Former Employee Taking Your Clients and Confidential Information: What a Singapore Company Can Do

General information only, not legal advice. Need a lawyer for this? We can introduce you to one. See below.

Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.

It usually starts with a phone call from a long-standing client. They are moving their account, and the person they will now deal with is your former sales manager, who left three weeks ago to join a competitor or to set up on their own. A check of the company’s systems then shows that, shortly before resigning, the same employee forwarded client lists, price sheets and proposals to a personal email address.

For a Singapore company this is one of the most common, and most time-sensitive, disputes with former staff. Clients and confidential information are often the most valuable assets an SME has, and they can walk out of the door with a single person. This article explains what protects the company in law, how Singapore courts have approached these cases, and what the board should do in the first days after discovering the problem.

Three layers of protection

A company’s rights against a departing employee usually come from three separate sources. They overlap, and a strong claim often relies on more than one.

Restrictive covenants: non-solicitation, non-dealing and non-compete clauses

Singapore courts start from the position that a clause restraining an employee after employment is unenforceable unless the employer shows it is justified. In Smile Inc Dental Surgeons Pte Ltd v Lui Andrew Stewart [2012] SGCA 39, the Court of Appeal, following its earlier decision in Man Financial (S) Pte Ltd v Wong Bark Chuan David [2007] SGCA 53, set out the approach. The first question is whether the employer has a legitimate proprietary interest to protect, beyond simply wanting to avoid competition. Client connections and goodwill can qualify. Only if there is such an interest does the court ask whether the restraint is reasonable between the parties and in the public interest. Covenants in employment contracts receive stricter scrutiny than those in a sale of business, because of the unequal bargaining power.

Smile Inc also shows how a poorly drafted clause can fail completely. The dental practice’s restraints had no time limit. The Court of Appeal held that a restraint of indefinite duration was unreasonable and void, and the court would not rewrite the clause to insert a sensible period. The employer lost, even though the dentist had breached the clauses as written.

Points that usually matter when a company looks at its own clauses:

• Type of restraint: a non-solicitation clause (no approaching the company’s clients) is generally easier to justify than a full non-compete.
• Scope: restricting contact with clients the employee actually dealt with in, say, the last 12 months is more defensible than all clients worldwide.
• Duration and area: there must be a period, and it must be no longer than reasonably needed to protect the interest.
• Seniority: a restraint that may be reasonable for a sales director may be unreasonable for a junior executive.
• Proof of solicitation: in Smile Inc, advertising and a similar price list were not enough to prove solicitation of patients.

Our earlier article on enforcing non-compete and restraint of trade clauses covers drafting in more detail.

The duty of good faith and fidelity while still employed

An employee owes the employer an implied duty of good faith and fidelity throughout employment, including any notice period or garden leave. Diverting clients to a new business before leaving, or copying client files for later use, may breach that duty even if there is no restrictive covenant at all.

The duty has limits. In Smile Inc, the Court of Appeal held that preparatory steps, such as incorporating a company, leasing premises and discussing a future venture with a colleague, were not breaches. The court also distinguished the duty of fidelity from fiduciary duties: an employee without management authority was not a fiduciary. A senior manager or a director is in a different position, and directors owe fiduciary duties to the company that can make diverting a business opportunity a serious breach.

Breach of confidence after I-Admin

For many companies, the strongest claim is not the restrictive covenant but breach of confidence, because it does not depend on a well-drafted clause and has no fixed expiry.

In I-Admin (Singapore) Pte Ltd v Hong Ying Ting and others [2020] SGCA 32, former employees of a payroll software company had set up a competitor. The company’s source code, client data and business materials were found on their devices and in their emails. The High Court had dismissed the claim because the company could not prove the material had actually been used. The Court of Appeal allowed the appeal and modified the law.

Under the modified approach, the company must still show that the information has the necessary quality of confidence and was received in circumstances importing an obligation of confidence. An obligation also arises where the information was accessed or acquired without the owner’s knowledge or consent. Once that is shown, a breach is presumed, and the burden moves to the defendant to show that its conscience was unaffected, for example because it came across the information by accident or did not know it was confidential. The court noted that owners often discover breaches late, and that the defendant is better placed to explain what it did.

Two practical lessons follow from I-Admin:

• The company does not need to prove that the stolen client list was actually used to win clients. Unauthorised taking and keeping can be enough.
• Remedies may be modest if the employee has stopped using the material. The court refused an injunction and an account of profits there, and awarded equitable damages measured by the value of the information to the defendants, such as the time and cost they saved, sending the amount back for assessment.

Personal data: the PDPA angle

Client lists usually contain personal data. Under section 48D of the Personal Data Protection Act 2012, an individual who knowingly or recklessly discloses personal data held by an organisation without its authority commits an offence. Section 48E creates a similar offence for unauthorised use that brings a gain, or causes harm or loss. Each carries a fine of up to S$5,000, imprisonment of up to 2 years, or both. These offences sit alongside the company’s civil claims.

