Document exactly what confidential information or trade secrets the former employee or contractor accessed, copied, or used:

To qualify as a "trade secret," you must show you took reasonable steps to maintain secrecy:

• NDAs: Did the employee/contractor sign a confidentiality or non-disclosure agreement?
• Access controls: Password protection, role-based permissions, VPN requirements, two-factor authentication
• Confidentiality markings: Documents labeled "Confidential," "Proprietary," or "Trade Secret"
• Need-to-know policies: Restricted access to sensitive data on a business-need basis
• Exit procedures: Return-of-property checklists, exit interviews, certification of data deletion
• Employee handbook/policies: Written policies prohibiting unauthorized copying or disclosure

If you had no protective measures, courts may find the information wasn't a protectable trade secret. However, even minimal measures (NDAs + password protection) can suffice if the information derives real value from secrecy.

Gather forensic evidence showing the former employee/contractor took or used your trade secrets:

Calculate your actual losses and unjust enrichment to determine the stakes:

• Lost revenue: Clients who defected to the former employee's new venture, using your confidential information
• Unjust enrichment: Value the former employee gained by using your trade secrets (e.g., faster time-to-market, lower customer acquisition costs)
• Development costs avoided: What it would have cost them to develop the information independently (e.g., years of R&D, customer relationship building)
• Competitive advantage lost: Diminished market position, eroded pricing power, loss of first-mover advantage

Leverage factors:

• Strength of forensic evidence (smoking-gun emails, clear download logs)
• Egregious conduct (mass data theft, coordinated team departure, lying during exit interview)
• Availability of injunctive relief (can you stop ongoing use and prevent further damage?)
• Former employee's financial resources and reputational sensitivity

Your cease-and-desist letter should accomplish multiple goals simultaneously:

1. Immediate cessation: Stop all use and disclosure of specific categories of confidential information
2. Return and destruction: Require return of all misappropriated materials and certification of deletion from all devices
3. Disclosure of recipients: Identify everyone to whom the information was disclosed (new employer, clients, partners)
4. Preservation of evidence: Prohibit deletion of emails, wiping devices, or altering cloud data
5. Customer de-solicitation: Demand they cease contact with specific clients (when supported by trade secret theory, not just noncompete)
6. Create settlement leverage: Signal serious intent and exposure to injunctive relief and damages

Choose your tone strategically based on the relationship and desired outcome:

1. Identification of trade secrets: Be specific—"client contact information, pricing data, and proposal templates," not just "confidential information"
2. Evidence of misappropriation: Reference specific acts (e.g., "On [date], you downloaded 15,000 customer records to a USB drive")
3. Contractual and statutory violations: Cite the NDA, employment agreement, and CUTSA/DTSA
4. Immediate demands:
   • Cease all use and disclosure
   • Return all materials (physical and electronic)
   • Certify deletion from personal devices and cloud storage
   • Identify all recipients of the information
   • Preserve all evidence (no deletion or destruction)
5. Deadline: Typically 48 hours to 7 days depending on urgency
6. Consequences of non-compliance: TRO/preliminary injunction, damages, exemplary damages (2× actual), attorneys' fees
7. Settlement opening (optional): "We are willing to discuss a resolution that avoids litigation if you take immediate corrective action."

Dear [Former Employee/Contractor]:

I represent [Company Name] in connection with your misappropriation of trade secrets and confidential business information in violation of your Confidentiality Agreement dated [date], the California Uniform Trade Secrets Act (Civil Code § 3426 et seq.), and the federal Defend Trade Secrets Act (18 U.S.C. § 1836 et seq.).

Our investigation has revealed that, prior to your resignation on [date], you engaged in a systematic effort to misappropriate [Company]'s proprietary information, including:

• Customer contact information, purchasing history, and account details for over [X] clients;
• Confidential pricing structures, margin data, and discount schedules;
• Proprietary proposal templates, marketing materials, and business development strategies; and
• [Other specific trade secrets].

Specifically, our IT audit logs show that on [dates], you:

• Downloaded [X] files containing customer data to a USB drive;
• Forwarded [Y] emails containing confidential pricing information to your personal email account ([email]);
• Copied [Z] proprietary documents to your personal Dropbox account; and
• Accessed and exported the entire CRM database on [date], three days before your resignation.

You have since used this misappropriated information to solicit [Company]'s clients and compete directly against us in violation of your legal obligations.

IMMEDIATE DEMANDS:

To avoid immediate legal action, you must comply with the following within 48 hours of receipt of this letter:

1. Cease and desist from all use, disclosure, or dissemination of [Company]'s trade secrets and confidential information.
2. Return all confidential materials, documents, files, and data in any form (physical, electronic, cloud-based) to [Company] at [address].
3. Certify in writing that you have:
   • Deleted all copies of confidential information from your personal devices (computers, phones, tablets, USB drives, external hard drives);
   • Deleted all copies from personal cloud storage accounts (Dropbox, Google Drive, iCloud, etc.);
   • Deleted all emails containing confidential information from personal email accounts; and
   • Not disclosed any confidential information to third parties.
4. Identify all individuals and entities to whom you disclosed [Company]'s confidential information, including your new employer, clients, business partners, and investors.
5. Preserve all evidence related to your access, use, and disclosure of [Company]'s information. Do not delete, alter, or destroy any documents, emails, text messages, or electronic files.
6. Cease all contact with the following [Company] clients: [list specific clients if appropriate and legally supportable].

