Trade secrets and NDAs in Uzbekistan

Trade-secret protection requires an established protection regime; signing a non-disclosure agreement (NDA) alone is insufficient. The Law on Trade Secrets governs safeguards, the Civil Code (CC) contractual recovery, and the Labour Code (LC) employee liability. The contract sets the confidentiality period after employment ends; a prohibition on joining a competitor requires a separate assessment.

At a glance:

• The regime requires four mandatory safeguards (Art. 10, Trade Secrets Law): an information list, handling and control procedures, access records, and a marking identifying the owner.
• A business counterparty may face a damages claim (Art. 14 CC) and an agreed contractual penalty; the grounds and calculation differ.
• An ordinary employee reimburses direct actual damage (Art. 337 LC). A separate rule applies to specified management positions.
• An established regime, the transfer of identified information, and a proven breach determine the claim against the recipient.

Updated: 16 September 2026

What qualifies as a trade secret

A trade secret is information that has commercial value because third parties do not know it, is not freely accessible on a lawful basis, and is protected by confidentiality measures. Its owner establishes the regime, while a recipient under a contract is termed a confidential recipient (Art. 3, Trade Secrets Law). Disclosure may occur orally, in writing, through technical means, or through an act or omission.

Information must meet all the conditions for protection (Art. 4, Trade Secrets Law): actual or potential commercial value arising from secrecy; no general public knowledge or public availability; confidentiality measures; and no characteristics of state secrets or another category of legally protected secrecy. A customer database, technology, or pricing calculation therefore depends on its content and access arrangements, not merely its filename.

The owner's rights arise once the regime is established (Art. 6, Trade Secrets Law). State registration, a patent, or a certificate is not required (Art. 1095 CC) to protect undisclosed information. Internal arrangements remain necessary: commercial value, the absence of free access, and protective measures are also conditions under civil legislation (Art. 98 CC).

What information cannot be kept secret

The owner defines the protected information but cannot include statutorily excluded categories (Art. 5, Trade Secrets Law). The complete list in that provision covers information:

• on property rights and transactions subject to state registration;
• in founding documents and documents confirming entries in state registers for legal entities, individual entrepreneurs, and dehkan farms operating without legal-entity status;
• in documents authorizing entrepreneurial activity;
• on a state institution's assets and its use of the relevant budget funds;
• on environmental pollution, fire safety, sanitary and epidemiological conditions, radiation conditions, food safety, and other factors affecting the safe operation of production facilities and public safety;
• on workforce numbers and composition, pay systems and working conditions, occupational safety, workplace injuries, occupational disease, and vacancies;
• on employers' wage and social-payment arrears;
• on violations of legislation and proceedings imposing liability;
• on the terms of privatization of state property;
• on non-profit organizations' income amounts and structure, asset amounts and composition, expenditure, employee or member numbers and remuneration, and use of unpaid labour;
• on persons authorized to act for a legal entity without a power of attorney;
• required to be submitted as state statistical reporting.

Information must also remain outside the regime where another law requires disclosure or prohibits restricting access. An NDA stating that “all information about the employer is secret” therefore cannot establish lawful trade-secret protection for working conditions, wage arrears, or violations. Exclusion from trade-secret protection does not itself authorize a breach of another applicable protection regime.

Which documents establish an effective regime

The regime is established once the owner implements the measures required by law (Art. 8, Trade Secrets Law). Confidentiality terms in civil-law contracts are a necessary part of the arrangements. An order introducing the regime and a trade-secret policy can consolidate organizational decisions, but a document's title cannot replace its substance or implementation.

The law specifies the mandatory protective measures (Art. 10, Trade Secrets Law). They can be documented as follows:

Passwords, permissions in information systems, transfer logs, and restrictions on uncontrolled copying are examples of technical implementation. The law permits additional lawful measures; these are selected to match how information is actually stored and transferred.

The Model Regulation registered under No. 2818 applies to organizations with state ownership exceeding 50%. For other organizations its provisions are advisory. Public-sector forms and procedures should therefore not automatically be presented as a mandatory package for every private company.

The employer must obtain the employee's signed acknowledgement (Art. 11, Trade Secrets Law) of the information list, regime, and liability rules, and create conditions enabling compliance. Employee consent is required if access is outside their employment duties. A clause prohibiting disclosure of legally protected secrets is expressly permitted in an employment contract (Art. 104 LC).

