This article is written by Karman Noor of Army Institute of Law, an intern under Legal Vidhiya.
ABSTRACT
Globalization has made outsourcing and Business Process Outsourcing integral to corporate strategy, enabling companies to achieve cost efficiencies, tap specialized expertise, and build scalable operations across borders. India has emerged as a premier global hub for IT-enabled services, BPO, and Knowledge Process Outsourcing, drawing sustained foreign investment and managing substantial volumes of data and processes for international clients. This heavy reliance on external service providers operating within complex and often opaque technological ecosystems, however, creates acute vulnerabilities for the protection of trade secrets, which include sensitive commercial information such as proprietary algorithms, customer lists, pricing structures, and operational processes that derive competitive value from secrecy.
This paper examines the central trade secret challenges that arise in outsourcing and BPO relationships in India, focusing on the legal framework, emerging threats, key judicial decisions, and practical mitigation strategies. In the absence of a dedicated trade secrets statute, the Indian regime is built on a patchwork of contractual mechanisms, equitable doctrines, statutory provisions, and international obligations, particularly under the TRIPS Agreement. The article argues that although courts and policymakers have made notable progress, persistent enforcement gaps and structural weaknesses make it necessary to adopt coherent, specialized legislation to secure India’s status as a trusted global outsourcing destination.
INTRODUCTION
Outsourcing and BPO have become indispensable elements of contemporary business models, allowing organizations to relocate customer service, data processing, software development, analytics, and other functions to specialized providers capable of delivering at scale. India’s dominance in this domain is underpinned by its large, English-speaking workforce, competitive costs, time-zone advantages, and steadily improving digital infrastructure, which collectively have positioned it as a preferred locus for global service delivery. As a result, Indian firms handle enormous quantities of commercially sensitive information, much of it qualifying as trade secrets.
Trade secrets are typically defined as confidential business information that is not generally known, confers a commercial advantage because it is secret, and is subject to reasonable measures to preserve its secrecy. In outsourcing arrangements, this can encompass technical know-how, source code, training data for algorithms, client databases, pricing models, and strategic plans. Once such information is disclosed to unauthorized persons, protection is effectively lost and the competitive advantage it afforded may disappear permanently. This fragility makes trade secrets especially exposed in multi-party outsourcing ecosystems characterized by extensive data flows, tiered subcontracting, and high employee mobility across firms and jurisdictions.
Unlike patents, which provide a time-bound monopoly in exchange for public disclosure, or copyrights, which protect expression rather than underlying ideas, trade secrets depend entirely on confidentiality. Their protection thus requires not only legal rules but also robust contractual drafting, organizational discipline, and technical safeguards that can function across corporate boundaries. In India, however, the absence of a comprehensive trade secret statute means that protection depends on general contract law, equitable doctrines of breach of confidence, and scattered statutory provisions that were not designed with modern outsourcing structures in mind. The result is a regime that can offer meaningful relief in some cases but remains fragmented and uncertain.
This article situates trade secret issues in outsourcing within the wider scholarly and economic debate, examines the international and Indian legal frameworks, analyses the key vulnerabilities specific to outsourcing and BPO, and reviews important judicial decisions, both domestic and foreign, that shape expectations for Indian providers. It concludes by highlighting contractual, operational, and technological mitigation strategies while underscoring the need for dedicated legislation such as the proposed Protection of Trade Secrets Bill.
LITERATURE REVIEW
Academic literature on trade secrets emphasizes their distinctive position in the intellectual property system as the only major form of protection that does not require registration, can theoretically last indefinitely, and does not demand disclosure of the protected information, provided secrecy is preserved. Scholars note that these characteristics make trade secrets especially attractive for fast-moving technologies where patent cycles are too slow or where public disclosure would erode the competitive value of an innovation. At the same time, the dependence on secrecy renders trade secrets particularly vulnerable in environments where information must be shared extensively, as in outsourcing and BPO relationships.