LEGAL CONSEQUENCES:

If you fail to comply fully with these demands, [Company] will immediately seek:

• A Temporary Restraining Order and preliminary injunction prohibiting your use of trade secrets;
• Monetary damages for actual losses and unjust enrichment;
• Exemplary damages of up to twice the amount of actual damages under CUTSA and DTSA;
• Attorneys' fees and costs for willful and malicious misappropriation; and
• All other relief available under state and federal law.

We expect your full written response and compliance by [specific date and time]. Direct all communications to me at [attorney contact info].

[Optional settlement language:] While we are prepared to pursue all available remedies, we are willing to discuss a resolution that avoids protracted litigation if you take immediate corrective action and demonstrate good faith.

Sincerely,

[Attorney Name]
Counsel for [Company Name]

The strongest trade secret cases are built on clear digital evidence of theft:

Interview current employees who may have knowledge of the former employee's activities:

• Co-workers who observed suspicious behavior: Staying late, working on personal devices, downloading files, taking photos of screens
• Managers who had exit conversations: What did the employee say about their plans? Did they lie about where they were going?
• IT staff: Unusual help desk tickets (password resets, access requests, complaints about locked-out USB drives)
• Clients who were contacted: Did they receive calls/emails from the former employee using your confidential information?

Compare your materials to the former employee's new work product to show copying:

Create side-by-side exhibits showing the similarities. The more identical the materials, the stronger the inference of copying.

Build a chronological timeline showing premeditation:

1. 3–6 months before departure: Incorporation of new competing business, domain registration, trademark filings
2. Final weeks: Spike in data access and downloads, meetings with clients positioned as "farewell" but actually transition discussions
3. Final days: Mass email forwarding, CRM exports, printing of confidential documents
4. Resignation: Short or no notice, vague about future plans or outright lies about new role
5. Post-departure: Immediate launch of competing business, client announcements, identical service offerings

This timeline shows the theft was intentional, planned, and willful—supporting claims for exemplary damages and attorneys' fees.

If ongoing misappropriation is causing irreparable harm, seek immediate court intervention:

What the court can order:

• Immediate cessation of use of trade secrets
• Return and destruction of all misappropriated materials
• Prohibition on soliciting specific clients (if trade-secret-based, not just noncompete)
• Forensic imaging of devices to verify deletion
• In extreme cases under DTSA: ex parte seizure of devices and materials

Most trade secret cases settle before trial. Common settlement structures:

• Standstill agreement: Defendant agrees to stop using trade secrets; plaintiff agrees not to sue for past conduct; mutual release
• Negotiated license: Defendant pays royalty or lump sum to continue using information under defined constraints
• Return and destroy: Defendant certifies return/destruction of all materials; plaintiff releases past claims
• Client carve-out: Defendant agrees not to solicit specific clients for defined period (if legally supportable)
• Monetary payment: Lump sum to cover damages, attorney fees, and avoid admission of liability
• Non-disparagement and confidentiality: Both sides agree not to discuss the dispute publicly

Continuing violation doctrine: If misappropriation is ongoing (e.g., defendant continues to use stolen client list), the statute of limitations may not begin to run until the use ceases.

I represent companies in trade secret misappropriation, unfair competition, and breach of fiduciary duty cases involving former employees and contractors. I handle matters from demand letters through emergency TROs and full litigation under CUTSA and DTSA.

• Forensic investigation coordination: Work with IT and forensic experts to document data theft and preserve evidence
• Cease-and-desist demand letters: Aggressive, legally sound letters demanding immediate cessation, return of materials, and preservation of evidence
• Emergency injunctive relief: File for TROs and preliminary injunctions to stop ongoing misappropriation
• Trade secret litigation: Prosecute claims under CUTSA and DTSA for damages, exemplary damages, and attorneys' fees
• Settlement negotiation: Secure favorable standstills, licenses, or monetary settlements without protracted litigation
• California § 16600 compliance: Ensure demand letters and litigation strategy comply with California's anti-noncompete laws

1. Rapid response: Time is critical in trade secret cases. I move quickly to stop ongoing harm and preserve evidence before it's destroyed.
2. Forensic-driven strategy: I work with IT and forensic experts to build airtight evidence of theft—download logs, email trails, side-by-side comparisons.
3. Aggressive demand letters: My cease-and-desist letters are detailed, evidence-based, and designed to create immediate settlement pressure while preserving your right to emergency relief.
4. California law expertise: I navigate the tension between protecting your trade secrets and complying with California's strict anti-noncompete laws (§ 16600, SB 699).
5. Emergency litigation readiness: If the former employee doesn't comply, I'm prepared to file for a TRO within 24–48 hours, with declarations, exhibits, and proposed orders ready to go.