Direct answer

Measures must be real, matched to the information, and in place before the leak.

SPC and AUCL practice ask whether the right holder took measures corresponding to the commercial value and the way the information was held: need-to-know access, passwords, watermarks, confidential marking, physical isolation, NDAs or NNN with staff and suppliers, training, and retrieval of devices on exit. A single footer, or an NDA signed after the defendant already had the files, is usually not enough. Over-classifying everything can also hurt, because it suggests you did not identify what was actually secret. Measures are a limb of the secret, not a damages afterthought.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

01

Who could access the information, and why?

Open drives and all-hands WeCom groups are the usual fail.

Access
02

Was it marked and logged?

Stamps, watermarks, DLP and access logs dated before the leak.

Marking
03

Did recipients sign a duty that actually binds them?

Employee handbook, NDA, NNN with the real factory.

Contract
04

What happened on exit or supplier change?

Account cut-off and return certificates.

Exit

Working rule: Map the regulated role before marketing or launch in China.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal
Ask the operating question
Why it changes the route
Open folder
Could the whole company download the drawings?
Corresponding measures fail if there is no need-to-know.
Post-leak NDA
Was the NDA signed after the copy walked?
Measures must pre-date the misappropriation.
Everything is secret
Is the lunch menu marked confidential too?
Courts discount blanket labels with no grading.
Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Access policy and logsWho had rights on the dates that matter.
02Marking samplesHow the secret files actually looked.
03NDA/NNN/handbookSigned duties for staff and suppliers.
04Exit packDevice return, account disable, reminder letters.
Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Is encryption mandatory?

No single technology is mandatory. Encryption helps. The test is corresponding measures as a set, not one tool.

Do measures have to be perfect?

They have to be corresponding and genuine, not perfect. A serious lock plus a later breach can still be a secret.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

National laws database (NPC)
Anti-Unfair Competition Law (gov.cn)
Supreme People’s Court
SAMR