This post uses hypothetical scenarios for illustrative purposes only. It does not describe any actual client, transaction, or representation, and is not legal advice.
Here is the Florida trade-secret story founders almost never hear before a data room opens. A Florida target — a SaaS company with a proprietary pricing algorithm, or a specialty manufacturer with a customer list built over twenty years, or a professional services firm with a defined engagement methodology — signs an LOI with a strategic buyer. Before the buyer’s team can touch the target’s numbers, the parties sign a mutual NDA. The NDA is boilerplate. It defines “Confidential Information” as any non-public information disclosed by one party to the other. It requires the receiving party to use reasonable measures to protect the information. It has a two-year term. Nothing in it references the Florida Uniform Trade Secrets Act at § 688.001 through § 688.009. Six weeks later the deal falls apart. Nine months after that, the buyer’s competing product ships with pricing logic that looks a lot like the target’s algorithm. The target’s litigation counsel opens the NDA, opens the statute, and discovers that the strongest remedies available under Florida trade-secret law depend on paperwork the target never asked for.
Florida’s Uniform Trade Secrets Act, codified at Chapter 688 of the Florida Statutes and reachable through the Florida Senate’s official statute portal at flsenate.gov/Laws/Statutes/2024/Chapter688, is one of the most powerful and most under-invoked bodies of Florida commercial law in the M&A context. The statute exists precisely to protect the kind of information that gets disclosed during a diligence room. And yet the standard mutual NDA that Florida targets sign before diligence begins almost never references it — which means the statute’s most valuable remedies are quietly forfeit before the buyer even logs into the data room.
What § 688.002(4) actually requires
The definitional heart of Florida trade-secret law sits at § 688.002(4). A “trade secret” is information — including a formula, pattern, compilation, program, device, method, technique, or process — that derives independent economic value from not being generally known and not being readily ascertainable by proper means, and that is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.
The four-element test collapses into two operational questions. Does the information have independent economic value from secrecy? And is the owner making reasonable efforts to maintain secrecy? The first question is usually easy — pricing models, customer lists, source code, proprietary methodologies, and negotiated vendor terms all clear the bar. The second question is where trade-secret protection is won or lost. Florida courts have been consistent that “reasonable efforts” is a fact-intensive inquiry, and the paper trail on secrecy measures is what plaintiffs live and die on when the case gets to summary judgment.
An NDA is one of the most important pieces of that paper trail. A generic mutual NDA that treats “Confidential Information” as an undifferentiated category, without any reference to trade-secret classification, tends to prove the opposite of what the target needs to prove — it shows that the target treated its trade secrets the same way it treated general commercial information, which is not the treatment § 688.002(4) contemplates.
Why the statute reference matters for remedies
The remedies under Chapter 688 are materially stronger than the general contract-damages remedies available for an NDA breach. Section 688.004 authorizes damages for actual loss, damages for unjust enrichment not accounted for by actual loss, and, in cases of willful and malicious misappropriation, exemplary damages of up to twice the compensatory award. Section 688.003 authorizes injunctive relief against actual or threatened misappropriation and permits the court to order affirmative acts necessary to protect the trade secret. Section 688.005 authorizes attorney’s fees for the prevailing party in cases of willful and malicious misappropriation or bad-faith litigation. And § 688.007 preempts conflicting state tort remedies, which means the trade-secret claim is often the only well-formed civil claim the target has.
The statute of limitations under § 688.007 is three years from the date the misappropriation was discovered or reasonably should have been discovered. That is a longer runway than the two-year contract term typical of the boilerplate NDA — a target relying only on the NDA’s own remedies loses meaningful claim window as soon as the NDA term expires.
An NDA that expressly references § 688.001 through § 688.009, defines the target’s trade secrets as “Trade Secrets” within the meaning of § 688.002(4), and preserves the statutory remedies in a specific carve-out from any limitation-of-liability clause preserves the statutory posture. An NDA that treats the trade-secret disclosure as generic “Confidential Information” and caps damages at direct losses argues its way out of exemplary damages, out of fee-shifting, and often out of the injunction as a practical matter.
The DTSA overlay and the notice-of-immunity requirement
The federal Defend Trade Secrets Act at 18 USC § 1836 creates a parallel federal cause of action for trade-secret misappropriation that is available for any trade secret related to a product or service used in or intended for use in interstate or foreign commerce. For a Florida target with any national customer base or interstate supply chain, the DTSA claim is generally available and generally worth preserving.
The DTSA carries its own drafting hook. Section 1833(b)(3) provides that an employer may not recover exemplary damages or attorney’s fees in a DTSA action against an employee or contractor unless the employer provided a notice of the whistleblower immunity — the notice that federal law protects certain disclosures of trade secrets to government officials and in court filings. The notice must appear in “any contract or agreement with an employee that governs the use of a trade secret or other confidential information.”
