Employee Copies a Foreign Company’s Client List in Turkey: Trade Secret and Criminal Law Remedies (2026 Updated Guide)

An employee copies a foreign company’s customer list in Turkey. Learn when client data may qualify as a trade secret, what evidence employers should preserve, and which civil, employment and criminal remedies may be available.

A foreign-owned company operating in Turkey may discover that an employee has copied its client list shortly before resigning, transferred customer information to a personal email account, downloaded CRM records, exported pricing information to a USB device or shared commercially sensitive data with a competitor. The incident should not automatically be treated as an ordinary employment dispute. Depending on the nature of the information, how it was obtained and how it was subsequently used or disclosed, the company may need to consider trade-secret protection, employment-law remedies, unfair-competition claims, interim measures, compensation and potentially criminal proceedings. The first priority is preserving reliable digital evidence before accounts, devices, logs or cloud records are deleted.

Is a Client List Automatically a Trade Secret?

Not every collection of customer names automatically qualifies for the same level of legal protection. The company’s position becomes stronger where the information is not publicly available and contains commercially valuable material developed through substantial business effort.

A client database may contain contact persons, purchasing history, negotiated prices, discounts, payment conditions, order volumes, customer preferences, contract renewal dates, internal notes and sales strategies.

The complete database can therefore have substantially greater commercial value than a simple list of publicly available company names.

Why Does Confidentiality Matter?

A company alleging misuse of confidential information should be able to demonstrate that it actually treated the information as confidential.

Relevant evidence can include confidentiality clauses, internal policies, restricted CRM permissions, password controls, access logs, employee training, confidentiality notices and technical restrictions on exporting data.

Foreign Companies Should Identify the Information Precisely

Avoid making a general allegation that the employee “stole company information.”

Identify exactly what was copied: customer database, contact information, price lists, quotations, contract terms, sales history, prospective customer information, CRM notes or another category of commercially sensitive data.

Preserve Evidence Before Confronting the Employee

An immediate confrontation can sometimes result in deletion of emails, cloud files or messaging records.

Before taking action, the company should lawfully preserve available evidence concerning account activity, downloads, forwarding, printing, external storage and unusual access patterns.

Review CRM Access Logs

CRM records may show which customer files were accessed, exported or downloaded and when those actions occurred.

Compare suspicious activity with the employee’s resignation date, notice period and communications with competitors.

Review Corporate Email Records

If information was sent from a corporate account to a private email address, preserve the relevant server-side records in accordance with applicable employment and data-protection rules.

Do not rely solely on screenshots if more reliable electronic records remain available.

USB and External Storage Evidence Can Be Important

Where company computers record connections to external storage devices, forensic examination may help establish whether significant quantities of information were copied.

The company should preserve the device and logs appropriately rather than allowing ordinary IT maintenance to overwrite potentially important evidence.

Cloud Transfers Should Be Investigated

Client information can be transferred through personal cloud storage, file-sharing platforms or web applications.

Available network and device records may help reconstruct the transfer, subject to applicable privacy and evidence rules.

Do Not Conduct an Unlawful Digital Investigation

The employer’s legitimate interest in protecting trade secrets does not create unlimited authority to inspect every aspect of an employee’s private communications.

Evidence-gathering should respect applicable privacy, personal-data and employment-law requirements.

Preserve the Employee’s Work Computer

If the employee has already left, avoid immediately reformatting or reallocating the computer.

A properly conducted forensic examination may reveal file-access history, transfers, deleted files and other relevant activity.

Maintain Chain of Custody

If criminal proceedings are contemplated, the reliability of digital evidence becomes particularly important.

Record who collected each device, when it was collected, how it was stored and what forensic operations were performed.

Consider a Forensic Image

For significant cases, a forensic copy of the relevant storage media may be preferable to ordinary manual examination.

This can help preserve the original device while technical analysis is conducted on a copy.

Can Screenshots Be Used?

Screenshots can be relevant, but their evidentiary value may be challenged if authenticity, completeness or context is disputed.

Whenever possible, preserve the underlying electronic record together with metadata and system logs.

Examine the Employment Contract

The contract may contain confidentiality, intellectual-property, data-security, return-of-property and post-employment obligations.

These provisions can become important in both employment and commercial litigation.

Confidentiality Can Continue After Employment Ends

The end of employment does not necessarily give an employee unrestricted freedom to disclose or exploit protected company secrets.

The exact obligations depend on the circumstances, contractual provisions and applicable law.

Non-Compete and Confidentiality Obligations Are Different

A former employee’s ability to work for a competitor should not be confused with the right to take confidential company information.

Even where a post-employment non-compete restriction is unavailable or unenforceable, misuse of genuinely protected confidential information can raise separate legal issues.

Is Remembering Customer Names the Same as Copying a Database?

Not necessarily.

