Trade secrets in Cyprus: legal criteria and practical protection

Apply the legal test to specific information

Cyprus Law 164(I)/2020 implements the EU trade-secrets framework. Its definition requires secrecy in the relevant professional or commercial circles, commercial value because of that secrecy and reasonable efforts by the lawful controller to preserve it in the circumstances. These conditions work together. Information does not qualify merely because it is useful, expensive to develop or described as confidential in a standard footer.

Identify the particular information rather than claiming that the whole business is a secret. A non-public technical process, a detailed pricing model or a combination of operational information may warrant examination. Explain what is not generally known or readily accessible and why secrecy matters commercially. A broad statement that competitors would find the business interesting does not identify the protected material.

Distinguish the secret from public inputs or general expertise used to create it. A model may contain publicly available market prices alongside non-public assumptions or methods. Record which part of the combination is claimed to be secret and the basis for that position. This precision helps both everyday handling and later professional assessment if misuse is suspected.

Basis and guidance: Cyprus Law 164(I)/2020: consolidated trade-secrets legislation; European Commission IP Helpdesk: trade secrets

Create a focused register without exposing the secret itself

Prepare an internal schedule identifying the information, business owner, controlled location, relevant versions and reasons for protection. The schedule should help authorised staff recognise what requires care without reproducing the secret in a widely circulated spreadsheet. Use a reference to the protected material and restrict access to the schedule where its contents would themselves reveal sensitive commercial details.

Identify how the organisation obtained lawful control. Information developed by founders, employees, contractors or a joint project may raise different ownership and contractual questions. An invoice for development work does not necessarily explain all rights in the resulting materials. Keep the relevant agreements and provenance records available and resolve uncertainty before promising unrestricted rights to an investor or buyer.

Prioritise the information whose exposure would matter most to current operations. A short, maintained list with clear controls can be more useful than a classification system that marks every document equally sensitive. Review entries when information becomes public, is replaced or loses its commercial relevance. Protection arrangements should reflect the actual information lifecycle rather than accumulate indefinitely without a responsible owner.

Document reasonable protection in the actual working environment

The legal requirement concerns reasonable measures in the circumstances. Select controls that fit the information’s value, exposure and use, and retain evidence that they operate. A policy may explain the intended approach, but access permissions, approved sharing and completed reviews show how it is applied. Do not assume that buying a security product proves the relevant files were protected by it.

Check shared folders, external links, repository permissions and former collaborator accounts. Identify who needs access for a current task and how that access is removed when the task ends. Where technical restrictions are impractical, assess other proportionate handling measures and document their limits. The objective is a coherent approach to preserving secrecy rather than an absolute promise that no disclosure can ever occur.

Use the following table as a practical evidence map. It is not a statutory guarantee that an item qualifies as a trade secret. If a control exists only on paper, assign the implementation and verification work rather than listing it as complete. The organisation should be able to explain what was protected, by whom and through which working arrangements.

Basis and guidance: Cyprus Law 164(I)/2020: consolidated trade-secrets legislation

Use NDAs alongside controls and a defined sharing purpose

An NDA can establish confidentiality and use obligations, but its value depends on how it applies to the disclosure and recipient. Identify the parties, the information or categories covered and the permitted purpose. Distinguish permission to examine material for a defined project from permission to reuse it in unrelated products or share it with other organisations. Obtain appropriate drafting advice for the actual relationship.

Keep an understandable record of what was disclosed and under which arrangement. A signed agreement stored separately from an uncontrolled stream of attachments may leave uncertainty about the material involved. Use appropriate references or a disclosure schedule where helpful. Avoid placing the secret into a public contract attachment merely to make the definition more detailed.

Check whether the receiving organisation needs advisers, employees or subcontractors to see the information and how their access is controlled. Agree a practical process for further disclosure and for returning or deleting material when the purpose ends. Do not treat an NDA as a substitute for deciding whether the recipient needs the full information in the first place.

Handle employee and contractor access without claiming ordinary skills

Cyprus law expressly preserves employee mobility and the use of experience and skills lawfully acquired in the normal course of employment. A trade-secret programme should not label all professional knowledge as company property or imply that a departing worker cannot use general expertise. Identify the specific protected information and obtain advice on any separate contractual restrictions rather than assuming the trade-secrets statute supplies a general non-compete.

Give people practical handling instructions relevant to their work. Explain which repositories or documents contain restricted material, which channels may be used and whom to ask before sharing. A general induction statement is less useful if the employee cannot identify the actual files involved. Apply the same operational clarity to contractors and temporary collaborators with access to sensitive projects.

At departure, review access, devices, shared credentials and project handover through a lawful process. Preserve necessary records without indiscriminately collecting personal information or accusing someone of misuse solely because they are leaving. Record completed access changes and outstanding return arrangements. If there is a specific concern, separate the factual investigation from routine offboarding and involve appropriate advisers.

For proportionate handling of personnel information, see the employee-data guide.

Basis and guidance: Cyprus Law 164(I)/2020: consolidated trade-secrets legislation

Recognise lawful discovery and protected disclosures

The statute recognises lawful independent discovery or creation. It also addresses observation, study, disassembly or testing of publicly available or lawfully possessed products where the relevant person is not subject to a legally valid restriction on obtaining the secret. Therefore, the appearance of a similar competing product does not by itself establish unlawful acquisition. The route by which information was obtained matters.

