“If you don’t protect your secrets, you can’t defend them”
The protection of trade secrets is not automatic. Italian case law takes a strict approach: it is not sufficient to demonstrate the theft or unauthorized use of the information; rather, it is necessary to prove the existence of effective protective measures. In the absence of such measures, even information of high economic value may lose the legal protection provided for in Articles 98 and 99 of the Industrial Property Code. The focus thus shifts from “data theft” to the quality of the protection system implemented.
In the absence of such measures, even information of high economic value may lose the legal protection provided for in Articles 98 and 99 of the Industrial Property Code. The focus therefore shifts from “data theft” to the quality of the protection system implemented.
For example, the Court of Bologna (Judgment No. 2140/2024) emphasized the importance of access tracking, user profiling, and archiving on company servers with individual authorizations.
Similarly, the Court of Brescia (judgment no. 2247/2025) deemed measures such as strong authentication, access segmentation, and advanced protection of communication systems to be adequate. In such cases, the integration of technical and organizational controls proved decisive for the recognition of trade secret protection.
The real critical factor is not just the security measures implemented, but the ability to demonstrate them. In a legal setting, the company must be able to accurately reconstruct who accessed what, when, and with what privileges.
In this context, logs, authentication systems, and tracking mechanisms serve not only a technical function but also an evidentiary one. In the absence of such evidence, even formally secure infrastructures prove ineffective from a legal standpoint.
Many organizations still rely on models based on VPNs or perimeter controls, which do not provide granular control over individual resources.
This creates a gap between perceived security and demonstrable security: the company may believe it is protected, but may not be able to prove it in the event of a dispute. It is precisely this discrepancy that case law is increasingly highlighting, favoring models based on Zero Trust, identity, and continuous access control.
OSA Secret is a use case of Oplon Secure Access, a Zero Trust platform for the secure management of access to corporate resources. In this scenario, in addition to identity- and context-based controls, advanced features for the protection of trade secrets are introduced.
Before accessing resources, the user may be required to accept a digital NDA and a privacy notice, making the contractual obligation traceable. The system also applies watermarks and session identifiers, along with complete, tamper-proof activity logging. In this way, OSA Secret extends the Zero Trust paradigm by integrating access security with the ability to protect and provide evidence of confidential information.
European and Italian regulations place a genuine burden of proof on companies: it is not enough to simply declare information as confidential; companies must demonstrate that they have adequately protected it.
In this context, cybersecurity solutions play both a technical and a legal role.
Oplon Secure Access integrates IAM, PAM, and ZTNA technologies to ensure that the security measures required by law are truly “adequate.” In this way, the platform helps bridge the gap between technical compliance and the legal protection of trade secrets, in accordance with Articles 98–99 of the Industrial Property Code.