There can be a significant factual difference between general professional knowledge retained in an employee’s memory and the deliberate copying of a structured confidential database immediately before resignation.

The manner in which information was obtained and used should therefore be documented.

What If the Customers Are Publicly Known?

The fact that customer identities can partly be discovered from public sources does not necessarily resolve the dispute.

A structured database combining contacts, purchasing history, pricing, preferences and internal commercial information may contain confidential value beyond publicly discoverable names.

Pricing Information Can Be Particularly Sensitive

Customer-specific prices, discount structures and negotiated commercial terms can provide a competitor with an immediate advantage.

If such information was copied together with the client list, identify it separately in the legal file.

Prospective Customer Lists May Also Matter

The database may include companies that have not yet become customers but have been developed through significant sales activity.

Sales leads, contact histories and negotiation information can therefore require separate analysis.

Turkish Commercial Law Remedies May Be Available

Depending on the facts, misuse or disclosure of commercially sensitive information can raise issues under Turkish unfair-competition and trade-secret rules.

The company should analyze the conduct rather than assuming that every client-list dispute fits automatically within a single legal provision.

Criminal Liability May Also Arise

Certain conduct involving unlawfully obtaining, disclosing or using protected commercial secrets may potentially create criminal-law exposure under Turkish law.

Whether criminal liability exists depends on the precise information involved, the employee’s conduct, how the information was acquired and whether the statutory elements of the relevant offense are established.

Do Not File a Criminal Complaint Based on Suspicion Alone

A former employee joining a competitor shortly after resignation is not, by itself, proof that a trade secret was stolen.

The company should distinguish suspicion from demonstrable digital and commercial evidence.

Identify the Act of Acquisition

Was the database exported from the CRM? Was it emailed externally? Was it copied to USB? Was it photographed? Was access obtained after authorization had ended?

The precise acquisition method can materially affect the legal analysis.

Identify Any Disclosure

Determine whether the employee merely copied the information or actually provided it to another company or individual.

Email records, messages, cloud-sharing logs and subsequent customer contacts may become relevant.

Identify Commercial Use

A particularly important question is whether copied information was subsequently used to solicit the company’s clients.

Compare the former employee’s new commercial activity with the copied database.

Sudden Customer Transfers Can Be Evidence, but Not Conclusive Proof

If several customers unexpectedly move to the employee’s new employer, that development may justify further investigation.

However, customers can change suppliers for legitimate reasons. Additional evidence connecting the transfer with misuse of confidential information is preferable.

Consider Urgent Interim Measures

If the company has evidence that confidential information is actively being disclosed or exploited, waiting for a final judgment may allow irreversible commercial damage.

Depending on the legal basis and evidence, urgent judicial measures aimed at preventing continued misuse may need to be evaluated.

Speed Is Critical

A client database can be distributed electronically within seconds.

The legal strategy should therefore prioritize stopping continued disclosure and preserving evidence rather than focusing exclusively on eventual compensation.

Demand Return or Deletion of Company Information

Depending on the circumstances, the company may formally demand that the employee return company documents and cease possessing or using unlawfully retained confidential information.

Any deletion process should be handled carefully where evidence still needs to be preserved.

Do Not Destroy Your Own Evidence

A demand requiring immediate deletion can create an unintended evidentiary problem if the only remaining copy showing misuse disappears.

Coordinate evidence preservation with the requested remedial action.

The New Employer May Become Relevant

If a competitor knowingly receives or uses improperly obtained confidential information, the dispute may extend beyond the former employee.

Evidence of the competitor’s knowledge and conduct becomes important.

Send Legal Notice Where Appropriate

A carefully drafted notice can identify the protected information, demand cessation of use and preserve the company’s legal position.

Avoid making unsupported criminal accusations in commercial correspondence.

Employment Termination May Be Considered

If the employee remains employed when the copying is discovered, the employer should evaluate the seriousness of the conduct under Turkish employment law.

The timing and grounds of any disciplinary or termination decision should be documented carefully.

Do Not Delay Employment-Law Decisions

Certain employment-law remedies are subject to short procedural periods.

Companies should therefore coordinate employment and criminal/commercial strategy immediately after discovering the incident.

Personal Data Rules May Also Apply

Client lists frequently contain names, telephone numbers, email addresses and other personal information.

Unauthorized copying can therefore create data-protection issues in addition to trade-secret concerns.

Assess Whether a Data Breach Occurred

The company should determine what personal data were accessed, copied or disclosed, whose information was affected and whether further compliance obligations arise.

Trade-secret response and personal-data response should be coordinated rather than handled as unrelated incidents.

Foreign Parent Companies Should Preserve Cross-Border Evidence

Where CRM systems or email servers are controlled by a foreign parent company, relevant records may be located outside Turkey.

Preserve those records promptly and consider how they can be authenticated and lawfully used in Turkish proceedings.