In the M&A context, the DTSA notice-of-immunity requirement most commonly gets missed in the pre-diligence NDA signed by the buyer’s employees who will access the data room. The NDA that binds the buyer’s diligence team is a contract governing the use of confidential and potentially trade-secret information — the notice belongs in that document. A target that later sues under the DTSA and has not included the notice loses the exemplary damages and fee-shifting elements of the statutory recovery, which is often the entire economic case.
LOI-stage NDA versus diligence-stage NDA
The pattern most Florida targets follow — one NDA, signed at the very beginning of buyer conversations, used for everything through closing — is not the right pattern for a trade-secret-heavy target. Two NDAs work better.
The LOI-stage NDA is thin. It covers the exchange of financial summaries, the identity of the parties, and the fact of the discussion itself. It does not need to reference § 688.001 because no trade secret is being disclosed at that stage. Its job is to prevent leaks about the deal and to set the ground rules for expanded disclosure.
The diligence-stage NDA is thick. It is executed when the buyer signals it is ready to enter the data room. It defines “Trade Secrets” by reference to § 688.002(4), enumerates the target’s specific trade secrets by category — pricing algorithms, customer lists, source code repositories, negotiated vendor terms, proprietary methodologies — and carves out the statutory remedies from any limitation-of-liability clause. It includes the DTSA § 1833(b)(3) notice of immunity. It restricts access to a named list of buyer personnel who have signed individual acknowledgments. It contains a residual-knowledge clause that has been carefully drafted so that it does not, on its face, authorize the buyer’s team to walk away with what they saw. And it has a term that runs at least as long as the trade-secret status of the information, which for many categories is indefinite.
The two-step is not paperwork for paperwork’s sake. It is the difference between a target that can enforce § 688.001 with the full statutory remedy set and a target that is arguing its way through a generic contract claim with contract damages.
What “reasonable efforts” looks like beyond the NDA
A trade-secret plaintiff has to prove reasonable efforts to maintain secrecy independent of the NDA. Florida courts look at physical security, access controls, employee training, marking of confidential materials, and the target’s overall culture around secrecy. In the diligence context, this means the data room itself is evidence. A data room with restricted permissioning, download tracking, watermarking of sensitive documents, and separation of highly sensitive trade-secret materials into a clean room that only a subset of buyer personnel can access looks like reasonable efforts. A data room where every buyer team member has full download access to every folder looks like waiver.
The mechanics belong in the diligence-stage NDA and the data-room configuration together. The NDA references the clean-room protocol; the data-room platform enforces it. When the same target later sues for misappropriation, the data-room audit log is the exhibit that shows reasonable efforts. Where this fits in the broader Florida M&A diligence framework is discussed at montague.law/business-law/m-a-mergers-and-acquisitions; the buyer-versus-seller allocation of confidentiality risk is addressed at seller-friendly-vs-buyer-friendly-deal-terms.
The specific carve-outs the target should demand
Beyond the § 688.001 reference and the DTSA notice, three specific carve-outs distinguish a serious trade-secret NDA from a generic one. First, the survival clause. Trade-secret obligations survive termination of the agreement for as long as the information qualifies as a trade secret under § 688.002(4). A two-year contractual term that also runs against trade-secret obligations is a giveaway.
Second, the equitable-relief acknowledgment. The parties acknowledge that money damages are inadequate for trade-secret misappropriation and that injunctive relief is available without posting a bond. Florida courts routinely grant preliminary injunctions in properly-pleaded trade-secret cases, but the equitable-relief acknowledgment eliminates one of the standard defenses.
Third, the return-and-destruction protocol. On termination or on request, the receiving party returns or destroys all materials containing trade secrets, certifies destruction in writing, and identifies any materials that cannot practically be returned or destroyed. This provision is what makes the residual-knowledge clause enforceable against copies and derivatives that have propagated through the buyer’s systems.
The pattern that quietly costs Florida targets meaningful trade-secret recovery is not the eventual misappropriation. It is the NDA that was signed six weeks before the data room opened and never mentioned the statute that exists to protect what was about to be disclosed. Deal counsel who reference § 688.001 in the recitals, define trade secrets against § 688.002(4), and include the DTSA notice preserve the full remedy set. Deal counsel who use last year’s Delaware form give it away.
If you are a Florida target opening a data room and want to walk through how the pre-diligence NDA should reference § 688.001 to preserve the statutory remedies, feel free to reach out to my firm manager, Magda, at Magda@montague.law, or fill out our contact form. Mention you read this post.
— John
