The list has already gone, so the aim is to stop it being used, to make its use expensive, and to put the new employer in a position where continuing to use it is a knowing wrong. Speed matters in the first week, evidence matters more. Everything below fails if you cannot show the court which file was taken, when, by whom and from where.
- Preserve his mailbox, laptop image and cloud account before anyone reuses the device or the licence, and have the IT provider export access logs, download logs, USB events and email-forwarding rules for the last ninety days
- Identify the exact document: the CRM export, spreadsheet or contact file, its date, size and location, and a hash of the copy you hold
- His employment contract, NDA, confidentiality policy, exit checklist and the acknowledgement he signed on joining, plus the handover email that says he returned everything
- Evidence of use: the client who received his new-employer email, the LinkedIn message, the quote that matched your pricing to the rupee, with dates
- A certificate under Section 63 of the Bharatiya Sakshya Adhiniyam for every electronic record you intend to rely on, with the dual certification that section requires, so the printouts are admissible
- A note of what the list is worth: revenue from those accounts in the last year, and what it cost to build
Can we stop him using it if there was no non-compete?
Yes, because this is not a non-compete case. Section 27 of the Indian Contract Act, 1872 voids agreements in restraint of a lawful profession, trade or business, and that is why a clause stopping him joining a competitor after leaving will not be enforced, as we explain in our note on non-compete clauses. A confidentiality obligation is different. It does not restrain him from working, only from using your information, and it is enforced both as a contract and through the equitable action for breach of confidence that makes an NDA worth having. A list of your clients, with contacts, volumes, renewal dates and pricing, compiled inside your systems and not available outside, is the classic subject of that obligation. What you cannot restrain is his general skill and knowledge, including the fact that he remembers who your clients are. The line the court draws is between what he carries in his head and what he carried out on a drive, which is why the download log decides these cases.
| Remedy | Provision | Forum | What you get |
|---|---|---|---|
| Temporary injunction restraining use and disclosure, and directing return or destruction | Order XXXIX Rules 1 and 2, Code of Civil Procedure, 1908 | Civil court, or the arbitrator under the contract with Section 9 of the Arbitration Act for interim relief | An order within days on a strong record, enforceable by attachment and detention up to three months under Rule 2A |
| Compensation for copying or extracting data without permission | Section 43(b) of the Information Technology Act, 2000 | Adjudicating officer under Section 46 for claims up to five crore rupees, the competent court above that | Damages by way of compensation, in a summary proceeding |
| Prosecution for dishonest or fraudulent copying | Section 66 of the IT Act (imprisonment up to three years or fine up to five lakh rupees or both) | Police station or cybercrime portal, then the criminal court | Pressure, and a record that supports the civil case |
| Penalty for disclosure of personal information in breach of a lawful contract | Section 72A of the IT Act: penalty up to Rs 25 lakh following the Jan Vishwas amendment | The statutory adjudication route | Requires personal information obtained while providing services under a lawful contract, the specified disclosure, and intent or knowledge of likely wrongful loss or gain |
| Criminal breach of trust | Section 316 of the Bharatiya Nyaya Sanhita | FIR under Section 173 BNSS | Available where he was entrusted with the data and dishonestly used it in violation of the contract, an argument the police will test on whether a data file is "property" entrusted |
How fast can we get an injunction, and what does the court look at?
Order XXXIX Rule 2(1) is written for this case: in a suit to restrain a breach of contract or other injury, the plaintiff may apply at any time after filing for a temporary injunction restraining the breach complained of. Rule 1 adds the general power to preserve property in dispute. The court asks the usual three questions, a prima facie case, balance of convenience and irreparable harm, and on a confidentiality claim the answers turn on the evidence in the checklist above. File the suit and the application together with the affidavit exhibits, ask for an ex parte order on the ground that notice would defeat the purpose, and be ready for the court to require an undertaking in damages. Rule 2A gives the order teeth: disobedience can lead to attachment of property and detention in civil prison for up to three months. Our guide to getting a temporary injunction under Order 39 sets out the papers.
Is the IT Act route worth it alongside the suit?
Often it is the faster money remedy. Section 43 makes a person who, without permission of the owner or person in charge of a computer system, downloads, copies or extracts any data or information from it liable to pay damages by way of compensation. There is no need to prove dishonesty, only lack of permission, and an employee who exports the CRM the night before resigning has usually exceeded any permission he had. Section 46(1A) gives the adjudicating officer jurisdiction where the claim does not exceed five crore rupees, and that officer has the powers of a civil court. Section 66 requires dishonesty or fraud in the relevant act. Section 72A separately addresses specified disclosure of personal information obtained while providing services under a lawful contract; its current sanction is a monetary penalty, not the former imprisonment provision. Each route requires its own ingredients and supporting evidence. It is not a substitute for the injunction, because a magistrate does not order a competitor to stop calling your clients.
What should the letter to the new employer say?
Facts, obligations and a demand, nothing else. State that the employee was bound by confidentiality obligations that survive termination, that specific confidential information was extracted on a stated date, that you have reason to believe it is being used on the new employer's behalf, and that use of it by the new employer with that knowledge is itself actionable. Demand a written undertaking within a short period that the information has been returned or destroyed and will not be used, and that the employer will preserve all records. Do not call him a thief, do not copy clients, and do not assert what the logs do not show. Section 356 of the BNS makes defamation an offence, and an overwritten letter becomes his counterclaim. Send it by email and courier, and keep the delivery proofs, because knowledge is the fact that turns the new employer from a bystander into a defendant.
What I tell employers in the first call
Do not confront him and do not email him from anger. Both warn him to delete, and deletion is what you cannot undo. Preserve first, then send the letter, then file. The cases that succeed are the ones where the download log, the contract and the client's forwarded email arrive at the court on the same day. The cases that fail are the ones built on suspicion and a good story. And separately, fix the leak: the exit checklist that revokes access on the day of resignation, the CRM export permission that nobody below a manager holds, and the confidentiality clause that defines the information by category, on which our guide to protecting trade secrets without a statute is the place to start.