Protecting Trade Secrets Before Franchising Your Business

Franchising a business means sharing the knowledge that enables others to run it. But sharing your system does not mean giving everyone access to every piece of information. Before recruiting franchisees, business owners need to decide what must be taught, what should be shared only on a restricted basis, and how to keep it confidential. Within a franchise network, effective protection must go hand in hand with transparency and franchisees’ ability to operate their outlets.

1. Distinguish trade secrets from routine operational knowledge

Not everything in an operations manual is a trade secret. A publicly observable way of greeting customers is different from a seasoning formula, a specialist processing method or a purchasing cost breakdown that is not publicly known.

Indonesia’s Law No. 30 of 2000 on Trade Secrets protects information in technology or business that is not publicly known, has economic value because it is useful in business activities, and is kept confidential by its owner. Its scope includes production, processing and sales methods, as well as other information that meets these requirements.

Simply marking something ‘confidential’ is therefore not enough. Owners must take reasonable and appropriate steps to protect the information. Unlike trade marks, trade secrets are not protected through registration.

Draw up an inventory of information in three categories:

• Public: product information intended to be shared with customers.
• Internal: working procedures needed by the entire outlet team.
• Restricted: formulas, process parameters or commercial data needed only by people in certain roles.

For each item of restricted information, record who owns it, why it has economic value, who needs access and how it is stored. Do not automatically treat a supplier list as confidential if everything in it is already publicly available.

2. Map out when information needs to be shared

Government Regulation No. 35 of 2024 on Franchising, which replaced Government Regulation No. 42 of 2007, is the main regulatory framework for franchising in Indonesia. Among other criteria, it requires a business system and intellectual property that has been recorded or registered. Protecting trade secrets does not remove the need to check compliance with these franchise criteria.

The regulation also requires the Franchise Offering Prospectus to be provided at least 14 calendar days before the agreement is signed. Do not use confidentiality as a reason to withhold information that must be disclosed to prospective franchisees.

Equally, prospective franchisees do not always need a complete formula to assess an offer. Structure access in stages according to need:

1. Initial discussions: provide an overview of the system, investment requirements and operational responsibilities without revealing confidential details.
2. Assessment of the offer: provide mandatory disclosures and relevant information for evaluating the business; use a confidentiality agreement for sensitive documents where necessary.
3. Pre-opening preparations: give franchisees and the staff who will actually use it access to technical material.
4. Ongoing operations: maintain role-based access rather than granting access simply because someone works at the outlet.

Do not fragment information to the point where franchisees cannot maintain quality, calculate costs or meet product safety obligations. Access restrictions should protect the business, not create a dependency that was never explained at the outset.

3. Set confidentiality obligations that can be put into practice

Confidentiality agreements signed before information is disclosed should be consistent with the clauses in the franchise agreement. Avoid wording that merely states ‘all information is confidential’ without defining its scope or setting out procedures.

Discuss at least six points with your legal adviser:

• What is protected: the categories of information and how to identify protected documents.
• Permitted use: information is to be used to run the agreed business, not for other purposes.
• Authorised recipients: who may receive the information, including employees or service providers who need it.
• Exceptions: information that has lawfully become public, has been lawfully obtained from another party, or must be disclosed by law.
• Handling leaks: obligations to report incidents, secure access and co-operate with investigations.
• Ending access: returning or deleting copies, while observing statutory document retention requirements.

Also address the continuation of confidentiality obligations after the business relationship ends, for as long as the information still qualifies for protection. Do not equate confidentiality obligations with sweeping non-compete restrictions; each requires a separate legal assessment.

Where the arrangements include a trade secret licence, Law No. 30 of 2000 requires the licence agreement to be recorded. An unrecorded agreement has no legal effect against third parties. Seek specific advice on whether recording is required, rather than assuming that a confidentiality clause automatically covers everything.

4. Demonstrate protection through everyday working practices

Legal documents need to be backed by day-to-day controls. Use individual accounts for restricted material, avoid shared passwords, and keep records of access being granted and withdrawn. Sensitive training material should not be shared through chat groups whose membership is not properly managed.

Test these controls at your own outlets before introducing them to franchisees. Simulate an employee changing roles, a work phone being lost and an outlet manager resigning. Check whether access can be withdrawn promptly and document copies traced without interrupting service.

If you suspect a leak, first secure access logs and records of communications. Contain any further disclosure, then assess the incident with your legal adviser rather than immediately accusing a particular party.

Practical step: start with your single most valuable piece of information. Decide who may access it, put written obligations in place, then test how access can be withdrawn. Protection you can demonstrate is more useful than a ‘confidential’ stamp on every document.