forensic computer specialists.

2. Analysis of Log Records: Data theft log records are critically important as evidence . The date and time when which USB drive was plugged in, which files were copied, or the amount of data transferred from the server should be documented in a forensic computing report based on system logs.

3. Evidence Gathering Through Notary and Court Procedures: In order to prevent the deletion, destruction, or alteration of evidence, an urgent request for evidence gathering should be made to the duty court pursuant to Article 400 of the Code of Civil Procedure (HMK), or the relevant correspondence and screenshots should be officially documented through a notary.

What does this mean?

You are justified in gathering evidence when you have suspicions, but if you recklessly examine personnel's personal correspondence, the evidence you collect may be deemed invalid in court, and you could be found guilty; this process should be managed with a notary and a forensic IT expert, documented in a report that maintains the chain of evidence.

Managing the Legal Process for Companies Experiencing Business Data Theft

For a company, discovering that former employees have leaked data is a multifaceted crisis with operational, commercial, and legal dimensions. The question that arises in the employer's mind – "What should I do if an employee steals my data?" – can lead to irreparable damage to the company if the right steps are not taken. Managing this process requires not only prosecution under criminal law for the crime of disclosing trade secrets, but also the simultaneous and timely application of labor law, commercial law, and GDPR legislation.

1. The First 24-48 Hours: Crisis Protocol and Securing Evidence

The initial steps taken by company management the moment data theft is detected directly determine the course of future lawsuits:

• Access Reduction and System Isolation: All corporate email, VPN, server, and cloud access for the suspected employee should be immediately suspended; however, the accounts should absolutely not be deleted.

• Forensic Investigation: Computers should not be turned on and off by amateurs; images should be taken by authorized IT professionals without altering log records.

• Evidence Gathering Through Notary and Court Procedures: To prevent the concealment or alteration of evidence, an urgent evidence gathering process should be requested from the duty court, or digital records should be officially documented through a notary.

2. Coordinated and Simultaneous Legal Process

In times of crisis, legal proceedings must be conducted simultaneously on four fronts, not just one:

Legal Field	Action to be taken	Main Objective
Criminal law	A criminal complaint was filed with the prosecutor's office under Articles 239 and 136 of the Turkish Penal Code.	Punishment of the perpetrator and the use of official judicial investigative power.
Commercial Law	Unfair competition lawsuit with a request for a preliminary injunction.	The former employee's contact with customers must be immediately and legally terminated.
Labor Law	Termination for just cause, breach of duty of loyalty, and claim for penalty clause.	Compensation for contractual receivables and material damages.
Personal Data Protection Law (KVKK) Legislation	Notification to the Personal Data Protection Board within 72 hours.	Avoiding heavy administrative fines and corporate sanctions.

The separation of these processes can lead to significant losses of rights in other areas while achieving gains in one. For example, an email record illegally obtained in a criminal investigation could both lead to the dismissal of the case and expose the employer to criminal prosecution.

What does this mean?

Instead of panicking when customer data is stolen, a simultaneous and flawless legal strategy is implemented with the prosecutor's office, labor court, and data protection authority to fully protect your company's rights. A quickly implemented precautionary measure will prevent your customers from being contacted, while properly collected evidence will ensure the perpetrator faces sanctions in criminal court.

Protecting Your Company's Business Data and Having an Urgent Legal Action Plan

The theft of commercial data is a technical process situated at the intersection of criminal law, information technology law, labor law, and data protection legislation (KVKK). The biggest risk in this process is that the employer, while in the right, may be put in the wrong due to procedural errors.

Unauthorized examination of an employee's company computer may constitute a violation of privacy; a flash drive recording that has not been forensically imaged may lose its evidentiary value in court; or failure to report a violation to the Personal Data Protection Law (KVKK) within 72 hours may result in a direct administrative fine for the company. Therefore, the timely structuring of forensic IT procedures, the timely filing of requests for precautionary measures, and the presentation of the evidence chain to the court without disruption, as soon as suspicion of a trade secret violation arises, necessitate that the process be managed under the coordination of a competent legal professional.

Online Appointment Request

Frequently Asked Questions (FAQ)

Can a former employee face imprisonment for copying client lists?

Yes. Under Article 239 of the Turkish Penal Code, employees who copy or disclose trade secrets and customer data face 1 to 3 years of imprisonment. If personal data of individuals is involved, additional penalties of 2 to 4 years apply under Article 136.

Can corporate email accounts be reviewed to prove employee data theft?

Yes, provided the employer has notified employees beforehand through employment contracts or IT policies. Private personal mail accounts cannot be accessed, and evidence must be secured via certified digital forensics to maintain legal admissibility.

What is the statute of limitations for reporting trade secret disclosure?

Offenses under Article 239/1 of the TPC require a formal complaint. The employer must file the criminal complaint within 6 months from the date they discover the breach and identify the perpetrator.

Is it mandatory to notify the DPA (KVKK) if an employee steals client data?

Yes. If copied records contain personal data of individuals, the company must submit a formal data breach notification to the Personal Data Protection Authority within 72 hours of detection and notify affected data subjects.