What an NDA should cover and duration

In dealings between businesses, the parties define the information and protection obligations (Art. 13, Trade Secrets Law). An NDA is a non-disclosure agreement; it may be a separate document or terms within the main contract. The ability to enter into contracts not specifically named in legislation follows from freedom of contract (Art. 354 CC).

The following is a practical checklist of terms, rather than a universal statutory form:

• information descriptions and appendices identifying the protected material;
• permitted uses, recipients, and transfer channels;
• safeguards and incident-notification procedures;
• evidence of transfer, return of media, and destruction of copies;
• the duration of obligations after the contract ends;
• procedures for mandatory disclosure to authorities;
• recoverable losses, contractual penalties, and their relationship to damages;
• procedures for checking protection and resolving disputes.

The owner may check the recipient's protection measures as provided by the contract (Art. 14, Trade Secrets Law). When changing or cancelling the regime, the owner must notify the recipient in writing within the contractual period and respect existing contractual obligations (Art. 9, Trade Secrets Law).

Protection lasts until confidentiality is lost (Art. 7, Trade Secrets Law). In employment relationships, the contract separately specifies the non-disclosure period after employment ends. Employees must not use the secret for personal purposes without employer consent and must return media or destroy the information under employer supervision when the contract ends. These duties appear in the provision on protection during employment cited above.

What liability follows disclosure

Liability depends on the wrongdoer's status, fault, damage, and the elements of the offence. An NDA payment claim, a disciplinary fine, and a public-law sanction have different legal grounds.

Disciplinary sanctions include a reprimand, a fine up to 30% (Art. 312 LC) of average monthly earnings, up to 50% in cases specified by internal work rules, or termination on the relevant grounds. Example. With assumed average earnings of UZS 6,000,000, the ordinary maximum fine is UZS 6,000,000 × 30% = UZS 1,800,000; where the internal rules provide for the higher limit, UZS 6,000,000 × 50% = UZS 3,000,000.

A single gross breach may justify termination of employment (Art. 161 LC). Such breaches are listed in internal work rules (Art. 162 LC), contracts with directors and other categories specified by the LC, or disciplinary statutes and regulations. The Supreme Court Plenum explains that dismissal for disclosure requires information entrusted through employment duties and evidence of culpable disclosure (para. 37, Resolution No. 26).

A written explanation must be requested beforehand; each breach attracts one disciplinary sanction (Art. 313 LC). The reasoned order must be presented for signature within three working days, excluding absence. The deadline is one month from discovery (Art. 314 LC), excluding sickness and leave, with an outer limit of six months from the breach or two years following an inspection of financial and business operations or an audit. Criminal proceedings are excluded from these periods; where an internal investigation is conducted, discovery is the date the commission signs its final report.

The main public-law sanctions appear below. CAL means the Code of Administrative Liability; CrC means the Criminal Code; one BRV, the base calculation unit, is the basis for the fines. The website recalculates UZS amounts using the current base.

The administrative provision concerning harm to an individual cannot automatically be applied to every leak involving only corporate data. The Criminal Code defines large-scale damage as 300 to 500 BRV, equivalent to UZS 132.000.000–220.000.000 using the current base. Unlawful collection under the first part of the cited criminal provision has no such damage requirement.

Obtaining, using, or disclosing a secret without the owner's consent is also a form of unfair competition (Art. 21, Competition Law). A business entity faces a sanction of 2% of relevant-market revenue (Art. 42, Competition Law) during the infringement period, limited to the preceding three years. A first infringement with low economic impact attracts a warning; fines are imposed by a court unless guilt is admitted and payment is voluntary. A warning requires assessment of the low-economic-impact conditions (para. 43, Regulation approved by Cabinet Resolution No. 225); being a first offence alone is insufficient. Example. With relevant revenue of UZS 1,000,000,000, the formula gives UZS 1,000,000,000 × 2% = UZS 20,000,000, assuming no grounds for a warning.

What can be recovered from an NDA counterparty

A civil-law NDA may support damages and an agreed contractual penalty, but the contractual amount is not automatically the amount a court awards. Damages include actual loss and lost profits (Art. 14 CC). If the breach generated income for the wrongdoer, the injured party may claim lost profits of at least that income alongside other losses.

The losses must be linked to the breach and supported by a substantiated calculation. Lost-profit assessment considers steps taken and preparations made (Art. 324 CC): a sales forecast alone does not establish that the income would have been earned. In economic court proceedings, each party proves the circumstances supporting its claims and objections (Art. 68, Economic Procedure Code).

