GOING BEYOND CONTRACTS

In today’s digitized world, corporate will have to go an extra mile and be as innovative as possible to ensure protection of confidential information and prevent unauthorised acts by their personnel during the course of their employment. It is crucial for the IT and software companies to ensure that not only are they are covered through proper contracting but they also have an appropriate internal management

programme to ensure adherence of these contracts. Considering the intangible nature of confidential information and its economic value, it requires employers to put in place a safeguard system within their company. Apart from signing enforceable confidentiality and noncompete covenants with the employees, several other measures mentioned hereinafter necessitate consideration. n Companies need to explicitly identify the trade secrets and confidential information involved in each project. This needs to be followed by marking the documents as per their relevance. Some identifiers maybe ‘third party confidential’, ‘distribution to be limited to a certain department’, ‘make no copies’, etc. Such an identification and marking practice not only ensures that the information is handled in a confidential manner but also helps avoiding incurrence of any liability.

• An express communication with regard to confidentiality of information and data, as identified and marked, must be made to all employees deployed on the project. It is advisable to provide another list of information not covered by confidentiality obligations for better understanding of the internal users and stakeholders within an organization.
• Companies need to be judicious in granting access to confidential information. The number of employees accessing confidential information need to be limited and logs should be maintained for keeping record of access at any point in time.
• Employees need to be trained and regularly updated on information security guidelines and policy of the organization by the in-house counsels. Such training sessions need to be crafted and moderated uniquely for each internal department depending on the nature and extend of information handled by them. This allows establishment of a culture of information security within the organisation and makes the employees understand the legal consequences of any breach at an individual and organisational level. There is merit in meaningful background checks to be performed on employees.
• The information security guidelines’ education and training can be complimented by periodic tests and refresher modules for the employees. Conducting information security audits is recommended for organizations where business and clients are spread across jurisdictions.
• Establishing robust disciplinary process for any kind of breach works as an effective way of creating a culture of compliance within the organization. It also creates a deterrent and goes a long way in establishing company’s credibility.

Beyond regulatory sanctions, legal consequences, loss of goodwill and decline in market share, confidential information needs effective management as it adds to a competitive advantage. Trade secrets and confidential business information add to economic benefit and is critical for functioning of a company.

Managing confidential information has to be part of companies’ fundamental policies and not a onetime activity. Corporates should appreciate the potential costs and the implications of not having a strong confidential information management system. As business grows, well established rules and processes for development, management, distribution, protection and enforcement of confidential information need to be looked into proactively. Effective measures need to be adopted for establishing an ecosystem to administer confidential information in a manner such that it not only mitigates the risks of a breach and saves the company from potential damages but also adds to the credibility and brand value of the organization.