- Trade secrets now expressly cover “data” and “algorithms”: the 2026 Rules bring source code, models and customer datasets inside protection.
商业秘密现已明确涵盖”数据”与”算法”：源代码、模型与客户数据集被纳入保护范围。- The 2026 Trade Secret Protection Rules (SAMR Order No. 126, effective 1 June 2026) list eight reasonable confidentiality measures, including access tiers, data masking and audit logs.
2026年《商业秘密保护规定》（市场监管总局令126号，2026年6月1日施行）列举八类合理保密措施，含权限分级、数据脱敏与操作日志留痕。- “Corresponding” measures—not perfect ones—suffice; they must match the information’s nature, value and carrier.
采取”相应”保密措施即可，不要求万无一失；措施须与信息性质、价值、载体相匹配。- Electronic intrusion and over-right downloads are now named “improper means” for obtaining secrets.
“电子侵入”与超权限下载被明确列为获取商业秘密的”不正当手段”。- Penalties run from 100,000 yuan up to 5,000,000 yuan, with criminal referral for serious cases; punitive damages of 1x–5x apply in litigation.
行政处罚由10万元至500万元，情节严重的移送刑事；诉讼中可适用一倍以上五倍以下惩罚性赔偿。- A Chinese FIE should lock NDAs, access control, departure procedures and digital forensics before a leak, not after.
外资企业应在泄密前而非泄密后，固化保密协议、访问控制、离职程序与数字取证。
Trade Secret Protection for Foreign Firms in China: Confidentiality Measures, NDAs and Enforcement under the 2026 Rules | 外资企业商业秘密保护：2026新规下的保密措施、保密协议与维权
Why Trade Secrets Matter More After 2026
For a foreign-invested enterprise, the most valuable intangible assets are often not patents or trademarks but trade secrets—source code, algorithms, formulas, customer lists, pricing and strategy. China’s framework rests on the Anti-Unfair Competition Law (revised 2025, effective 15 October 2025) and is now sharpened by the Trade Secret Protection Rules (商业秘密保护规定), SAMR Order No. 126, promulgated on 24 February 2026 and effective 1 June 2026. The Rules replace the 1995 interim provisions and, for the first time, explicitly bring “data” and “algorithms” within the protected scope of technical information.
What Counts as a Trade Secret
A trade secret is commercial information—technical or business—that is not generally known, has commercial value, and over which the right holder has taken corresponding confidentiality measures. Technical information includes structure, raw materials, formulas, processes, methods, data, algorithms, computer programs and code; business information includes ideas, management, sales, finance, plans, samples, customer information and data. Failed experiments and interim results can qualify. The “not generally known” test is judged at the time of the alleged infringement, not with hindsight.
The Eight Reasonable Measures
The 2026 Rules enumerate eight categories of reasonable confidentiality measures, giving handlers a practical checklist:
- confidentiality agreements (NDAs) with employees, partners and recipients;
- personnel management—onboarding, rotation and departure controls;
- physical isolation—restricted areas, locked storage;
- technical protection—access tiers, data masking, operation-log retention;
- carrier management—labelling, registration, encryption of documents and devices;
- device control—USB, printing, screenshot and outward-transfer restrictions;
- departure management—hand-back, deactivation, post-employment restraint;
- other measures suited to the information.
The legal test is “corresponding” (相应), not “perfect”: measures must be identifiable and proportionate to the secret’s nature, value and carrier.
Improper Means, Expanded
The Rules name specific improper means of obtaining a secret, including theft, bribery, fraud, coercion, electronic intrusion, and ultra-term or ultra-right downloading—unauthorised entry into digital office systems, servers, mail, cloud or application accounts, or exploiting vulnerabilities. They also cover disclosure or use in breach of a confidentiality obligation, inducement to infringe, and third parties who knowingly acquire, disclose or use an illicitly obtained secret. Statutory safe harbours remain: independent discovery, reverse engineering of publicly available products, and disclosure to expose illegality or protect national security.
Administrative Enforcement and Penalties
A right holder may report to the market regulation department with preliminary evidence and leads. The authority may inspect, interrogate, copy, seal and seize, and query bank accounts. Where the allegedly infringing information is substantially identical to the secret and the respondent had access, infringement may be found unless rebutted. Penalties: cease the act, confiscate unlawful gains, and a fine of 100,000 to 1,000,000 yuan; for serious cases, 1,000,000 to 5,000,000 yuan. “Serious” includes large direct loss, major disruption to the right holder’s operations, harm to national or public interest, or a repeat offence within two years. Criminal referral follows for suspected crimes.
Litigation and Punitive Damages
In court, the Supreme People’s Court’s Interpretation on Punitive Damages for IP Infringement (法释〔2026〕7号, effective 1 May 2026) lets a plaintiff seek 1x–5x damages where infringement is intentional and serious. Deliberate trade-secret misappropriation by a competitor is expressly covered. Where the defendant refuses to produce books and records without cause, the court may fix the base on the plaintiff’s claim and evidence. For a foreign firm, the practical lever is the same as for administrative action: a documented, “corresponding” confidentiality program turns a weak claim into an enforceable one.
