Protecting Trade Secrets Before Franchising Your Business

Franchising a business means teaching others the ways of working that make it successful. But not every prospective franchisee or outlet employee needs access to all your know-how. In franchising, trust needs to be backed by clear access controls. Before offering a franchise in Indonesia, put measures in place to protect trade secrets without hindering required disclosures or franchisees’ ability to run the business.

1. Separate trade secrets from ordinary information

Not every internal document automatically qualifies as a trade secret. Indonesia’s Law No. 30 of 2000 on Trade Secrets protects technological or business information that is not publicly known, has economic value because it is useful in business activities, and is kept confidential by its owner.

This can include production, processing and sales methods, or other information that meets those requirements. Unlike trade marks, protection does not depend on registration. Simply marking something ‘confidential’ is therefore not enough: practical steps to safeguard the information matter.

Start by listing the information that genuinely gives your business an advantage, such as:

• A seasoning formula whose composition is not publicly available.
• Processing parameters that ensure consistent results.
• A pricing method based on your internal cost structure.
• Unannounced sales strategies with commercial value.

For each item, record its owner, where it is stored, who needs access and the risks if it is leaked. Do not classify published information, or information customers can readily discover, as secret simply because you want to prohibit its use.

Make sure ownership is clear, too. If a consultant developed a formula, or a method was created jointly with another party, review the development contract before promising franchisees the right to use it.

2. Set disclosure boundaries before making an offer

Indonesia’s main franchise regulation is Government Regulation No. 35 of 2024 on Franchising, which replaced Government Regulation No. 42 of 2007. It governs franchise criteria, offering prospectuses, agreements and the Franchise Registration Certificate, known locally as the STPW.

Franchisors must provide prospective franchisees with a prospectus at least 14 calendar days before the agreement is signed. The minimum information required includes the business system and financial statements for the past two years. Confidentiality must not be used as a reason to omit mandatory disclosures.

Distinguish between explaining the business system so a prospective franchisee can assess the offer and providing the confidential technical details needed to operate an outlet. Prospective franchisees need to understand the business activities, their obligations and the support available. Access to a complete formula, however, can be managed according to need and the stage of the relationship, provided all mandatory disclosure requirements are met.

Use three access levels as a practical framework:

1. Public information: the business profile, products and an overview of the franchise opportunity.
2. Assessment information: the prospectus and supporting documents for prospective franchisees’ due diligence, subject to appropriate confidentiality arrangements.
3. Restricted operational information: formulas or specialist methods for those who actually need to use them.

A confidentiality agreement does not replace the prospectus, STPW or franchise agreement. Trade secret protection also does not automatically satisfy the requirements for recorded or registered intellectual property under Government Regulation No. 35 of 2024; check compliance with those criteria separately.

3. Draft clauses franchisees can put into practice

Avoid clauses that simply state ‘all information is confidential forever’. An overly broad definition makes it harder for employees to understand their obligations and can trigger disputes over information that is already public.

Ask a legal adviser to help draft provisions covering at least:

• Scope of protection: the categories of information covered and how to identify confidential documents.
• Permitted use: solely to assess the offer or operate the agreed outlet.
• Permitted recipients: employees, advisers or service providers who need access and are bound by confidentiality obligations.
• Exceptions: information that has lawfully become public or must be disclosed by law.
• Security measures: prohibitions on sharing accounts, making unauthorised copies or storing documents on unapproved devices.
• Handling leaks: duties to report incidents, preserve evidence and co-operate in limiting further disclosure.

Distinguish permission to use business know-how from a transfer of ownership. Also explain when copies must be returned or deleted once access is no longer needed, taking account of legal document-retention obligations.

If the arrangement constitutes a trade secret licence, Law No. 30 of 2000 requires the licence agreement to be recorded. Without this, the agreement has no legal effect against third parties. Seek legal advice on how this applies to your suite of agreements.

4. Demonstrate security in day-to-day operations

Contracts must be supported by working practices. Use individual accounts, restrict access according to job responsibilities, and keep records of access being granted and revoked. Sensitive documents should be kept in controlled storage rather than circulated through general group chats.

Check that franchisees can still operate within these limits. For example, production staff need process parameters, but cashiers do not need the complete formula. Do not restrict information so tightly that an outlet cannot maintain product quality or safety.

Establish procedures for employees who change roles or leave: revoke account access, check devices and remind them of their confidentiality obligations. If you suspect a leak, secure the evidence first and seek advice on legal steps; avoid making public accusations without an investigation.

Practical step: before offering a franchise, choose your five most sensitive pieces of information, decide who may access them, then test whether your contracts and everyday security measures genuinely protect them.