International legal scholarship underlines the central role of the TRIPS Agreement in establishing minimum global standards for the protection of undisclosed information, including requirements that member states provide effective legal means to prevent unauthorized acquisition, use, or disclosure of such information in a manner contrary to honest commercial practice. Comparative analyses show that advanced jurisdictions increasingly rely on specialized statutes to give effect to these norms, such as the United States’ Defend Trade Secrets Act and the European Union’s Trade Secrets Directive, which define trade secrets, articulate broad civil remedies, and sometimes supplement them with criminal provisions. These instruments also integrate safeguards for whistleblowers and public interest disclosures, reflecting a balanced approach to secrecy and transparency.
In India, the literature converges on the view that trade secret protection is fragmented and underdeveloped. Commentators trace protection primarily to the Indian Contract Act, equitable actions for breach of confidence imported from English law, sectoral statutes like the Information Technology Act, and emerging privacy legislation such as the Digital Personal Data Protection Act. This multiplicity of sources leads to uncertainty regarding what qualifies as a trade secret, what remedies are reliably available, and how cross-border enforcement should operate in outsourcing disputes.
Economic studies highlight the growing reliance on trade secrecy as a primary means of protecting business value in knowledge-intensive sectors. They note that in outsourcing, there is an inherent tension between the operational requirement to share information with vendors and the strategic necessity of preserving confidentiality. Business and management scholarship therefore concentrates on practical safeguards, including detailed non-disclosure agreements, vendor due diligence, continuous monitoring, and technological controls like encryption and data loss prevention tools. More recent work explores the interaction between trade secret protection and data privacy regimes such as the GDPR and the DPDP Act, questioning whether stringent transparency or access rights may sometimes strain confidentiality obligations.
Empirical research and industry reports consistently find that insiders, particularly employees and contractors, are responsible for a large proportion of trade secret breaches, with risk intensifying in sectors characterized by high turnover, such as call centres and BPO operations. Multi-tier outsourcing and subcontracting further increase the number of entities and individuals with potential access to confidential information, complicating oversight and increasing the probability of leakage at some point in the chain.
INTERNATIONAL LEGAL FRAMEWORK
The international legal framework for trade secret protection is anchored by the TRIPS Agreement, which binds all WTO members, including India. Article 39 obliges members to protect undisclosed information that is secret, has commercial value because it is secret, and has been subject to reasonable steps to maintain its secrecy. These conditions are particularly important for outsourcing, because the requirement of “reasonable steps” effectively demands demonstrable contractual, organizational, and technical measures for trade secrets to be protected internationally.
TRIPS does not prescribe a particular legislative model, allowing states to adopt their own mechanisms. However, it does subject members to WTO dispute settlement, meaning that persistent failure to provide adequate protection may, in principle, attract international consequences. The Paris Convention’s provision on unfair competition, especially Article 10bis, reinforces this framework by condemning practices contrary to honest commercial conduct, including unauthorized exploitation of confidential information. Bilateral and plurilateral trade and investment dialogues, including those between India and major service-importing states, frequently incorporate intellectual property concerns and thus indirectly influence the expectations placed on Indian outsourcing providers.
Comparatively, the United States and European Union have adopted robust statutory regimes that stand in contrast to India’s common-law-dominated approach. The Defend Trade Secrets Act created a federal civil cause of action for misappropriation, allowing plaintiffs to sue in federal court and obtain injunctions, compensatory and exemplary damages, and attorney’s fees in cases of willful and malicious conduct. Most U.S. states have also enacted versions of the Uniform Trade Secrets Act, and criminal statutes address particularly serious trade secret theft, especially when foreign entities are involved. The EU Trade Secrets Directive harmonizes standards across member states, defining trade secrets broadly, detailing remedies, and protecting confidentiality during proceedings, while recognizing legitimate exceptions for whistleblowers and disclosures in the public interest.
Emerging global trends complicate this legal landscape. Heightened geopolitical tensions and fears of economic espionage have led some states to scrutinize or restrict outsourcing of sensitive functions, particularly in areas such as defence technology, critical infrastructure, and advanced digital services. Cybersecurity threats have intensified, with state-linked and criminal actors targeting outsourcing providers as relatively softer points of entry into the information assets of large client corporations. Simultaneously, data localization requirements and comprehensive privacy regimes require complex compliance strategies to ensure that trade secret protection, privacy, and regulatory mandates are all satisfied when data crosses borders and is processed within transnational outsourcing networks.
