In brief
Trade secret misappropriation is rarely a purely legal issue. It is typically fast-moving, opaque and often cross-border. While civil enforcement under Germany’s Trade Secrets Act (Geschäftsgeheimnisgesetz – “GeschGehG”) remains the primary tool, criminal law—specifically Section 23 GeschGehG—should be considered as a strategic additional route in appropriate cases. Properly deployed, it can help companies overcome evidentiary gaps, strengthen enforcement leverage and create meaningful deterrence.
Key takeaways
Criminal enforcement can unlock state investigative tools that are not available in civil proceedings and may be decisive where facts are unclear. Section 23 GeschGehG criminalizes the unlawful acquisition, use and disclosure of trade secrets, including by employees and third parties, but requires proof of intent combined with a qualifying motive. Proceedings generally depend on a criminal complaint filed within relatively short deadlines, meaning that early internal assessment is critical. While the criminal route can be highly effective—particularly in complex or cross-border cases—it also involves less procedural control and potential confidentiality risks compared to civil litigation.
Why criminal law can make the difference
In many trade secret cases, the injured company faces a fundamental challenge: the crucial evidence is controlled by the opposing party. This is particularly true in scenarios involving coordinated actions by employees and third parties or where data has already been transferred abroad. In such situations, civil proceedings may stall at an early stage due to lack of evidence.
Criminal enforcement can change that dynamic. German prosecutors have far-reaching investigative powers, including the ability to carry out searches, seize data carriers and conduct forensic analyses. These tools can be decisive in identifying what information was taken, where it is stored and who is involved. As a result, criminal proceedings are often not just punitive in nature but fact-finding instruments that can also support parallel civil actions.
From a practical perspective, this route is particularly relevant where there is suspicion of large-scale data exfiltration prior to an employee’s departure, involvement of competitors or intermediaries, or uncertainty as to the scope of the leakage.
The legal framework: Section 23 GeschGehG
Section 23 GeschGehG establishes criminal liability for core forms of trade secret misappropriation. The provision is closely linked to the civil-law structure of the Trade Secrets Act: whether conduct is criminal generally depends on whether it is unlawful under the relevant civil provisions on acquisition, use and disclosure.
In essence, the law captures three main categories of conduct. First, it criminalizes the unlawful acquisition of a trade secret, for example through unauthorized access, copying or appropriation of data or documents. Secondly, it extends liability to the use or disclosure of a trade secret that has been unlawfully obtained, which in practice is often the most damaging conduct. Thirdly, it addresses disclosure by employees during the term of their employment, reflecting the particular trust-based relationship in that context. The scope of liability further extends to third parties who knowingly use or disseminate unlawfully obtained information.
Penalties are significant: the basic offense is punishable by up to three years’ imprisonment or a fine, with aggravated cases—such as commercially motivated conduct or foreign use—exposing individuals to up to five years’ imprisonment. Importantly, even an attempt is punishable, allowing intervention at an early stage of misconduct.
What companies need to show in practice
Bringing a criminal case under Section 23 requires careful preparation. It is not sufficient to show that information was taken—companies must establish that the information qualifies as a legally protected trade secret. This requires demonstrating not only its secrecy and economic value, but also that reasonable confidentiality measures were in place.
In addition, the conduct must be unlawful in the sense defined by the Act, which introduces a strong link to the civil-law framework. Perhaps most importantly, the statute requires facts that can prove the presence of the subjective element. Generally, recklessness (“bedingter Vorsatz”) is sufficient.
Procedural aspects and strategic considerations
Criminal enforcement in this area is generally complaint-driven. The injured party must typically file a criminal complaint within a relatively short period (usually three months from becoming aware of the relevant facts and the identity of the alleged offender), unless prosecutors assume a particular public interest in pursuing the matter. This makes early internal investigation and legal assessment essential.
Strategic use in an international context
For international businesses, Section 23 GeschGehG is particularly relevant because of its potential cross-border reach. German criminal law can apply in certain situations involving foreign entities, especially within corporate groups where German interests are affected. In an environment where trade secret theft is frequently transnational, this provides an additional layer of protection. German law requires prosecution services to secure assets that stem from a crime. This can decisively help when it comes to recovering damages.
Conclusion
Criminal enforcement under Section 23 GeschGehG is not the default option, but it is a powerful and often underutilized tool. Where companies face limited visibility, coordinated misconduct or cross-border leakage, it can shift the balance by enabling state-led investigations and enhancing deterrence.