Lost profits are calculated allowing for reasonable costs (para. 19, Plenum Resolution No. 163) that would have been incurred to earn the income. The entire value of a lost sale therefore cannot be treated as lost profit without that calculation.

A contractual penalty permits recovery of a specified amount without proving losses (Art. 260 CC), but a valid obligation and its breach still need to be established. The penalty agreement must be in writing (Art. 262 CC). There is no universal statutory “NDA tariff”: the applicable term determines the amount and the event triggering payment.

By default, damages are recovered to the extent exceeding the penalty (Art. 325 CC). Legislation or the contract may instead provide for the penalty alone, full damages in addition to the penalty, or a choice between the two. A court may reduce a disproportionate penalty (Art. 326 CC).

Example. Assume proven losses of UZS 80,000,000 and an agreed penalty of UZS 30,000,000. Under the default crediting rule, UZS 80,000,000 − UZS 30,000,000 = UZS 50,000,000 in damages beyond the penalty. Total recovery is UZS 80,000,000, rather than UZS 110,000,000. This illustration assumes established grounds for recovery and no judicial reduction of the penalty.

A special rule applies to business obligations: unless legislation or the contract provides otherwise, the party in breach is liable unless it proves force majeure (Art. 333 CC). Liability for an intentional breach cannot be excluded in advance.

The owner may also demand that unlawful use cease (Art. 1096 CC). A person who independently and lawfully obtains the same information may use it. Special rules protect a good-faith recipient of another person's secret: liability for losses from use begins once the recipient learns that use is unlawful; taking account of the recipient's expenditure, a court may permit continued use under a paid exclusive licence.

How much can be recovered from an employee

Calling a document an NDA does not change the limits on an employee's material liability. Contractual employee liability cannot exceed LC limits (Art. 317 LC). As a general rule, liability requires wrongful conduct involving fault, a causal link, and a proven amount of damage (Art. 318 LC).

An ordinary employee reimburses direct actual damage (Art. 337 LC), including the additional expenditure and payments covered by that provision; lost profits are not recoverable from that employee. The usual cap is average monthly earnings (Art. 340 LC), unless the Code provides otherwise.

Disclosure of a legally protected secret is a separate ground for full material liability (Art. 342 LC). This means full direct damage, rather than any penalty written into the NDA. An agreement on full liability for money or goods is not a universal instrument (Art. 343 LC): it is invalid where the employee's functions do not include handling such assets.

For employees under eighteen (Art. 341 LC), full liability is limited to intentional damage, damage caused under the influence of alcohol, narcotics, or toxic substances, and damage resulting from a crime or administrative offence. Merely describing the breach as “disclosure” therefore does not remove the age-related restrictions.

A separate rule covers an organization's director, deputy directors, chief accountant, and head of a separate division. They bear full liability for direct damage and, at the request of the owner, supervisory board, or another authorized body, must reimburse losses under civil-law rules (Art. 488 LC) caused by their culpable acts or omissions. A blanket statement that lost profits can never be recovered from an employee overlooks this rule.

Liability is excluded in specified statutory circumstances (Art. 338 LC): force majeure, justified business risk, necessity, necessary defence, or the employer's failure to provide proper storage conditions for entrusted property. A court may reduce the recovery amount (Art. 350 LC), considering fault, the circumstances, and the employee's financial position; reduction is prohibited for damage caused by a crime committed for personal gain.

Example. An ordinary employee is alleged to have caused UZS 12,000,000 in proven direct damage and UZS 90,000,000 in lost profits. If grounds for full liability for disclosure are established, the material-liability claim is UZS 12,000,000. Under the general rule, the UZS 90,000,000 in lost profits cannot be added.

Before recovery, the employer must conduct an internal investigation (Art. 344 LC), establish the amount and causes of damage, and request a written explanation; refusal is recorded with witnesses. An employer's order may recover no more than average monthly earnings if issued within one month (Art. 347 LC) of discovering the damage. A larger amount or expiry of that month requires court proceedings. The employer has one year from discovery (Art. 560 LC) to bring this claim.

General rules on calculating damage, voluntary reimbursement, and deductions are covered in the article on employee material liability. It is relevant once disclosure has been established and the company is choosing a recovery procedure.

Can employees be prohibited from competing

A blanket prohibition on joining a competitor after employment ends cannot be treated as enforceable merely because the employee signed an NDA. Freedom of labour includes choosing an occupation and workplace (Art. 5 LC), while employment terms that worsen the employee's statutory position are invalid (Art. 105 LC). Invalidity of that term does not invalidate the entire contract.