THE INDIAN LEGAL FRAMEWORK
India’s existing trade secret protection reflects its common law heritage and remains largely judge-made, supplemented by contractual practice and a variety of general statutes. In the absence of a unified trade secret law, the Indian Contract Act of 1872 provides the basic foundation for protecting confidential information through contractual obligations. Section 27 renders agreements in restraint of trade void, constraining the use of broad post-employment non-compete clauses, but courts have accepted confidentiality obligations and limited non-competes where they are reasonably necessary to protect legitimate proprietary interests and are narrowly tailored in scope and duration. The Supreme Court’s ruling in Niranjan Shankar Golikari v. Century Spinning & Manufacturing Co. Ltd. is frequently cited for its endorsement of such calibrated restraints in appropriate circumstances.
Equity fills important gaps through actions for breach of confidence, drawing from the classic formulation in Coco v. A.N. Clark, which requires that information possess the quality of confidence, be disclosed in circumstances importing an obligation of confidence, and be used or threatened to be used in an unauthorized manner causing detriment. Indian courts have adopted this structure and used equitable relief, particularly injunctions under the Specific Relief Act, to prevent or limit the disclosure of confidential information where monetary damages would be inadequate. Sections 37 to 39 of the Act empower courts to grant temporary and permanent injunctions, a tool frequently invoked in trade secret disputes involving employees and outsourcing partners.
Several statutory provisions complement these doctrines. The Information Technology Act, 2000, obliges entities handling sensitive personal data to maintain reasonable security practices and provides civil and criminal consequences for unauthorized access and disclosure by persons who obtain information under lawful contracts. The Bharatiya Nyaya Sanhita, which replaces the Indian Penal Code, includes offences such as criminal breach of trust and certain forms of theft that can be applied to misappropriation of confidential information, though reported criminal prosecutions in trade secret cases remain limited. The Competition Act, the Copyright Act’s protection for databases as literary works, and the DPDP Act’s requirements for secure processing of personal data all indirectly support trade secret protection, particularly where confidential business information overlaps with protected personal data.
Judicial decisions have progressively clarified these principles. In American Express Bank Ltd. v. Priya Puri, the Delhi High Court held that customer lists and relational information acquired by an employee remained subject to confidentiality even after termination, granting an injunction to prevent solicitation and emphasizing the importance of non-disclosure commitments in sectors handling customer data. Burlington Home Shopping v. Rajnish Chibber similarly characterized customer and pricing information as trade secrets whose disclosure would cause competitive harm. In John Richard Brady v. Chemical Process Equipments Pvt. Ltd., the court found that technical know-how shared in a business partnership remained confidential after dissolution, confirming the survival of obligations as long as the information itself remained secret and commercially valuable.
In Diljeet Titus v. M. Alfred A. Adebare, client lists compiled by a law firm were treated as confidential information, reflecting a recognition that curated compilations created using firm resources are not merely personal property of individual partners. HCL Technologies Ltd. v. Sanjay Ranganathan addressed the common scenario of employees downloading proprietary materials onto personal devices; the Delhi High Court granted injunctive relief and underscored the enforceability of contractual terms that limit the purpose and scope of access to corporate information. At the same time, the Supreme Court in V.F.S. Global Services Ltd. v. Suprit Roy cautioned against sweeping post-termination non-compete clauses, reiterating that such restraints must be tied to protection of genuine trade secrets or specialized training and cannot simply be used to suppress competition.
Recognizing these limitations, the Law Commission of India in its Report No. 278, issued in 2024, recommended the enactment of a Protection of Trade Secrets law that would define trade secrets, specify what constitutes misappropriation, and establish a comprehensive menu of civil remedies including injunctions, damages, and, in serious cases, criminal sanctions. The accompanying draft Bill contemplates explicit exceptions for independent discovery, lawful reverse engineering, and disclosures compelled by law, thereby harmonizing domestic law with TRIPS and international best practices. As of late 2025 the Bill remains pending before Parliament, leaving Indian trade secret law in a transitional state that combines common law, contract, and dispersed statutory provisions without a single codified framework.
