Oplon Secure Access 12.4.0 is out Update →

ARTICLE BLOG

The Protection of Trade Secrets

Data Protection and Trade Secrets

In recent years, the GDPR has highlighted the need to protect personal data, requiring organizations to adopt adequate and demonstrable security measures. However, an equally important but less-discussed issue concerns the protection of trade secrets—such as know-how, processes, algorithms, and strategies—which constitute a company’s true competitive advantage. European legislation, in particular EU Directive 2016/943, transposed in Italy by Legislative Decree No. 63/2018, and Article 98 of the Industrial Property Code (CPI), recognizes the protection of trade secrets only if three cumulative conditions are met:

the information must be secret
it must have economic value by virtue of being secret
reasonable measures must be taken to keep it secret

It is not sufficient for the information to be confidential: it must be actively protected through concrete and verifiable controls. As also highlighted in case law, insufficient security measures can compromise the very legal protection of the trade secret.

Cybersecurity as a Legal Requirement

Cybersecurity regulations go beyond general principles or contractual tools such as NDAs and confidentiality clauses; they require the implementation of concrete technical and organizational measures.

The GDPR (Art. 32) requires the adoption of appropriate technical and organizational measures, including, as applicable, encryption, access control, and the ability to ensure data availability.
The NIS2 Directive requires advanced controls for critical and important entities, including segmentation, continuous monitoring, identity management, and activity logging.

Only by adopting these measures can organizations demonstrate, even in court, the adequacy of the protection implemented.

“If you don’t protect your secrets, you can’t defend them”

The problem: protection is not automatic

The protection of trade secrets is not automatic. Italian case law takes a strict approach: it is not sufficient to demonstrate the theft or unauthorized use of the information; rather, it is necessary to prove the existence of effective protective measures. In the absence of such measures, even information of high economic value may lose the legal protection provided for in Articles 98 and 99 of the Industrial Property Code. The focus thus shifts from “data theft” to the quality of the protection system implemented.

When the measures are deemed adequate

In the absence of such measures, even information of high economic value may lose the legal protection provided for in Articles 98 and 99 of the Industrial Property Code. The focus therefore shifts from “data theft” to the quality of the protection system implemented. For example, the Court of Bologna (Judgment No. 2140/2024) emphasized the importance of access tracking, user profiling, and archiving on company servers with individual authorizations. Similarly, the Court of Brescia (judgment no. 2247/2025) deemed measures such as strong authentication, access segmentation, and advanced protection of communication systems to be adequate. In such cases, the integration of technical and organizational controls proved decisive for the recognition of trade secret protection.

When protection is denied

Conversely, protection was denied where security measures were insufficient or merely formal.

The Court of Turin (Judgment No. 3934/2025) noted that the ability to export data to external devices without tracking, the absence of access controls, and permissive practices precluded the existence of adequate security measures.

In another case, the Turin Court of Appeals (Judgment No. 1042/2024) also denied protection due to a lack of documentary evidence, in the absence of signed NDAs, effectively enforced policies, and verifiable control systems.

The crux of the matter: proof of security

The real critical factor is not just the security measures implemented, but the ability to demonstrate them. In a legal setting, the company must be able to accurately reconstruct who accessed what, when, and with what privileges. In this context, logs, authentication systems, and tracking mechanisms serve not only a technical function but also an evidentiary one. In the absence of such evidence, even formally secure infrastructures prove ineffective from a legal standpoint.

The gap between claimed security and demonstrable security

Many organizations still rely on models based on VPNs or perimeter controls, which do not provide granular control over individual resources. This creates a gap between perceived security and demonstrable security: the company may believe it is protected, but may not be able to prove it in the event of a dispute. It is precisely this discrepancy that case law is increasingly highlighting, favoring models based on Zero Trust, identity, and continuous access control.

The sectors most at risk

All industries with sensitive information to protect, such as:

Advanced manufacturing: technical drawings and process specifications
Pharma and biotech: formulas and clinical protocols
Finance and private equity: M&A dossiers and valuation models
Automotive and aerospace: embedded software and supply chain mapping
Fashion and luxury: patterns and prototypes
Other sectors: energy, chemicals, food & beverage

The common criterion: if information is valuable precisely because competitors do not know it, it falls within the scope of trade secrets to be protected.

Oplon Networks' Solution: OSA Secret

OSA Secret is a use case of Oplon Secure Access, a Zero Trust platform for the secure management of access to corporate resources. In this scenario, in addition to identity- and context-based controls, advanced features for the protection of trade secrets are introduced. Before accessing resources, the user may be required to accept a digital NDA and a privacy notice, making the contractual obligation traceable. The system also applies watermarks and session identifiers, along with complete, tamper-proof activity logging. In this way, OSA Secret extends the Zero Trust paradigm by integrating access security with the ability to protect and provide evidence of confidential information.

Tangible benefits

The solution significantly reduces the attack surface and provides a complete audit trail of operations.

Each session is tracked in detail through tamper-proof logs, providing full visibility into who accesses what and when. Oplon thus facilitates a comprehensive audit of access and privileges, an essential element for demonstrating the organizational due diligence required by regulations.

The platform’s official documentation also highlights its goal of supporting compliance with regulations such as GDPR and NIS2.

Conclusions

European and Italian regulations place a genuine burden of proof on companies: it is not enough to simply declare information as confidential; companies must demonstrate that they have adequately protected it. In this context, cybersecurity solutions play both a technical and a legal role. Oplon Secure Access integrates IAM, PAM, and ZTNA technologies to ensure that the security measures required by law are truly “adequate.” In this way, the platform helps bridge the gap between technical compliance and the legal protection of trade secrets, in accordance with Articles 98–99 of the Industrial Property Code.

Latest from the blog

Voucher Cloud & Cybersecurity

The MIMIT Cloud & Cybersecurity Voucher offers small and medium-sized enterprises (SMEs) and self-employed individuals a concrete opportunity to invest in the security and evolution of their IT infrastructure.

1 September 2026

Oplon Secure Access 12.3.0

Oplon Secure Access 12.3.0 introduces enhancements designed to make remote access management even more efficient, secure, and simple. The new release offers improved Remote Desktop session quality thanks to Sharp Mode, more advanced password rotation control with the new Password Rotation Test Runner, and the ability to create Temporary Connections to quickly address issues on systems not yet registered on the platform. This update was made possible in part by valuable feedback from customers and partners, whose input continues to guide the solution’s evolution.

7 July 2026

DDoS, Click Day, and Application Outages

Click Days are no longer about attacks, but synchronized legitimate demand that can collapse systems. Traditional WAFs fail: they protect the network, not backend capacity. Resilience requires managing real application capacity under extreme load.

4 June 2026

Voucher Cloud & Cybersecurity

The MIMIT Cloud & Cybersecurity Voucher offers small and medium-sized enterprises (SMEs) and self-employed individuals a concrete opportunity to invest in the security and evolution of their IT infrastructure.

1 September 2026

Oplon Secure Access 12.3.0

Oplon Secure Access 12.3.0 introduces enhancements designed to make remote access management even more efficient, secure, and simple. The new release offers improved Remote Desktop session quality thanks to Sharp Mode, more advanced password rotation control with the new Password Rotation Test Runner, and the ability to create Temporary Connections to quickly address issues on systems not yet registered on the platform. This update was made possible in part by valuable feedback from customers and partners, whose input continues to guide the solution’s evolution.

7 July 2026