Corporate Espionage in India: What the Law Actually Protects

Most pages on this subject open with a number: what corporate espionage supposedly costs Indian business every year. This one does not, because no such number exists in any form worth repeating. What follows instead is the legal position, what Indian courts have actually done when companies brought these claims, and an honest account of where the criminal route stops.

The vocabulary is worth settling first, because it is used loosely everywhere else. The Law Commission of India distinguishes these terms by who is doing it. In economic espionage the actor targeting a company or a government entity to take its trade secrets is a foreign government. In industrial espionage the actor is another company or commercial entity. Misappropriation of trade secrets, which is what most Indian businesses are actually worried about, is a third thing again and is usually committed by somebody who was given the information in the ordinary course of work. These are not interchangeable, and the remedies differ.

There is no reliable figure for what this costs, and that is a finding

Three statistics circulate in Indian coverage of this subject: that a third of companies have been involved in some form of espionage, that business espionage ranks around ninth among threats to Indian companies with only a fraction of cases detected, and that losses run as high as a given percentage. All three appear in the Law Commission's own report, and the report's footnotes show what they rest on: two newspaper articles, one from 2010 and one from 2018. Neither underlying survey is identified anywhere by title, year, sample or method.

The Commission then says the quiet part itself. Its report records that because of the inherent nature of corporate espionage, there is no reporting, leading to an absence of cases in this regard. That is India's law reform body stating that the conduct is not reported and therefore cannot be counted. It is a better sentence for a business to act on than any figure, and it is why this page carries none.

One related caution. Reports on the cost of a data breach are not measurements of corporate espionage. They measure incident response, notification, customer churn and regulatory cost after a breach, usually from vendor-sponsored surveys. Borrowing those numbers to describe espionage is a category error that appears constantly in this niche.

What actually protects confidential business information

The World Intellectual Property Organization's country overview puts it plainly: there is no separate and exclusive statute to protect undisclosed information or trade secrets in India. Protection comes instead from three directions. Contract does most of the work, through confidentiality clauses and non-disclosure agreements, with damages for breach and injunctions available. Where there is no contract, the equitable action for breach of confidence is the remedy. And a set of criminal and Information Technology Act provisions apply in particular circumstances.

The Law Commission's own summary of the position is that the law as it stands is fragmented and difficult to navigate. In Report No. 289 of March 2024 it recommended a dedicated statute and annexed a draft Protection of Trade Secrets Bill, and separately recommended a second law on economic espionage, on the reasoning that fines and damages lack deterrent impact where a foreign state is the actor. Neither has been enacted, and no such bill appears on the PRS legislative tracker as at October 2026. A parliamentary standing committee had made a similar recommendation in 2021, and a National Innovation Bill drafted in 2008 was never enacted either.

What the courts have actually done

Four Delhi High Court matters set the shape of this, and the pattern across them is more useful than any one of them.

In Diljeet Titus v. Alfred A. Adebare, decided on 8 May 2006, departing associates of a law firm were restrained from using material they had copied, including the client database. Two things in that judgment are routinely overstated by people citing it. It is an interim order on an injunction application, not a final decree. And it draws a line that cuts against the employer: the court said it was possible that part of the information was retained in the defendants' memory, and if that was used no grievance could be made, which is different from a copy made of the list. They remained free to practise and to use what they had mentally retained.

A fortnight later, in American Express Bank v. Priya Puri, decided on 24 May 2006, the same court refused an injunction against a departing head of wealth management. Customer names, addresses and financial details were held not to be trade secrets on those facts, being obtainable independently at small expense. The court said a trade secret is something like a formula, technical know-how or a peculiar mode of business unknown to others, and that routine day to day affairs known to many are not. Its warning about what the bank was really asking for is worth quoting in substance: an injunction of that kind would create a position of once a customer of the bank, always a customer, and in the garb of confidentiality the employer could not be allowed to perpetuate forced employment.

In Stellar Information Technology v. Rakesh Kumar, decided on 29 August 2016, interim relief was again refused, and the court made the structural point: by expanding the definition of confidential information to include material in the public domain, the employer was not protecting proprietary information but seeking a restraint on trade, which is void. An over-broad confidentiality clause does not protect more. It risks protecting nothing.

The fourth is a trap for anyone reading older commentary. In Navigators Logistics v. Kashif Qureshi, a single judge rejected the plaint outright in September 2018, holding among other things that the plaintiff had not identified the author of the compilation it claimed copyright in, and that its confidentiality pleading was too vague to put to trial. That judgment is quoted everywhere as settled law. It was set aside on appeal on 20 November 2024, by a Division Bench which held that the court had gone beyond the plaint and relied on material that belonged at trial, and restored the suit. Only the finding that the post-employment non-compete was void survived. Anyone citing the 2018 reasoning as current authority is working from a judgment that no longer stands.

The pattern is consistent and it is the practical lesson. Courts protect confidential information where the claimant identifies the secret with precision and can show the steps it actually took to keep it secret. They refuse where the claim is a general assertion over customer contact data dressed up as a trade secret. Which means the security measures you can evidence are not merely operational hygiene. They are part of what makes the information legally protectable in the first place.

Post-employment non-competes do not work in India

This is the single most misreported point in Indian commercial content. Section 27 of the Indian Contract Act, 1872 makes an agreement restraining anyone from exercising a lawful profession, trade or business void to that extent. A negative covenant operating during the employment can be enforced. A restraint operating after the employment ends is void.

The Law Commission's report sets out the position: the Supreme Court upheld a covenant restricting an employee during the term of the contract, and in a later judgment distinguished covenants during employment from covenants after it, holding the latter void. That interpretation, the Commission records, has been uniform and consistent from 1874 onwards, followed by all the High Courts and expressly reaffirmed by the Supreme Court, and in an overwhelming majority of decisions courts have refused to restrain a former employee from joining a competitor.

