IP Standard Operating Procedure - Minimising IP Risks from Exiting Employees

Introduction and Purpose:

Standard Operating Procedures (SOPs) are essential for a strong IP strategy. The following provides a general framework to enable your deep tech company to minimise the IP risks that can arise when an employee exits. You are encouraged to adapt this SOP framework to the unique circumstances of your company.

Procedure:

Schedule exit interview and set agenda:

• Prior to a departing employee’s last day, schedule an exit interview with the departing employee that may include the presence of legal counsel. Notify the departing employee of the main purpose of the exit interview, which for the purposes of this SOP, includes discussing IP-related matters.

?

Key IP-related contracts:

• Confirm that the departing employee has signed all relevant IP assignment, confidentiality, and non-compete agreements (if relevant). Double check to ensure that the company has clear ownership of intellectual property created by the departing employee during the course of their employment.

?

Departing employee’s IP obligations documentation:

• Provide departing employee, via email or other communication platform, with a comprehensive document reiterating their obligations and responsibilities regarding IP protection. The documentation should highlight any specific trade secrets that especially need to be kept confidential. The documentation should ideally include examples or scenarios to clarify what constitutes confidential information or trade secrets. The departing employee is required to sign an acknowledgement of receipt and understanding of these IP obligations.

IP asset identification:

• Create an inventory of relevant IP-related documents, code repositories, research materials, and any other sensitive information associated with the departing employee. Note this in an excel spreadsheet or equivalent. ?
• Identify any trade secrets that may be at risk and implement additional safeguards, such as restricting access to sensitive information, implementing encryption, or introducing access control measures.
• Store all documentation in relevant repository following the company’s file and document naming conventions.

?

Project involvement:

• Document the departing employee's involvement in ongoing projects, research, development, or any other IP-related activities. Note this in an excel spreadsheet or equivalent (document the information, such as project names, dates, and the employee's role).
• Store all documentation in relevant repository following the company’s file and document naming conventions.

Company asset identification:

• Create a checklist (e.g. in excel spreadsheet or equivalent) of all company property assigned to the departing employee, including laptops, mobile devices, access cards, physical documents, and any other assets.
• Store all documentation in relevant repository following the company’s file and document naming conventions.
• Ensure that the departing employee returns all company-owned property before or on their last working day (before close of business) to “x” person / “x” location. ?
• Note on the checklist any company assets not returned or returned in a damaged or less than complete edition.
• Store all documentation in relevant repository following the company’s file and document naming conventions.
• Set appropriate alerts / reminders to follow-up about any unreturned, missing, or damaged assets.

?

During the exit interview:

• Reinforce the importance of IP protection and the departing employee's responsibilities as set out in confidentiality and non-disclosure agreements.
• Receive the signed IP obligation document from departing employee.
• Answer any questions or concerns the departing employee may have regarding IP protection and provide clarifications where necessary – which may include referring such questions to legal counsel.
• Obtain information about the departing employee's new employer (which could help determine the potential risk of misuse of the company’s confidential information) – e.g. name of employer, industry, job role.
• If relevant, confirm the departing employee will continue to assist the company with any IP of which they are an inventor / author.
• If relevant, query the departing employee about any missing or unreturned or damaged company assets. Involve legal counsel if necessary.
• Store all documentation in relevant repository following the company’s file and document naming conventions.

?

Notifying the IT department:

• Notify the IT department within 14 days of the employee's departure date to disable access rights and accounts within 1 day after the departing employee’s last day. (I.e. disable the departing employee's access to all company systems, networks, online platforms, email accounts, intranet access, VPN access, and any other relevant systems [list relevant systems, etc.])
• Reset passwords for shared accounts or systems that the departing employee had access to, ensuring that they no longer possess any valid login credentials [list relevant accounts].

?

Company asset follow-up:

• If necessary, follow-up on any missing company assets that the departing employee has not yet returned and ensure these are returned (ideally within 1 week of employee departing).

?

Check for IP breaches:

• Within 1 month of the departing employee leaving, with IT department, examine all work computers, hard drives, mobile devices, and removable devices used by the departing employee for any evidence of misuse of confidential information / IP assets.
• Within 1 month of the departing employee leaving, with IT department, examine the departing employee’s work email mailbox for at least the last 60 to 90 days of employment for any evidence of removing or deleting files, forwarding or downloading of sensitive IP-related documents.
• Within 1 month of the departing employee leaving, with IT department, via access logs and other security mechanisms examine for any evidence the departing employee was involved in removing or deleting files, forwarding or downloading of sensitive IP-related documents.
• Within 1 month of the departing employee leaving, with IT department, conduct a thorough data wipe on any company-provided devices returned by the departing employee to prevent unauthorised access to company IP.
• Store all documentation in the relevant repository following the company’s file and document naming conventions.

?

Monitor ex-employee’s new employer for IP risks:

• If the departing employee’s new employer is a major competitor, monitor actions of departing employee’s new employer for any evidence of trade secret misuse (e.g. check press releases and social media feeds on a monthly basis and set reminders / alerts to do so).

Disclaimer: this article is for education purposes only and should not be construed as legal or financial advice.