When a key employee gives notice and joins a competitor, trade secret protection and employee mobility: what to do in the first ten days determines whether the employer still has a claim by the time anyone is instructed to look at it. The first ten days decide which evidence survives, which systems get reviewed before logs rotate, and whether an injunction is realistic at all. This is the situation where waiting to see what happens costs more than acting on incomplete information.
Who this concerns
This applies to any Swedish employer, or the Swedish entity of a foreign group, whose departing employee had access to something that would hurt the business if a competitor had it: pricing models, formulation data, client lists with margin information, source code, supplier terms, or a product roadmap. The trigger is rarely subtle. An employee resigns with short notice, takes leave immediately after resigning, or the resignation coincides with a competitor's hiring announcement or with the employee registering a company of their own.
The reason this becomes urgent within days rather than weeks is that the employer's evidence is perishable. Laptops get wiped as a matter of IT routine. Access logs roll over. The departing employee's colleagues stop remembering exact dates once the immediate disruption of the departure passes. None of that is dramatic on its own, but together it means the position an employer has on day one is rarely the position it still has on day thirty, unless something was done to preserve it.
A separate set of questions arises when the new employer, or the employee's new venture, sits outside Sweden. If the competitor is based abroad, the practical value of a Swedish injunction depends on whether it can be enforced where the competitor actually operates, and evidence held on foreign servers or by a foreign employer is harder to reach through Swedish disclosure mechanisms. Where the employing company itself is the Swedish subsidiary of a foreign parent, decisions about whether to pursue the matter, and who instructs counsel, often have to travel up the group before day ten has passed, which is itself a reason to start the internal steps immediately rather than wait for a mandate from elsewhere.
What the law says
Under Swedish law as it currently stands, protection for confidential business information and the restrictions that can be placed on a former employee sit in two separate places that get confused in practice. One is the general protection against misuse of information that qualifies as a trade secret, which exists independently of what the employment contract says and covers information that is kept confidential and has value because it is not generally known. The other is whatever the employment contract itself provides: confidentiality clauses that survive termination, and any post-employment restriction on competing or soliciting clients, which is a separate contractual mechanism with its own, considerably stricter conditions for enforceability.
The practical consequence is that an employer cannot rely on a broad non-compete clause to do the work that trade secret protection is meant to do, and cannot assume that information is protected as a trade secret simply because a contract calls it confidential. Whether a given piece of information is protectable depends on how it was actually treated inside the business, not on how it is labelled. General professional skill and experience the employee built up while working for the employer is not something the employer can restrict, however useful that skill now is to a competitor.
No specific statutory provisions are cited here, because which clauses and which tests apply depends on the structure of the individual employment relationship, the wording of the contract, and how the information was actually handled before the employee left. Those facts, not the general framework, decide the outcome.
How it works in practice
The ten days that matter split into a sequence of decisions, not a single action. Each step forecloses or preserves an option for the step after it.
Day 0 to 1: contain access before anything else
The first action is administrative, not legal: end the departing employee's access to systems that hold the information at issue, on the day the resignation is confirmed or the departure becomes irregular, whichever comes first. This is not an accusation. It is standard practice that should already be routine for any departure, and doing it late is what later looks like negligence if the information does turn up with a competitor.
Day 1 to 3: preserve the record before it is overwritten
Before any device is wiped, reissued, or handed to IT for standard reset, a forensic image should be taken of the employee's laptop and, where the employer's policy allows it, relevant mobile devices. This is a technical step that a forensic provider, not internal IT, should carry out, because the chain of custody matters if the image is ever used in proceedings. Waiting until a dispute looks likely is usually too late, because the routine device reset happens faster than the dispute develops.
Day 2 to 4: map what the employee actually had access to
Not what the employee's job title suggests they had access to, but what the access logs actually show: which files were opened, downloaded, or emailed in the weeks before departure, and whether any of that access pattern is unusual against the employee's normal behaviour. This step tells the employer whether there is anything to act on at all, which is a question worth answering honestly before spending further time or money on the matter.
Day 3 to 5: read the actual contract, not the template
The employment contract, not the standard company template, needs to be read specifically for what confidentiality obligation survives termination, whether there is a non-compete or non-solicitation clause, what geographic and temporal scope it covers, and whether the employee received anything in exchange for accepting the restriction. A restriction that looks broad on paper is not automatically enforceable, and assuming it is enforceable before writing to the employee is a common source of embarrassment later.
Day 5 to 7: decide whether a letter helps or warns
A cease-and-desist letter to the former employee, and sometimes to the new employer, can stop further use of the information and put both parties on notice. It can also alert a competitor to exactly what the employer is worried about, before the employer has finished checking whether that worry is justified. The decision to send one should follow the evidence review, not precede it.
Day 6 to 8: assess whether an interim injunction is realistic
An application for interim relief depends on showing, with contemporaneous evidence, that misuse is happening or imminent and that the delay of ordinary proceedings would cause harm that cannot be undone later. This is not a step to take on suspicion. It requires the device image and access log review from earlier in the window to already exist.
Day 7 to 10: decide who else needs to know
Clients, other employees who might be approached by the departing colleague, and the group parent if the employer is a subsidiary, often need a decision about what to say and when. Silence beyond this point tends to be read internally as either confidence that nothing happened, which invites complacency, or as an admission that nothing was done, which invites the same mistake next time.
What to check within the first ten days:
- Exactly which systems and files the departing employee accessed in the final weeks, not months, of employment.