The notion that a post-employment restraint survives if it is reasonable in duration and geography is English law. It is not Indian law, and an Indian employment contract drafted on that assumption is likely to be unenforceable in the part that matters most.

The criminal route, and where it actually stops

Several provisions are available, and each has a catch worth knowing.

Criminal breach of trust under section 316 of the Bharatiya Nyaya Sanhita, 2023 is usually the strongest fit for an employee, because it turns on entrustment and on dishonest use in violation of a legal contract touching the discharge of that trust, which maps directly onto a confidentiality clause. Where the person is a clerk or servant it carries up to seven years. Theft is a poorer fit, because theft requires movable property, and whether information is movable property has never been settled by an Indian court. The nearest Supreme Court authority points the other way: in a 1964 decision the Court observed that electricity is not movable property and that abstracting it was an offence only because the Electricity Act created one by a statutory fiction. No Indian statute creates such a fiction for data.

On the technology side, section 43(b) of the Information Technology Act, 2000 covers downloading, copying or extracting data without the permission of the owner, and section 66 makes doing so dishonestly or fraudulently criminal. Two corrections are due here, because both errors are widespread. Section 43 is a civil provision adjudicated by an adjudicating officer, with section 66 as its criminal counterpart, and an Indian company therefore has a statutory compensation route as well as a police complaint. And section 72, which many pages offer as the remedy for employee leaks, applies to people who secured access through powers conferred under the Act, meaning officials and certifying authorities. It does not apply to an ordinary employee.

Then the honest part. We could not establish that any Indian criminal prosecution for the theft or misappropriation of business information has reached a reported judgment, in either direction. The matters on the public record stop at first information report, chargesheet, or proceedings being quashed. The most publicised Indian case of this kind, arising from documents taken from central ministry offices in Delhi in February 2015, is instructive precisely because of how it is usually described. It is commonly presented as an Official Secrets Act prosecution. On the record of the first information report and the chargesheet, the charges were ordinary provisions on trespass, theft, cheating, forgery, receiving stolen property and conspiracy, and the Act was not invoked. A tribunal order of January 2019, in service proceedings brought by one of the suspended employees, records the matter as still pending almost four years after the arrests. No conviction, acquittal or discharge has been publicly reported since. We name no individuals here: every person involved was an accused, and nothing against any of them appears to have been judicially established.

The evidence rule changed in 2024, and most advice has not caught up

If you recover a device, a camera or a storage medium, what it holds is admissible only with a statutory certificate. Almost every page on this subject, and a great deal of Indian legal commentary, still refers to section 65B of the Indian Evidence Act, 1872. That Act was replaced by the Bharatiya Sakshya Adhiniyam, 2023 with effect from 1 July 2024, and the governing provision is now section 63.

The differences are practical. The certificate has to be submitted along with the electronic record at each instance it is tendered for admission, rather than once. It must be signed by the person in charge of the device or of the relevant activities and also by an expert. And it has to be in the form set out in the Schedule, which has a part for the person in charge and a part for the expert, and which requires the device make, model and identifying number along with the hash value of the record, with the algorithm named and the hash report enclosed.

The consequence for anyone who finds something is simple. A recovered device is worth what its chain of custody and its hash are worth. That is the real reason not to pull a device apart, hand it around the office or let building staff take it away, and it is a better reason than any assurance about reports.

Three layers, and what a sweep actually reaches

Protection here divides into three layers that behave differently, and being honest about which one a sweep addresses is more useful than claiming it is the foundation of everything.

The first layer is physical and electronic surveillance of a space: a device placed in a room, a vehicle or a fitting. This is what technical surveillance countermeasures address. It is also the layer where the law is clearest, because unlawful interception of a message is an offence under the Telecommunications Act, 2023, which carries up to three years or a substantial fine, and which came into force in June 2024.

The second layer is intrusion into systems, where the microphone is already in the room because it belongs to a laptop or a conferencing unit, and the audio leaves inside ordinary encrypted traffic. No radio sweep detects that. Our guide to office indicators goes into why that is now the likelier threat in a modern office, and the guide to phone monitoring covers the handset version of the same problem.

The third layer is the insider, and it has no technical countermeasure at all. What it has is governance, and Indian law already requires some of it. The rules defining reasonable security practices under the Information Technology Act expressly include physical security control measures alongside managerial, technical and operational ones, which gives a physical security programme a legal footing rather than merely a prudential one. And a listed company is already required, under the insider trading regulations, to maintain a structured digital database recording who unpublished price sensitive information was shared with, maintained internally with time stamping and audit trails and preserved for at least eight years. That register is exactly the record that makes a leak investigable, and no sweep substitutes for it.

One last caution about expectations. Even a Supreme Court appointed technical committee, examining devices in the Pegasus matter, reported finding malware in five of the twenty nine devices it examined while being unable to confirm what it was. Detection and attribution are different problems, and attribution is frequently not achievable. Any firm that promises to tell you who was listening is promising something the best resourced investigations in the country have not delivered.

What a sweep can and cannot establish

A sweep reports what was found in the areas examined, by the methods used, at the time of the visit. It cannot prove a room has never been compromised and it cannot keep it clean afterwards. Against the three layers above, it addresses the first and leaves the second and third to other disciplines. If the concern is a specific negotiation or boardroom, our national guide sets out what a sweep involves, and the location pages cover how reporting and local rules differ by state. Where executive travel is part of the picture, the guide to vehicle trackers covers what can and cannot be found on a car, and our Mumbai and Gurugram pages deal with the two places corporate work concentrates most.

Frequently asked questions