KEY ISSUES IN OUTSOURCING AND BPO
Several structural characteristics of India’s outsourcing and BPO industries intensify trade secret risks. High employee turnover is perhaps the most prominent, with attrition rates significantly higher than in many other sectors, especially in call centres and entry-level process roles. Employees in these environments acquire detailed knowledge of workflows, scripts, system configurations, and customer profiles, and their movement to competitors or new vendors poses a constant risk that confidential information will be transmitted, whether intentionally or inadvertently. Because Section 27 limits post-employment restraints, firms cannot rely solely on non-compete clauses to mitigate this risk, and must instead emphasize confidentiality obligations, non-solicitation provisions, and rigorous exit protocols.
Multi-tier outsourcing and subcontracting amplify vulnerabilities by expanding the number of independent entities that may access confidential information. Prime contractors frequently engage specialist vendors to perform distinct components of a project and may permit further subcontracting, creating cascades of responsibility and access that are difficult for the original client to monitor directly. In such structures, the client often lacks contractual privity with lower-tier subcontractors and must rely on the prime contractor to enforce confidentiality and security obligations downstream. Breaches at the subcontractor level can therefore be hard to detect, investigate, and remediate, particularly where infrastructure and data reside in different jurisdictions and legal systems.
Cross-border enforcement challenges compound these structural issues. Trade secret disputes in India may take several years to resolve through the trial and appellate courts, reducing the practical value of ex post remedies in a context where the harm from disclosure is immediate and often irreversible. Foreign companies that secure judgments in their home courts may face additional hurdles in seeking recognition and enforcement in India because foreign judgments must be proved and are not automatically enforced. Differences in discovery procedures, evidentiary standards, and approaches to interim relief further complicate the litigation landscape. Meanwhile, cyber-enabled theft allows vast quantities of data to be exfiltrated within minutes and transferred through multiple jurisdictions, often ending up in locations where cooperation with Indian or foreign authorities is limited.
Regulatory developments, particularly the Digital Personal Data Protection Act and various data localization requirements, introduce both opportunities and complexities. On the one hand, mandated security safeguards, accountability obligations, and breach notification requirements can reinforce trade secret protection by compelling organizations to adopt stricter technical and organizational measures. On the other hand, transparency requirements and individual rights of access under privacy law may in some circumstances tension with confidentiality interests, especially where datasets combine personal and proprietary information. Data localization rules that require certain categories of data to remain within national borders or be processed only in specified jurisdictions impose architectural constraints on outsourcing arrangements and may raise costs while concentrating risk in particular locations.
LANDMARK JUDICIAL DECISIONS WITH OUTSOURCING IMPLICATIONS
Domestic case law such as Priya Puri, Burlington Home Shopping, John Richard Brady, Diljeet Titus, and HCL Technologies collectively demonstrate that Indian courts are prepared to treat client lists, technical know-how, curated databases, and employer-owned information as protectable trade secrets or confidential information when the requisite elements of secrecy, value, and reasonable protective measures are present. Courts have been willing to grant interim and final injunctions to prevent misuse, particularly where continued use or disclosure would erode business goodwill or allow competitors to gain an unfair advantage. At the same time, decisions like V.F.S. Global reflect judicial insistence that restrictive covenants must be proportionate and genuinely directed at protecting proprietary interests rather than simply suppressing competition.
Internationally, Epic Systems Corp. v. Tata Consultancy Services Ltd. stands out as a defining trade secret case involving an Indian outsourcing provider. In that case, a United States jury found that employees of TCS had accessed Epic’s proprietary healthcare software documentation beyond the scope authorized for a benchmarking project and had downloaded thousands of confidential files, leading to an initial damages award in the hundreds of millions of dollars that was later reduced on appeal but remained substantial. The case sent shockwaves through the Indian IT and BPO industry, not only because of the financial magnitude of the judgment but also because it highlighted the extent to which foreign courts will scrutinize internal access controls, employee conduct, and whether companies have instituted and enforced robust trade secret protection measures. In response, many Indian providers reportedly strengthened compliance programs, access controls, employee training, and monitoring systems to reassure global clients of their commitment to trade secret protection.