The framework also preserves legally required or permitted disclosures and contains safeguards for expression, information and relevant public-interest disclosures. A confidentiality label cannot automatically prohibit a person from reporting wrongdoing or complying with a lawful disclosure obligation. Assess the actual circumstances and applicable protections before treating a disclosure as actionable misuse.

Ensure internal reporting procedures do not contradict those safeguards. Staff should know how to raise a concern without being told that every reference to business information is forbidden. The trade-secret assessment and the handling of a protected report are distinct questions, even where they involve some of the same material. Do not use a secrecy programme to conceal matters the organisation is required to disclose.

Coordinate those arrangements with the whistleblowing-channel guide.

Basis and guidance: Cyprus Law 164(I)/2020: consolidated trade-secrets legislation; European Commission: trade-secrets framework and safeguards

Control disclosure during pitches, collaborations and due diligence

Before a demonstration or commercial discussion, decide what can be shown publicly and what requires restricted access. A pitch may explain a product’s value without exposing every implementation detail. Prepare an approved version and identify who can authorise deeper disclosure. This reduces the risk of discovering after a presentation that a supposedly secret process was included in an unrestricted slide deck.

For an investment or acquisition review, stage access according to the purpose and progress of the transaction. Keep the recipient list, permitted use and documents provided traceable. If advisers or prospective partners need additional detail, assess that request specifically rather than granting blanket access to the whole operational repository. Record the limitations of any summary so that it does not misrepresent what was reviewed.

Consider the recipient’s identity and role before sharing. A familiar brand, group name or email domain does not always identify the legal party bound by the agreement. Confirm the contracting entity and the people authorised to receive the information. Keep those checks proportionate to the disclosure and preserve the relevant explanation where several entities participate.

Establish the counterparty through the company-search and due-diligence guide.

Preserve facts and seek a proportionate response to suspected misuse

If information appears to have been accessed or disclosed improperly, preserve the original evidence and a chronology. Identify the material, relevant permissions, event times and how the concern arose. Restrict further access where appropriate through authorised processes. Do not alter logs or overwrite documents to create a cleaner story; distinguish confirmed events from an inference that still needs investigation.

Ask suitable legal and technical professionals to assess whether the material qualifies, whether the acquisition, use or disclosure was unlawful and which response is proportionate. Cyprus law provides civil measures and remedies subject to conditions and safeguards. An allegation does not guarantee an injunction or damages. Timing, evidence and the risk of further disclosure can matter, so obtain advice promptly rather than relying on a generic limitation-period calculation.

If the material also contains personal data, assess that aspect separately. A commercially sensitive customer file can raise both trade-secret and data-protection questions. The fact that the business wants to keep the file secret does not answer whether individuals face a risk or whether notification duties arise. Coordinate the work while retaining the distinct reasoning for each assessment.

For the personal-data aspect, follow the breach-response workflow.

Basis and guidance: Cyprus Law 164(I)/2020: consolidated trade-secrets legislation

Worked example: a non-public pricing model shared with a partner

Assume a Cyprus business has a pricing workbook containing public market inputs, its own non-public weighting method and negotiated supplier terms. Before sharing it with a prospective partner, identify which information is actually claimed to be secret and why. Public input figures should not be described as proprietary solely because they appear in the workbook. The combination and non-public elements require a specific assessment.

The business might provide a limited demonstration first and disclose a controlled copy only for an agreed evaluation purpose. Record the version, authorised recipient and applicable restrictions, and check that the shared link does not permit unrestricted onward access. These measures support a practical protection file, but the legal conclusion still depends on the actual information and circumstances.

If the partner later launches similar prices, that fact alone does not establish copying or misuse. Preserve the evidence of disclosure and examine what is known about the later conduct. Independent development, public market conditions and the contractual arrangements may all be relevant. A reasoned investigation should identify the claimed information and alleged conduct rather than infer liability from commercial disappointment.

Review protection when the information or business changes

Revisit the register after product releases, staffing changes, collaborations and changes in storage or sharing tools. Information that was once secret may become publicly available, while new methods or commercial terms may need protection. Make updates specific to the material and the actual access arrangements. A historic NDA should not be treated as a complete review of every later disclosure.

Test the process with a safe scenario: can a team member identify a restricted file, request authorised access and share an approved version without exposing additional material? Check whether departure reviews remove obsolete permissions and whether external links have the intended restrictions. Record gaps and verify the corrective work rather than treating a training invitation as proof of completion.

Keep the protection file usable for authorised management and professional advisers while avoiding unnecessary circulation of the secret itself. The business should be able to explain its claim, show the measures used and recognise the limits of protection. Zeno can coordinate independent professional support where the classification, agreement or suspected misuse requires a case-specific legal assessment.

Primary sources and scope

Sources checked: September 27, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Cyprus Law 164(I)/2020: consolidated trade-secrets legislation
• European Commission IP Helpdesk: trade secrets
• European Commission: trade-secrets framework and safeguards

Practical guides for this topic

• Non-compete clauses in Cyprus employment: section 27 and alternatives

  Cyprus employer guide to Contract Law Cap.149 section 27, post-employment restraints, parallel work under Law 25(I)/2023, confidentiality and practical exit controls.