A former employee took confidential company data before leaving, what legal action can we take?

Question

An ex-employee downloaded client lists and trade secrets before resigning and is now using them for a competing business. I have been reading conflicting things online and I would like to understand what Indian law actually says about this, which Act and Section applies, what the realistic timelines and costs are, and what I should be doing right now to protect my position. If the matter can be resolved without litigation I would prefer that route, but I want to know what my rights are before I agree to anything or sign any document.

MyVakeel Legal Desk · Accepted Answer

A former employee took confidential company data before leaving, what legal action can we take? is governed in India primarily by Information Technology Act, 2000 – Section 72A, Information Technology Act, 2000 – Section 43 and Indian Contract Act, 1872 – Section 27 (restraint of trade, note limits). The short answer is set out below, followed by the practical steps most people in this situation need to take. Read it alongside the specific provisions named, because the exact relief available to you turns on the facts you can prove on paper.

Section 72A punishes disclosure of personal/confidential information obtained under a lawful contract without consent, with a breach causing wrongful loss punishable by up to 3 years imprisonment or fine up to Rs 5 lakh, or both.

Section 43 read with Section 66 covers unauthorised copying/extraction of data from a computer system, entitling the company to compensation and enabling a criminal complaint for hacking/data theft.

While non-compete clauses post-employment are largely unenforceable in India under Section 27 of the Contract Act, confidentiality/non-disclosure obligations survive termination and can be enforced through injunction.

File a civil suit seeking an injunction restraining use of the stolen data/trade secrets and damages, alongside a criminal complaint for a quicker deterrent and evidence-gathering via police investigation.

Preserve access logs, device audit trails, and the employment contract's confidentiality clause as key evidence before initiating action.

What to do next: 1) Audit system logs to identify what data was accessed/downloaded and when; 2) Send a cease-and-desist legal notice invoking the confidentiality clause; 3) File a civil suit for injunction and damages, and a criminal complaint under Section 72A; 4) Preserve all digital forensic evidence with a certified forensic examiner.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — most remedies under Information Technology Act, 2000 – Section 72A carry limitation periods, and a delay you cannot explain weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in this practice area.