MITIGATION STRATEGIES AND CONCLUSION
Mitigating trade secret risks in outsourcing and BPO requires an integrated approach that spans contractual, organizational, and technological domains. At the contractual level, outsourcing agreements and NDAs must clearly define what constitutes confidential information, often combining specific categories such as source code, data sets, and business plans with broader formulations covering any information that ought reasonably to be regarded as confidential in context. They should impose strong confidentiality obligations, provide for survival of those obligations beyond termination where necessary, and include explicit cascade clauses ensuring that subcontractors are bound to equivalent standards. Intellectual property clauses must clarify ownership of any work product, derivatives, and improvements created in the course of the relationship, especially where the client’s trade secrets are used as inputs. Non-solicitation provisions and carefully calibrated non-compete clauses within the limits of Section 27 can further protect against harmful employee movements, while dispute resolution clauses should provide for efficient and confidential arbitration, often in neutral locations, to minimize the risk of public disclosure during litigation.
Operationally, organizations must conduct rigorous vendor due diligence and maintain ongoing oversight, including security audits, risk assessments, and continuous monitoring of access to sensitive systems and repositories. Clear internal policies, robust role-based access controls, and strong cultural messaging around confidentiality are vital for reducing insider risk. Human resources practices should integrate trade secret protection across the employment life cycle, from onboarding agreements and training to exit interviews and formal certifications of data return or deletion. For extremely sensitive functions, some firms may opt for captive centres or hybrid models that offer tighter direct control over personnel and infrastructure while still leveraging India’s advantages.
Technologically, encryption, data loss prevention tools, intrusion detection and response systems, and advanced analytics to detect anomalous access patterns all form part of the protective architecture required in modern outsourcing environments. Comprehensive logging and immutable audit trails help to both deter misconduct and demonstrate that reasonable steps were taken to preserve secrecy, which is essential under standards such as Article 39 TRIPS and under emerging domestic norms. Regular security testing, including penetration testing and vulnerability assessments, allows firms and their vendors to address weaknesses before they are exploited.
CONCLUSION
Ultimately, trade secret issues in India’s outsourcing and BPO sectors sit at the intersection of economic opportunity and legal vulnerability. The current regime, built on contracts, equity, and sectoral statutes, can offer meaningful remedies but does not yet provide the clarity, predictability, and deterrent strength of a dedicated trade secret statute. High insider risk, complex subcontracting chains, cross-border enforcement difficulties, and regulatory pressures highlight the need for both stronger governance at the firm level and legislative reform at the national level. The experience of landmark cases, including Epic Systems v. TCS and leading Indian decisions, shows that failures in trade secret protection can inflict severe financial and reputational damage, whereas well-designed frameworks can reinforce trust and sustain India’s position as a preferred global outsourcing destination.
REFERENCES
- Law Comm’n of India, Rep. No. 278, Protection of Trade Secrets and Related Issues (2024).
- Digital Personal Data Protection Act, No. 22 of 2023 (India).
- Information Technology Act, No. 21 of 2000 (India).
- Indian Contract Act, No. 9 of 1872, § 27 (India).
- Niranjan Shankar Golikari v. Century Spinning & Mfg. Co., A.I.R. 1967 S.C. 1098 (India).
- Am. Express Bank Ltd. v. Priya Puri, 2006 (32) PTC 391 (Del. High Ct.).
- Epic Sys. Corp. v. Tata Consultancy Servs. Ltd., 945 F.3d 925 (7th Cir. 2019).
Disclaimer: The materials provided herein are intended solely for informational purposes. Accessing or using the site or materials does not establish an attorney-client relationship. The information presented on this site is not to be construed as legal or professional advice, and it should not be relied upon for such purposes or used as a substitute for advice from a licensed attorney in your state. Additionally, the viewpoint presented by the author is personal.