The company must also look at its own obligations. If the incident is a notifiable data breach, section 26D requires the organisation to notify the Personal Data Protection Commission no later than 3 calendar days after assessing it as notifiable. See our guide to mandatory data breach notification.

The first days after you find out

1. Cut off access: disable the former employee’s email, cloud, CRM and remote access, and change shared passwords.
2. Preserve evidence: do not wipe or reissue the employee’s laptop or phone. A forensic image taken by a specialist is far more persuasive than screenshots.
3. Pull the logs: email forwarding, downloads, USB activity and file access records around the resignation date.
4. Identify the clients affected and record what each one has said, when and to whom.
5. Check the paperwork: the signed employment contract, any handbook confidentiality policy, the resignation letter and exit documents.
6. Take advice on a letter of demand seeking undertakings, return and deletion of material, and an account of dealings. Where there is a real risk that evidence will be destroyed, lawyers may consider an urgent court order; see our article on Anton Piller orders.

Avoid reacting in ways that weaken the company’s position, such as contacting the new employer with accusations that cannot yet be proved, or making statements to clients that could be defamatory.

What the company should do

• Board minutes: record the board’s decision to investigate, to engage forensic specialists and lawyers, and to commence or settle proceedings, and who has authority to instruct them.
• Registers and ACRA filings: if the person was also a director or company secretary, make sure the resignation or removal is lodged with ACRA within the required time and the register of directors is updated, so that the person cannot continue to hold themselves out as an officer.
• Accounts: record legal and forensic costs properly, and consider with the company’s accountant whether any claim, provision or contingent liability needs to be disclosed in the financial statements.
• HR records: keep the investigation file, the signed contract and exit documents in a secure place. Our guide on handling employee misconduct and investigations covers process.
• Fix the gaps: review contracts for current staff, add reasonable non-solicitation and confidentiality clauses, restrict downloads and personal email forwarding, and run exit checklists.

Disputes over former employees sometimes overlap with disputes about who could bind the company in the first place, for example where a departing manager signed side deals with clients. Our article on whether a company is bound by a contract signed without authority explains that issue.

Frequently asked questions

Can we stop a former employee from working for a competitor?

Only if there is an enforceable restrictive covenant, and full non-compete clauses are the hardest to enforce. The company must show a legitimate proprietary interest and that the restraint is reasonable in scope, area and duration. A clause with no time limit is likely to be void.

The clients approached the former employee, not the other way round. Is that solicitation?

Possibly not. Solicitation generally requires the employee to have initiated or encouraged the approach, and general advertising may not be enough, as Smile Inc shows. A non-dealing clause, which prohibits doing business with certain clients at all, is drafted to deal with this situation but must also be reasonable.

Do we need to prove that the former employee used our client list?

Not necessarily. Under the modified approach in I-Admin, once the company shows the information was confidential and was taken without consent, a breach is presumed and the employee must explain. Proof of use still matters for the remedy.

Is taking a client list a criminal offence?

It can be. Where the list contains personal data, sections 48D and 48E of the PDPA make unauthorised disclosure and certain unauthorised uses offences. Whether to report the matter is a decision to take with legal advice, because it can affect the civil claim.

How quickly do we need to act?

As quickly as possible. Courts are more willing to grant urgent relief where the company moved promptly, and delay makes evidence harder to preserve. Clients also tend to settle into new relationships within weeks.

Need a lawyer?

This article is general information about Singapore law for companies, directors and shareholders. It is not legal advice, and it does not take account of your circumstances. Raffles Corporate Services Pte Ltd is a corporate service provider, not a law practice, and does not give legal advice.

If a former employee has taken your company’s clients or confidential information, we can introduce you to an experienced Singapore law firm that handles employment, restraint of trade and breach of confidence disputes. Tell us briefly what has happened and we will connect you.

Email: [email protected]
WhatsApp: +65 8501 7133 or +65 9018 0072

We can also take care of the corporate side for you: board and shareholder resolutions, register updates and ACRA filings.

Conclusion

A Singapore company is not powerless when a former employee takes its clients or confidential information. Reasonable restrictive covenants, the duty of fidelity during employment and, above all, the law of breach of confidence as reshaped by I-Admin give real protection. Results depend on what the contract says, what the evidence shows and how quickly the company moves. The text of the PDPA provisions mentioned above is on Singapore Statutes Online, and the Personal Data Protection Commission publishes guidance on data breaches. For help with the board resolutions, register updates and ACRA filings that follow a senior departure, speak to Raffles Corporate Services.

The Editorial Team, Raffles Corporate Services