A Pre-Leak Compliance Program for a China FIE
- Classify secrets by value and sensitivity; label and register carriers.
- Tier access by role; mask and log; disable high-risk outbound channels for crown-jewel data.
- NDAs everywhere—employees, contractors, JV partners, acquirers—with clear scope and remedies.
- Departure protocol: hand-back, access revocation, and a post-employment reminder of obligations; watch “secret-poaching” and malicious raiding.
- Forensic readiness: retain logs and access records so a leak can be traced and proven.
- Cross-border caution: moving a secret offshore can itself trigger data-export and important-data questions—clear it through the data-compliance gate first.
Related Reading
See our copyright and trade secrets overview (No. 31), software copyright registration (No. 183) and foreign-related dispute resolution (No. 39).
外资企业商业秘密保护：2026新规下的保密措施、保密协议与维权
为何2026年后商业秘密更重要
对外资企业而言，最有价值的无形资产往往不是专利或商标，而是商业秘密——源代码、算法、配方、客户名单、定价与战略。中国制度以《反不正当竞争法》（2025年修订，2025年10月15日施行）为基，并因《商业秘密保护规定》（市场监管总局令126号，2026年2月24日公布、2026年6月1日施行）而 sharpened。该规定取代1995年暂行办法，首次明确将“数据”与”算法”纳入技术信息的保护范围。
何为商业秘密
商业秘密是不为公众所知悉、具有商业价值、经权利人采取相应保密措施的商业信息（技术或经营信息）。技术信息含结构、原料、配方、工艺、方法、数据、算法、计算机程序、代码；经营信息含创意、管理、销售、财务、计划、样本、客户信息与数据。失败的实验与阶段性成果亦可受保护。”不为公众所知悉”以涉嫌侵权行为发生时为准，不作事后倒推。
八类合理保密措施
2026年规定列举八类合理保密措施，为企业提供实操清单：
- 与员工、合作伙伴、接收方签订保密协议（NDA）；
- 人员管理——入职、轮岗、离职控制；
- 物理隔离——限制区域、上锁保管；
- 技术防护——权限分级、数据脱敏、操作日志留痕；
- 载体管理——标注、登记、文档与设备加密；
- 设备管控——U盘、打印、截屏与对外传输限制；
- 离职管理——交还、停用、离任后约束；
- 其他与信息相适应的措施。
法律标准为”相应”而非”完美”：措施须可识别，并与秘密的性质、价值、载体相称。
不正当手段的扩张
规定明确列举获取商业秘密的不正当手段，包括盗窃、贿赂、欺诈、胁迫、电子侵入、超期或超权限下载——擅自进入数字化办公系统、服务器、邮箱、云盘、应用账户，或利用漏洞攻击。亦涵盖违反保密义务披露或使用、教唆引诱侵权，以及明知系非法取得仍获取、披露、使用的第三人。法定安全港仍保留：独立研发、对公开产品的反向工程、为揭露违法或维护国家安全而披露。
行政执法与处罚
权利人可凭初步证据与线索向市场监督管理部门举报。监管机关可检查、询问、复制、查封扣押、查询银行账户。在案信息与被主张秘密实质相同且被举报人有获取条件的，可认定侵权，除非其举证反驳。处罚：责令停止、没收违法所得，并处10万元至100万元罚款；情节严重的处100万元至500万元。情节严重者含权利人直接损失较大、对其生产经营造成重大不利影响、危害国家或公共利益，或两年内再犯。涉嫌犯罪的移送刑事。
诉讼与惩罚性赔偿
在司法中，最高人民法院《关于审理侵害知识产权民事纠纷案件适用惩罚性赔偿的解释》（法释〔2026〕7号，2026年5月1日施行）允许原告在故意且情节严重时请求一倍以上五倍以下赔偿。竞争对手故意窃取商业秘密明确覆盖在内。被告无正当理由拒不提供账册的，法院可依据原告诉请与证据确定基数。对外资企业，抓手与行政维权相同：有文档、有”相应”措施的保密体系，能把薄弱主张变为可执行权利。
外资企业的泄密前合规方案
- 按价值与敏感度分级秘密，标注并登记载体。
- 按角色分级权限，脱敏并留痕；对核心数据禁用高风险外传通道。
- 处处签NDA——员工、承包商、合资伙伴、收购方——明确范围与救济。
- 离职程序：交还、停用权限、提醒离任后义务；警惕”携密跳槽”与恶意挖角。
- 取证准备：留存日志与访问记录，使泄密可回溯、可证明。
- 跨境审慎：将秘密传出境外本身可能触发数据出境与重要数据问题——先经数据合规闸门。
延伸阅读
可参阅本站著作权与商业秘密总览（编号31）、软件著作权登记（编号183）与涉外争议解决（编号39）。
Sources