Protecting Trade Secrets When You Delegate Work to a Virtual Assistant

Published September 22, 2026.

Trade secret protection in delegated work

Trade secret protection becomes an operational question the moment a founder hands sensitive work to a virtual assistant. Product roadmaps, pricing models, customer lists, supplier terms, source code, sales pipelines, and unpublished financials can all qualify as trade secrets, but only if the business treats them that way. United States law does not protect a secret that the owner has failed to guard. This review examines the Defend Trade Secrets Act, the related criminal statute, and the access-control guidance that together define what a business should do before sharing confidential information with a remote assistant.

What qualifies as a trade secret

The Defend Trade Secrets Act defines a trade secret as information that the owner has taken reasonable measures to keep secret and that derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, another person who can obtain economic value from its disclosure or use. The definition covers both technical information and business information. It does not require registration, and it does not expire on a fixed date, but it does depend on the owner's conduct.

Two phrases in that definition do the work. Reasonable measures means the practices the business uses to limit access and disclosure. Independent economic value means the information is worth protecting because competitors do not have it. A founder who shares everything with everyone and hopes an agreement will cover it is relying on the second element while neglecting the first.

The federal statutes

The Defend Trade Secrets Act is codified at 18 U.S.C. Section 1836 and creates a federal civil cause of action for misappropriation. It permits injunctions, damages measured by the actual loss and the unjust enrichment caused by the misappropriation, and in egregious cases exemplary damages of up to twice the amount of compensatory damages plus attorney's fees. It also authorizes civil seizure in extraordinary circumstances. The Economic Espionage Act at 18 U.S.C. Section 1832 makes certain trade secret theft a federal crime.

The definitions section at 18 U.S.C. Section 1839 supplies the operative terms, including misappropriation, improper means, and the definition of a trade secret itself. One important procedural feature of the Act is the immunity notice requirement in 18 U.S.C. Section 1833. It requires an employer to include a specific notice of whistleblower immunity in any contract or agreement with an employee or contractor that governs the use of trade secrets or confidential information. If the business fails to include the notice, it cannot recover exemplary damages or attorney's fees under the Act in a later action against that worker. The whistleblower immunity provision itself protects a person who discloses a trade secret in confidence to a government official or attorney solely for the purpose of reporting or investigating a suspected violation of law, or in a sealed court filing.

The practical implication is concrete. A confidentiality agreement used with a virtual assistant should contain the statutory notice language, or should incorporate a policy that does. A founder who reuses an old, generic NDA may be leaving remedies on the table without realizing it.

Reasonable measures in a delegated arrangement

Courts and the statute look at whether the owner's measures were reasonable under the circumstances. For a virtual assistant, the measures cluster into a few categories. The first is legal: a written confidentiality agreement with the immunity notice, a scope of work, and clear permitted-use language. The second is access: least-privilege accounts, role-based permissions, multi-factor authentication, and separate credentials so that a single assistant does not see every system. The NIST control catalog describes this posture through its access control and audit families, including the principle that accounts receive only the access their function requires. The third is handling: labeling confidential files, limiting downloads and local copies, using approved storage rather than personal drives, and avoiding confidential details in unapproved chat tools. The fourth is lifecycle: an onboarding record that lists what access was granted and an offboarding checklist that revokes it, collects devices and credentials, and confirms return or deletion of information.

Our review of virtual assistant access and account security covers the credential mechanics in more detail, and the virtual assistant workforce outcomes evidence frames the operating context for long-term remote engagements.

Drafting the agreement

A useful confidentiality agreement for delegated work defines confidential information, states the permitted purposes, prohibits disclosure and unauthorized use, requires reasonable care, addresses return or destruction at the end of the engagement, sets a term and survival clause, and identifies the remedies and governing law. It should also include the Defend Trade Secrets Act immunity notice. When the assistant is a contractor rather than an employee, the agreement should match the independent relationship and avoid terms that would undercut the classification analysis.

There are limits. A business cannot protect information that is publicly available, independently developed, or readily ascertainable by proper means. Very broad definitions of confidential information can be narrowed by courts, and some states, including California, restrict restraints on worker mobility and disfavor broad non-competition terms. The goal is a defensible, well-scoped agreement paired with real controls, not the most aggressive possible language.

Detection and response

Even good controls can fail. A business benefits from knowing where its trade secrets live, who can reach them, and how unusual access would appear. Access logs, data loss prevention settings on business accounts, and a documented incident response process turn an abstract policy into something the business can act on. If misappropriation is suspected, preserving evidence and acting quickly matter because injunctive relief is often the most valuable remedy. The federal framework rewards owners who can show both that the information was secret and that they took reasonable steps to keep it that way.

Methodology and limits

This review examined the text of the Defend Trade Secrets Act at 18 U.S.C. Section 1836, the definitions at Section 1839, the immunity notice provision at Section 1833, the criminal provision at Section 1832, the United States Patent and Trademark Office's trade secret policy resources, and the NIST Special Publication 800-53 access control guidance. Each source was checked on September 22, 2026. The review summarizes federal law and control principles; it does not provide legal advice, does not evaluate a particular agreement, and does not address every state law that may apply. Trade secret law is fact-specific and changes over time, so a business should have a qualified attorney review its agreements and practices before relying on this synthesis.

Frequently asked questions

Does a virtual assistant need to sign an NDA? A written confidentiality agreement is one of the reasonable measures that make trade secret protection possible, and it should include the federal immunity notice.

Is an NDA enough to protect a trade secret? No. The owner must also take reasonable measures to keep the information secret, such as limiting access and controlling how files are stored and shared.

What happens if I forget the immunity notice? The Defend Trade Secrets Act can still apply, but the business cannot recover exemplary damages or attorney's fees from that worker under the Act.

Can I stop a former assistant from working for a competitor? That depends heavily on state law, and some states limit such restraints. Trade secret protection focuses on misuse of confidential information rather than on preventing competition itself.

References

1. Defend Trade Secrets Act, 18 U.S.C. Section 1836, U.S. Code
2. Definitions, 18 U.S.C. Section 1839, U.S. Code
3. Immunity Notice, 18 U.S.C. Section 1833, U.S. Code
4. Trade Secret Policy, United States Patent and Trademark Office
5. Security and Privacy Controls for Information Systems and Organizations (SP 800-53 Rev. 5), National Institute of Standards and Technology