The implication of these rules is that a duty not to disclose or use protected information is different from prohibiting employment, business activity, or all contact with a former employer's customers. Joining another company does not itself prove disclosure. A non-solicitation clause must likewise be assessed by its substance: whether it protects a specific secret or restricts employment rights. Specifying a duration and paying compensation do not, by themselves, remove LC restrictions.

Secondary employment is other paid work under a separate contract outside the main job's working hours (Art. 432 LC). It may be internal or external. The law imposes specific restrictions (Art. 433 LC): for minors; for work in adverse conditions where the main job involves the same conditions, except employees of healthcare-system organizations; and in other cases specified by legislation. Restrictions may be introduced for particular occupations and positions with trade-union committee agreement where secondary employment threatens health or production safety.

External secondary employment by a director, deputy director, chief accountant, or head of a separate division requires owner or authorized-body permission (Art. 487 LC). These rules operate within their statutory scope; they do not give every employer a general right to prohibit a former employee's subsequent employment.

When secrets must be provided to authorities or courts

The regime does not permit refusal of every lawful request. Information is provided free of charge upon a reasoned request by an authorized authority (Art. 15, Trade Secrets Law), where needed within that authority's powers. An authorized official signs the request, which states its purpose, legal basis, and deadline unless legislation provides otherwise. Following refusal, the authority may seek a court order.

The receiving authority must maintain confidentiality (Art. 16, Trade Secrets Law). Its personnel must not disclose or transfer the information except as permitted by law, or use it for personal purposes.

Access in litigation is generally limited to the substance of the dispute (Art. 17, Trade Secrets Law). Unrestricted court access is permitted in disputes with state authorities; insolvency, liquidation, or cessation of the owner's activity; inheritance of the secret; division of spouses' joint property involving the secret; disputes between the owner and confidential recipient; and disputes between founders of the owner or recipient.

The general control procedure, inspectors' powers, and appeals are covered in the article on business inspections. It is relevant where a request for trade secrets forms part of a company inspection.

What changed in 2026

• From 17 March 2026, ZRU-1122 of 17 March 2026 amended the exclusion from trade-secret protection: it covers terms of privatization of state property, rather than only the terms of privatization tenders or auctions.
• ZRU-1122 of 17 March 2026 took effect on official publication. An internal information list must therefore reflect the current statutory wording and exclude privatization terms from trade secrets.

What owners should check before sharing information

Start with the specific information and recipient. Is the protected information and its scope defined; are legally open categories excluded; do handling procedures operate; is access recorded; are media marked; has the recipient signed the undertaking and acknowledged the regime; and is evidence of transfer retained? These questions connect the paperwork with actual protection.

For a business counterparty, separately check permitted use, duration, penalties, and loss calculations. For an employee, check duties, conditions enabling compliance, and applicable liability limits. Ending the contract or a single breach of non-disclosure obligations provides grounds for ending access (Art. 12, Trade Secrets Law), but ending access does not release confidentiality obligations. Returning media and disabling accounts should be recorded as implementation of the regime, rather than proof that a leak has already occurred.

Frequently asked questions

Is signing an NDA enough without a trade-secret policy?

A signature does not replace the information list, handling and control procedures, authorized-person records, or markings identifying the owner. These measures form the regime. They can be distributed across an order, policy, appendices, and recordkeeping documents: the law specifies the substance of protection. Employees also need to acknowledge the regime in writing and have conditions enabling compliance.

Can an NDA penalty be recovered from an employee?

Not every contractual amount is recoverable. Employee material liability must be distinguished from a disciplinary fine subject to statutory limits. Disclosure may justify recovery of full direct damage, but not an arbitrary contractual sanction. The management positions listed in this article are subject to a separate damages rule.

Can a former employee be barred from joining a competitor?

A general prohibition conflicts with freedom of labour and the invalidity of employment terms that worsen statutory rights. Post-employment confidentiality may be required for a contractual period, but it protects information. Joining a competitor does not itself establish disclosure. Secondary-employment restrictions for particular employee categories are not a general prohibition on employment after leaving a job.

Does an NDA continue after employment ends?

Ending access does not release an employee's confidentiality obligations. The law requires the contract to specify how long the employee must refrain from disclosure after employment ends. Protection also depends on the information remaining confidential. On departure, media must be returned or information destroyed under employer supervision; restrictions on use for personal purposes must also be reflected in the obligations.