- Whether the employment contract contains a confidentiality clause that survives termination, and what it actually covers.
- Whether any non-compete or non-solicitation clause exists, what it restricts, and for how long.
- Whether the employee received separate consideration for accepting a post-employment restriction.
- Whether the information at issue was treated as confidential in practice, not just in the contract's wording.
- Whether the new employer or venture is based inside or outside Sweden.
- Whether any client or supplier has already been contacted by the departing employee.
If three questions come back positive
If the access logs show unusual activity, the contract contains an enforceable restriction, and the information genuinely was treated as confidential, the position is strong enough to justify a letter and, if needed, an application. If any one of the three is missing, the matter is weaker than it looks and a letter risks tipping off a competitor to a dispute the employer cannot yet win.
What often derails this before day ten
The most common failure is not a legal one. It is that the device gets wiped on day two because nobody told IT to hold it, or the access review happens after the cease-and-desist letter goes out rather than before, so the letter is written on assumption rather than evidence.
The numbers
There is no fixed number of days, weeks, or kronor that applies uniformly to this situation, and any figure offered without reference to the specific facts is not useful. What can be said with confidence is qualitative: the cost of the matter rises sharply once a letter has already been sent without adequate evidence behind it, because the employer then has to either escalate on a weak position or withdraw, both of which are more expensive than a properly sequenced first ten days. Cost also rises where the new employer is based abroad, because gathering evidence and, if it comes to that, enforcing any outcome outside Sweden adds a jurisdictional layer that a purely domestic matter does not have.
Time pressure is asymmetric. The steps that preserve evidence, revoking access and imaging devices, cost almost nothing and take a day. The steps that commit the employer to a position, sending a letter or filing for interim relief, are expensive to reverse. The sequence above is built around doing the cheap, reversible steps first and the expensive, committing steps only once there is something to act on.
Where it usually goes wrong
This entire approach assumes there is something worth protecting and evidence to support it. Where the departing employee had genuinely general commercial experience rather than access to something specific and confidential, no amount of process in the first ten days manufactures a claim that was never there. Trying to restrict an employee's use of skills they built up over a career, rather than specific confidential information, is the single most common way employers overreach, and it tends to be visible to anyone reviewing the contract from outside the dispute.
A second limit sits in the contract itself. A non-compete clause that is unreasonably broad in scope, geography, or duration, or one for which the employee received no separate benefit, is unlikely to hold regardless of how urgent the situation feels. Acting as though a weak clause is a strong one, because the employer wrote it that way, does not change what a court will do with it.
A third limit is evidentiary overreach in the opposite direction: accessing a former employee's personal devices, personal email accounts, or private messages without a proper legal basis to do so can turn a legitimate trade secret concern into a separate exposure for the employer, particularly where the access itself breaches data protection obligations. The correct scope of review is company systems and company-issued devices, not whatever the employer can technically reach.
Finally, where the new employer or the employee's new venture sits outside Sweden, the practical value of anything achieved domestically within the ten-day window is limited by whether it can actually be enforced where the competing activity happens. A strong Swedish position against a foreign competitor is not the same thing as a strong position, full stop, and that gap needs to be part of the decision about whether to escalate at all.
If the departing employee had general skills, not specific access
Then the matter is not a trade secret matter and treating it as one wastes the ten-day window on steps that were never going to produce a claim.
If the restriction was never properly agreed
Then the contractual route is closed regardless of how the information was handled, and the analysis reduces to whether trade secret protection alone, without contractual backing, covers what actually happened.
Does a signed non-compete automatically protect the information?
No. A non-compete clause and trade secret protection are separate mechanisms. A signed clause that is too broad, unpaid for, or disproportionate to the role can be unenforceable regardless of what it says, while information can still be protected as a trade secret even without any contractual clause at all, provided it was genuinely kept confidential and has independent value.
What counts as protectable information rather than general experience?
The distinction usually turns on specificity and how it was handled inside the business, not on how important it felt to the employee's job. A client list with pricing history, a formulation, or unpublished technical data is typically protectable. The employee's general familiarity with the market, or skills that would transfer to any employer in the sector, typically is not.
Can the employer review the departing employee's personal devices or accounts?
Only with a proper basis for doing so, and generally not without consent or a court order. Reviewing company systems, company email, and company-issued devices is standard practice for a departure of this kind. Extending that review to personal accounts without a legal basis creates a separate exposure for the employer and should not be assumed to be part of the standard first response.
What to do next
The steps above manage what is within the employer's control before anyone outside the company is instructed: preserving evidence, reading the actual contract, and mapping actual access. What they cannot do is tell the employer whether the specific information at issue qualifies as protectable, whether the specific clause in the specific contract will hold, or what a Swedish court is realistically likely to grant on the facts as they actually stand. That question needs the contract, the access logs, and the sequence of events in front of someone who does this for a living, not a generic list.
This is the point where the analysis stops being something that can be done from a checklist and starts requiring an assessment of the actual documents. Lodline's intellectual property and UPC practice works from exactly that starting point: the employment contract, the access record, and the specific information at issue, reviewed together before any letter goes out.
Where the underlying concern is less about a departing employee and more about whether an innovation should be protected by secrecy at all, rather than by a patent that would eventually become public, the trade-off between the two routes is addressed separately in decisions on opting out European patents from the UPC, which is worth reading before the next filing decision rather than after this dispute closes.
To have the first ten days reviewed against the actual documents rather than against a general checklist, the starting point is an assessment of the specific position.