Headquarters Should Avoid Altering Accounts

Foreign IT departments sometimes disable and delete former employees’ accounts automatically.

Once litigation or criminal proceedings are reasonably anticipated, relevant retention procedures should be considered immediately.

Quantify the Commercial Damage

If the company seeks compensation, it should document actual commercial consequences.

Relevant evidence may include lost customers, lost contracts, reduced margins, investigation expenses and other measurable losses causally connected with the unlawful conduct.

Lost Profit Claims Require Evidence

It may be difficult to prove that every lost customer left because of the copied database.

Preserve customer communications, sales histories, competing offers and other evidence that can help establish causation.

Contractual Penalties Should Be Reviewed

Some employment or confidentiality agreements contain contractual penalty provisions.

Their enforceability and application should be assessed under the relevant Turkish legal rules rather than assumed automatically.

Review Access Permissions After the Incident

A trade-secret dispute frequently exposes internal security weaknesses.

Determine whether employees have broader CRM access than necessary and whether customer databases can be exported without approval.

Restrict Bulk Exports

For commercially sensitive databases, companies should consider technical controls limiting bulk downloads, unusual exports and transfers to unauthorized locations.

Security controls also help demonstrate that the business genuinely treats the information as confidential.

Improve Offboarding Procedures

Before an employee leaves, companies should revoke unnecessary access, recover devices, preserve relevant records and remind the employee of continuing confidentiality obligations.

The process should be standardized for employees with access to sensitive commercial information.

Separate Personal and Corporate Devices

Bring-your-own-device practices can complicate evidence preservation substantially.

Companies handling valuable client databases should maintain clear policies concerning corporate information stored on personal devices.

Review Messaging Applications

Where business communications routinely occur through messaging applications, the company’s evidence and retention strategy should reflect that reality while respecting applicable privacy rules.

Foreign Companies Should Create a Turkey-Specific Trade Secret Policy

A multinational policy may not adequately address Turkish employment, commercial, criminal and data-protection considerations.

The Turkish operation should identify what information is confidential, who can access it, how it may be transferred and what happens when employment ends.

Immediate Legal Response Plan

When an employee is suspected of copying a foreign company’s client list in Turkey, the company should immediately preserve computers and server records, review CRM and email logs, identify exactly what information was taken, document confidentiality measures, investigate external transfers, preserve chain of custody, review the employment agreement, evaluate employment-law deadlines, determine whether unfair-competition and criminal remedies may apply, assess urgent interim measures, investigate any personal-data breach and notify relevant foreign headquarters personnel not to delete evidence.

Frequently Asked Questions

Is a customer list automatically a trade secret in Turkey?

Not automatically. The nature of the information, its commercial value, whether it is publicly available and the measures used to keep it confidential can all be important.

Can an employee email the client list to a personal account?

Doing so can create serious legal issues where the employee lacks authorization and the information is confidential or commercially protected.

Can the employer inspect the employee’s computer?

The employer may have legitimate reasons to examine company systems, but privacy, personal-data and employment-law requirements must be respected.

Can copying a client list become a criminal matter?

Potentially. Criminal liability depends on the precise nature of the information and the manner in which it was obtained, disclosed or used.

Can the company stop the former employee from using the database?

Depending on the evidence and legal basis, the company may seek remedies aimed at stopping continued misuse, including consideration of urgent judicial measures.

Can the competitor also be liable?

Potentially, particularly where evidence establishes knowing participation in the acquisition, disclosure or exploitation of protected confidential information.

What if the employee deletes the copied files?

Deletion does not necessarily mean that evidence has disappeared. Forensic examination, server logs, email records and cloud activity may still provide relevant evidence.

Can the company claim compensation?

Potentially. The company will need to establish the legal basis, damage and causal connection between the unlawful conduct and claimed loss.

Does a confidentiality clause help?

Yes, it can be important evidence of the employee’s obligations, although the legal analysis is not necessarily limited to the wording of the contract.

What should the company do first?

Preserve the digital evidence before confronting the employee. Client-list cases can be won or lost through CRM logs, email records, device evidence and a clear record showing exactly what confidential information was copied, when it was taken and how it was subsequently used.

Client-Focused Legal Support for Trade Secret and Employee Misconduct Cases in Turkey

Foreign companies facing employee data theft in Turkey may need to coordinate employment law, trade-secret protection, unfair-competition claims, digital evidence, interim measures, data-protection obligations and criminal proceedings at the same time. Fırat Fesih Kaya Law Office assists foreign-owned companies, international investors and employers facing unauthorized copying, disclosure or commercial use of confidential business information in Turkey. Lawyer Fırat Fesih Kaya provides legal assistance in preserving evidence, assessing employee and competitor liability, preparing criminal complaints where legally justified, seeking urgent judicial protection and pursuing compensation and other remedies arising from misuse of confidential company information.

Phone: +90 312 434 22 22
Mobile: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey