Trade secret protection in Spain depends on something many companies never document: under Law 1/2019 on Trade Secrets, information only qualifies as a trade secret if it is secret, has business value because it is secret, and has been the subject of reasonable measures to keep it secret. Without those measures there is no secret to defend, and once you learn who took it you have three years to act. This guide is for technology, AI and industrial companies that rely on source code, models, formulas, pricing or customer data they have not patented.
Key takeaways
- Article 1 of Law 1/2019 sets three cumulative conditions; the third, reasonable measures, is the one owners most often cannot prove.
- Reverse engineering of a product lawfully on the market and independent discovery are lawful (Article 2), so secrecy must be protected by contract and practice, not assumed.
- Civil actions prescribe three years after the holder learns who committed the violation (Article 11).
- Spanish courts can declare information confidential and restrict access to documents and hearings (Article 15), but you must ask.
- Before the Unified Patent Court (UPC), the Court of Appeal held on 18 March 2026 that business information handed to the other side without a confidentiality order lost its protected status.
What counts as a trade secret under Spain’s Law 1/2019?
Law 1/2019 of 20 February on Trade Secrets (Boletín Oficial del Estado, BOE, 21 February 2019, in force since 13 March 2019) transposed the EU Trade Secrets Directive into Spanish law. Article 1 protects any information or knowledge, whether technological, scientific, industrial, commercial, organisational or financial, that meets three conditions:
- It is secret: not generally known among, or readily accessible to, people in the circles that normally deal with that kind of information.
- It has business value, actual or potential, precisely because it is secret.
- Its holder has taken reasonable measures to keep it secret.
Two limits matter in practice. Article 1(3) states that trade secret protection cannot restrict employees’ use of experience and skills honestly acquired during their careers. And Article 2 treats as lawful the independent discovery of the same information and the observation, study, disassembly or testing of a product made available to the public, unless a valid obligation prevents it. A competitor that buys your device and takes it apart has not infringed anything unless a contract said otherwise.
What are “reasonable measures”? A practical checklist
The law does not list them. What courts look at is whether the holder behaved as someone who wanted the information to stay secret, in proportion to its value. Article 9(3) also tells judges to weigh “the measures adopted for its protection” when deciding what remedies to grant, so weak measures can cost you even when you win. In our experience the evidence that persuades is documentary and dated. The checklist below is our recommendation, not a legal list:
| Area | Measure | Evidence it leaves |
|---|---|---|
| Inventory | Identify which information is a secret and who owns it (code repositories, model weights, training datasets, formulas, supplier terms) | A dated register reviewed at least yearly |
| Labelling | Mark documents and folders as confidential, with a short policy explaining the label | Labelled files and the policy itself |
| Access control | Need-to-know permissions, strong authentication, logging of downloads and exports | Access lists and system logs |
| Employees | Confidentiality clauses, training and a written policy on the use of generative AI tools | Signed contracts, training records |
| Third parties | Non-disclosure agreements (NDAs) before sharing, with purpose limits and return or deletion obligations | Signed NDAs and a log of what was disclosed |
| Departures | Exit interviews, device return, revocation of access, reminder of continuing duties | Signed exit checklist |
| Litigation and audits | No disclosure to courts, authorities or counterparties without a prior confidentiality request or order | Applications and orders on file |
The last row is the one most often forgotten, and it is where the UPC case below comes in.
What can you claim if a trade secret is taken?
Article 3 defines the violation: unauthorised access to or copying of documents or files containing the secret, any other conduct contrary to honest commercial practice, and use or disclosure in breach of a confidentiality agreement. Producing or selling “infringing goods” that significantly benefit from a misappropriated secret is also unlawful use.
The civil remedies in Article 9 include a declaration of infringement, an injunction, a ban on making or selling infringing goods, their seizure and recall, delivery up of the documents and files that contain the secret, damages and publication of the judgment. Damages under Article 10 can reflect lost profits, the infringer’s unjust enrichment and moral damage, or a lump sum based on a hypothetical licence fee.
Procedurally, the Commercial Court (Juzgado de lo Mercantil) of the defendant’s domicile, or of the place of infringement or its effects, has jurisdiction (Article 14). Before suing you can ask for fact-finding measures (diligencias de comprobación, Article 17), access to sources of evidence (Article 18) and evidence preservation (Article 19), and interim measures such as stopping use or disclosure, retaining infringing goods or freezing assets (Article 21). Since 3 April 2025, the main civil claim also requires a prior attempt at negotiation under Organic Law 1/2025, although pre-action interim measures do not.
The Spanish Criminal Code punishes taking data or documents to discover a trade secret with two to four years’ imprisonment, rising to three to five years if it is disclosed (Article 278), and disclosure by someone bound to secrecy with two to four years (Article 279). Under Article 287 these offences generally require a complaint by the injured party.
The UPC confidentiality trap: disclose once, lose it
Spain does not participate in the UPC, but Spanish companies litigate there whenever their products reach participating states. In EOFlow v Insulet (UPC_CoA_930/2025), the Court of Appeal dismissed an appeal on 18 March 2026 against a Milan Central Division order. EOFlow had been ordered to provide information on the extent of its infringing acts and had produced contracts, invoices, turnover and prices, asking only that the public be kept out of the file under Rule 262.2 of the Rules of Procedure (RoP).
As Hoffmann Eitle summarised on 29 April 2026, the court drew a sharp line between Rule 262.2 (restricting public access) and Rule 262A (restricting the other party’s access and use), and found no implicit rule that confines information to the litigation. Information disclosed to Insulet without a Rule 262A order, an agreement or an undertaking was no longer a trade secret (see also the Osborne Clarke case summary). The lesson reaches beyond the UPC: in any proceeding, ask for protection before you file.
What this means for your business
- Map your secrets: list the information that would hurt you if a competitor had it, and decide which is better patented and which is better kept secret.
- Document the measures in the checklist, especially for code, models and datasets that move between teams and vendors.
- Align contracts across the corridor: NDAs, employment and supplier terms should work in Spain and in the Latin American and African countries where you share information.
- Prepare a response plan: who preserves evidence, who calls counsel and which court measures to request in the first days.
- Build confidentiality requests into every dispute plan, including UPC, arbitration and regulatory proceedings.
If you need these measures reviewed or a misappropriation case prepared, our trade secret protection and IP litigation team can audit the evidence and plan the action. Where secrets sit in AI models or training data, our AI and digital assets practice works alongside, and within the same group META Channel covers the AI Act and GDPR side.
Where companies get trade secret protection wrong
- No proof of measures. Policies exist in theory, but nothing dated shows who had access or what was labelled.
- Letting the clock run. Three years from knowing the infringer passes quickly while internal investigations drag on.
- Over-broad employee restrictions. Clauses that try to stop staff using general skills clash with Article 1(3) and weaken the whole contract.
- Disclosing in litigation without an order. Producing documents with only a public-access request can forfeit protection, as EOFlow found.
- Uncoordinated advisers. Different firms handling employment, contracts and litigation rarely keep one consistent record of measures.
Frequently asked questions
How long do I have to sue for trade secret misappropriation in Spain?
Article 11 of Law 1/2019 sets a three-year limitation period, counted from the moment the holder learned who committed the violation, and it can be interrupted on the general grounds in the Civil Code. Since April 2025, sending a proper request to negotiate under Organic Law 1/2025 also interrupts prescription, which matters when you need time to prepare the claim.
Do I need to register a trade secret in Spain?
No. There is no registry for trade secrets. Protection arises when the three conditions in Article 1 are met, which is why evidence of reasonable measures is so important. Some companies deposit dated descriptions with a notary or a timestamping service to prove what they held and when, but that does not replace confidentiality measures.
Can an ex-employee use what they learned at my company?
They can use the general experience and skills honestly acquired during their career, which Article 1(3) protects. They cannot take, use or disclose specific information that qualifies as a trade secret, such as source code, customer lists with pricing or technical files. Clear contracts and exit procedures make that line easier to prove in court.
Can IP Global Guard handle a trade secret dispute for my company?
Yes. We audit your reasonable measures, prepare evidence, coordinate pre-action and interim measures before the Spanish courts and manage confidentiality requests in any related proceeding. Where the dispute extends to Latin America or Africa, we coordinate qualified local correspondents so you keep one strategy and one point of contact.
How IP Global Guard protects your confidential know-how
A trade secret is won or lost long before the claim: in the register of secrets, the contracts and the confidentiality requests made at the right time. IP Global Guard, the IP services line of META Channel Corporation Limited, handles audits, licences and disputes with one strategy and one billing relationship across more than 25 jurisdictions; see our coverage in Europe, Latin America and Africa.
Tell us which information you need to protect and where it travels, or share the facts of a suspected leak. We will check your measures against Law 1/2019 and propose the next steps. Contact our team to review your trade secret protection.
This article is general information, not legal advice, and does not replace an assessment of your specific case.
Sources
- BOE, Law 1/2019 of 20 February on Trade Secrets (published 21 February 2019)
- BOE, Organic Law 1/2025 of 2 January on the efficiency of the Public Justice Service (in force 3 April 2025)
- BOE, Spanish Criminal Code, Organic Law 10/1995 (consolidated text), Articles 278-280 and 287
- Hoffmann Eitle, UPC case review: EOFlow v Insulet, UPC_CoA_930/2025 (29 April 2026)
- Osborne Clarke, UPC decisions: EOFlow v Insulet, Court of Appeal order of 18 March 2026
