What is the difference between a trade secret and personal data?

Personal data is information about an identified or identifiable person and falls under KVKK, Türkiye's data protection law. A trade secret is non-public business information that gives the organization value: formulas, processes, pricing, customer lists, strategies. The same document can contain both.

How does Seratus recognize trade secrets?

Through the business categories and confidentiality levels defined in the organization's taxonomy. Document type, content patterns and location are evaluated together, and results are refined with human-approved corrections. There is no fixed list of trade secrets; the categories are tuned per organization.

What is a confidentiality taxonomy?

A scale that grades documents from public to top secret. Each level is tied to policies that define who may access the document, how it may be shared and how long it is kept. Seratus ties labels to those policies and to retention and destruction processes.

How is the departing-employee risk reduced?

Before departure, a list of the high-confidentiality documents the employee can reach is produced; after departure, remaining access, unresolved SIDs and personal archive copies are cleaned up. Each step is written to the audit log.

Trade secrets and company secrets: a DSPM view of critical data

Trade secrets fall outside KVKK yet are an organization's most critical data: confidentiality taxonomy, classification, access narrowing, departing employees.

An organization’s most valuable data usually belongs to no single person, which is exactly why no personal data regulation covers it. Product formulas, manufacturing processes, pricing models, customer lists, purchasing terms, research results and strategy documents are trade secrets whose leak can affect the organization for years. A discovery and classification infrastructure built for KVKK compliance is incomplete if it is not also used to manage this data with the same discipline.

Trade secrets: critical data that is not personal data

The difference between personal data and a trade secret lies in the reason for protection. Personal data is protected because of the rights of the data subject, and KVKK, Türkiye’s data protection law, sets the framework for that protection. A trade secret is protected because of the value it gives the organization; being non-public, being subject to reasonable confidentiality measures and carrying economic value are its typical characteristics. Which information counts as a trade secret and how it must be protected is settled with counsel; this article is not legal advice.

What matters for data management is that the two categories usually sit inside the same documents:

A customer contract contains both the personal data of the customer’s representative and the customer-specific pricing terms.
A research report carries both the health data of trial participants and the formula.
A sales deck holds both a list of customer contacts and the target-market strategy.

A “separate tool for personal data, separate tool for trade secrets” approach therefore produces two scans, two classifications and inconsistent access policies. The right approach is a single discovery and classification engine that produces labels on three axes: data type, confidentiality level and business category.

The confidentiality taxonomy: scale and policy

The confidentiality level is the scale that decides who may see a document and how it may travel. A typical scale has four or five tiers:

Level	Typical content	Typical policy
Public	Product brochures, press releases, published price lists	Unrestricted sharing
Internal	Procedures, general announcements, training material	Within the organization; external sharing needs approval
Confidential	Customer contracts, cost sheets, planned prices	Role-based access; no external sharing
Top secret	Formulas, research results, merger and acquisition files, strategic plans	Named individuals, logged access, no link sharing

The scale itself is nothing new; the problem is that it lives only in a policy document and has never been applied to actual files. Employees do not label documents; even when they do, the label is not tied to access and sharing controls. The result is a document class defined as “top secret” being shared with an “everyone in the organization” link.

The Seratus data classification capability derives the confidentiality level from content and context, refines it through human-approved corrections and ties labels to policies and to retention and destruction processes. The taxonomy is managed by the organization: the number of tiers, their names and the rules for each are set to the organization’s own policy.

Where it accumulates and how it leaks

Trade secrets overlap heavily with competitively sensitive information but are broader; technical and operational knowledge is included. Typical accumulation points:

Research and engineering shares. Formula and recipe files, design documents, test results, source code exports.
Manufacturing. Process parameters, quality control criteria, supplier specifications.
Sales and marketing. Customer lists, pricing models, campaign plans, win/loss analyses of bids.
Management and finance. Budget and planning decks, merger and acquisition files, board material.
Microsoft 365. Drafts attached to Teams chats, personal copies in OneDrive, “share with everyone” links.
Databases and object storage. Price and cost tables, product recipe tables, models and datasets in S3.
Mail archives. Years of bid, contract and strategy correspondence.

The leak paths are just as predictable: broad permissions, external sharing links, personal cloud and USB copies, files taken along by departing employees, and documents uploaded to supplier portals beyond what was needed. What these paths have in common is that every one of them can be seen in advance through discovery and access analysis.

