Responding to a departing employee who took information

When an employee leaves for a competitor and the company suspects information went with them, the response should be sequenced and fast.

Preserve. Image the departing employee’s laptop and phone before reissuing them, and suspend deletion on their mailbox and file shares. Reimaging a device destroys the evidence that would prove the case.

Analyse. Forensic review of USB device connections, cloud sync activity, downloads and email forwarding in the weeks before resignation. Patterns matter more than individual files.

Review the paperwork. Confidentiality agreement, assignment of inventions, restrictive covenants and their governing law, the employee handbook acknowledgement, and any equity or bonus documents with forfeiture terms.

Communicate carefully. A letter to the former employee and to the new employer reminding them of the obligations, sent promptly, preserves remedies and puts the new employer on notice for aiding and abetting purposes. It should be accurate and measured, because an overstated letter supports a tortious interference counterclaim.

Decide about injunctive relief quickly. Delay undercuts irreparable harm, and a company that waits three months to move is met with its own timeline.

Consider proportionality. Litigation against a departing employee is visible, affects morale, and can publicise the very information at issue. Sometimes an agreed protocol with the new employer achieves more.