The departing-employee risk

The most discussed trade secret leak scenario is the departing employee. The problem has two sides: not knowing which documents the employee could reach before leaving, and access not being fully removed after leaving.

The first side is solved with visibility before departure. The access graph lists the high-confidentiality documents a given user can reach directly and through groups. That list gives the exit interview and the return-of-property process a concrete basis; “which documents did they see” is answered from a record, not a guess.

The second side is solved with cleanup after departure. Even when the account is disabled, unresolved SIDs remain in ACLs; sharing links stay active; copies in the employee’s OneDrive may never have been transferred; a PST archive sits on a file server. Seratus shows these leftovers as “departed user access” and “unresolved SID” findings; permission removal and quarantine actions run through the approval workflow.

A principle from KVKK’s Board Principle Decision 2026/2035 of 16 September 2026 is worth recalling here: after the employment relationship ends, an employee’s communication data is not indefinitely accessible to the employer; access must be limited to specific staff and logged. While searching a departed employee’s mail archive for trade secrets, those limits apply to the personal correspondence in the same archive. Seratus shows findings as masked samples; full content is opened only inside an approved review workflow and under record.

Narrowing access: applying least privilege to documents

The most effective control for protecting trade secrets is limiting access to the people who actually need it. Everyone accepts the principle; it goes unapplied because nobody knows which document can be reached by whom.

Narrowing access proceeds in three steps. First, the current access list for high-confidentiality documents is produced: direct permissions, group memberships, circular groups, sharing links. Next, the list is reviewed with the document owner and those without a need are identified. Finally, permission removal runs through the approval workflow and is written to the audit log.

The Seratus access and exposure graph supports each of these steps: overshared and public documents, “everyone in the organization” and anonymous links, orphaned and departed user access, unresolved SIDs and circular group memberships are prioritized together with the document’s confidentiality level. A “top secret” document with broad access appears at the top of the list.

Example scenario: formula files at a pharmaceutical and chemicals company

At a pharmaceutical and chemicals company, the research team keeps formula and process documents on a SharePoint site. The site was opened to the “all research” group years ago; over time the group came to include intern and consultant accounts. Some documents were shared with a manufacturing partner through anonymous links that were never revoked. The copies in a departed process engineer’s OneDrive were never transferred, and his PST archive sits on a file server.

In this scenario Seratus flags documents matching the “formula” and “process document” categories as “top secret”; the access graph shows the intern and consultant accounts reaching them through the group, the active anonymous links and the departed user’s remaining access. In the review queue the research director and the information security officer narrow access to a named list, revoke the links, quarantine the OneDrive copies and route the PST archive into the review workflow. Each decision is recorded with its reason. The example is anonymous and hypothetical.

How Seratus closes these gaps

Gap 1: Trade secrets appear in no inventory. The same agentless discovery engine produces business category and confidentiality level across file servers, local disks, Microsoft 365, databases, S3-compatible object storage and mail archives; no separate scan is needed for trade secrets. Details: agentless DSPM.

Gap 2: The confidentiality level exists in policy but not on files. A manageable taxonomy, human-approved corrections and labels tied to policy and to retention and destruction processes; the label application action runs through the approval workflow.

Gap 3: “Top secret” documents have broad access. The access and exposure graph prioritizes oversharing on high-confidentiality documents, anonymous and “everyone in the organization” links and circular groups; permission removal is approved and logged. Details: Microsoft 365 integration.

Gap 4: Departing employees’ access and copies are not cleaned up. Departed user access, unresolved SIDs, untransferred OneDrive copies and PST archives are listed as findings; quarantine and permission removal actions are assigned to an owner.

Gap 5: Price, recipe and model data in databases and object storage is invisible. Sampling-based classification and a role-to-table permission graph for Oracle, SQL Server and PostgreSQL/MySQL; object-level classification and access information for S3-compatible storage. Details: object storage (S3).

Gap 6: Concern that the protection tool itself could leak data. Seratus runs on-premises and supports air-gapped networks; connections are read-only; console access is role-based; optional LLM enrichment runs only on the organization’s own or self-hosted model; no data goes to external AI services.

Takeaway

Trade secrets fall outside regulation-driven compliance programs because they are not personal data, yet they are the class of data whose leak has the longest-lasting effect. The discovery, classification and access analysis infrastructure built for KVKK manages this data with the same discipline once it is extended with a confidentiality taxonomy. Seratus produces type, confidentiality level and business category with a single engine, narrows access, cleans up what departing employees leave behind and proves every step.