To file a breach of confidentiality lawsuit, you identify the legal duty that was violated, gather evidence of the unauthorized disclosure and the harm it caused, and file a complaint in the appropriate court before your state’s deadline runs out. Winning the case turns on three things: a duty to keep the information private existed, the defendant broke it, and the breach caused you a concrete injury. Filing deadlines run anywhere from two to ten years depending on your state and the type of claim, so the timing question deserves attention early.
Pick the Legal Theory First
Breach of confidentiality is not a single cause of action. It can be framed as a breach of contract, a tort, or a violation of a specific statute, and the theory you choose changes what you need to prove, what you can recover, and where you file.
A breach of contract claim is usually the cleanest path when a signed nondisclosure agreement or a confidentiality clause in an employment contract exists. You show the contract, the breach, and the financial loss. Contract claims typically limit recovery to the money the breach cost you, but they demand less proof of intent.
Without a written agreement, a tort claim may still be available. Invasion of privacy and negligent disclosure of confidential information apply when someone violates an implied duty arising from a professional relationship or the circumstances in which the information was shared. Tort theories open the door to emotional distress damages and, where the conduct is egregious, punitive damages.
When trade secrets are involved, the Defend Trade Secrets Act allows a civil suit in federal court if the misappropriated trade secret relates to a product or service used in interstate commerce. Remedies under the DTSA include injunctions, actual loss damages, and exemplary damages of up to twice the compensatory amount for willful and malicious misappropriation.1Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings Many plaintiffs plead state and federal theories together.
Prove the Duty of Confidentiality
Every claim rests on showing the defendant had a legal obligation to keep the information private. That obligation comes from one of three sources.
A Written Agreement
An NDA or a confidentiality clause in an employment contract is the clearest source. These documents identify what is protected, how long the obligation runs, and sometimes the consequences of breach. With a signed agreement in hand, proving the duty element is usually a matter of handing the court the contract.
An Implied Professional Duty
Certain professional relationships create a duty even without a written agreement. Attorneys have an ethical obligation to protect information related to representing a client, and it continues after the representation ends.2Legal Information Institute. Attorneys Duty of Confidentiality The ABA’s Model Rules of Professional Conduct bar lawyers from revealing client information without informed consent and require reasonable steps to prevent unauthorized disclosure.3American Bar Association. Rule 1.6 Confidentiality of Information Similar implied duties apply to doctors and therapists.
A Statute
Federal and state statutes impose confidentiality obligations in specific contexts. HIPAA sets national standards for patient health information and restricts how healthcare providers and their business associates handle it.4U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule One boundary matters here: HIPAA does not give you a private right of action against a healthcare provider. Enforcement runs through the HHS Office for Civil Rights. A HIPAA violation can still supply strong evidence for a state-law negligence or invasion-of-privacy claim, because it shows the provider fell below the federally required standard of care.
What You Have to Prove
Whatever theory you pick, three elements have to line up: the duty existed, the defendant violated it, and the violation caused you real harm.
Proving the duty is largely mechanical. You produce the NDA, point to the professional relationship, or identify the statute. The breach element requires showing that confidential information was actually disclosed to someone who should not have received it, without your consent or legal justification. The disclosure does not have to be intentional. A therapist discussing a case in a waiting room, or an employee sending a client list to the wrong email address, both qualify.
Causation and damages is where cases stall. It is not enough to show that someone talked. You need to connect that disclosure to a specific injury: revenue lost after a competitor learned your strategy, a job you were fired from once your medical condition surfaced, therapy costs from the fallout. Courts want a traceable line from breach to harm, not speculation.
Gather Evidence Early
Documentation built early is worth more than any argument made later. Start collecting the moment you learn about the breach, because memories fade and digital records can vanish.
- The agreement or relationship. Pull the NDA, employment contract, or any document establishing the obligation. If the duty arises from a professional relationship, document when it began and its nature.
- The disclosure itself. Save screenshots, emails, texts, social media posts, or any record of what was disclosed and to whom. If the disclosure was verbal, write down what was said, when, where, and who was present while it is fresh.
- The specific information at issue. Vague claims that “private information” was leaked will not carry a case. Pinpoint the data.
- Your damages. Collect financial statements showing lost income, termination letters, medical bills tied to emotional distress, invoices from reputation management or crisis response services, and any other proof of the harm.
Keep originals and make backup copies. Evidence sitting on someone else’s device or server may have to come out through discovery, but knowing it exists lets your attorney plan for it.
Watch the Filing Deadline
Every claim has a statute of limitations, and missing it ends the case no matter how strong the evidence. The clock usually starts when you discover the breach or reasonably should have.
For contract-based claims like a broken NDA, deadlines vary by state. Written contracts range from three years in states like Delaware and Maryland to ten years in states like Illinois and Indiana. Oral contract deadlines run shorter, typically two to five years. Tort claims for invasion of privacy or negligence often have shorter windows still, commonly one to three years.
Under the Defend Trade Secrets Act, the federal deadline is three years from the date you discovered or should have discovered the misappropriation.1Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings A continuing misappropriation counts as a single claim for limitations purposes, so the clock does not restart with each new act of use or disclosure.
Before You File
Send a Cease and Desist Letter
A cease and desist letter is not required, but it is often a smart opening move. It gives written notice that you know about the breach, identifies the information at issue, demands the disclosures stop, and warns of legal consequences. Sometimes that ends the problem without litigation. When it does not, the letter creates a paper trail showing the defendant kept going after being told to stop, which supports a later claim of willful misconduct.
Check for an Arbitration Clause
Read the underlying agreement before drafting a complaint. Many NDAs and employment contracts contain mandatory arbitration clauses requiring private arbitration instead of court. If yours does, a lawsuit may get dismissed and sent to arbitration anyway. Arbitration has its own rules and timelines and is generally private, which can help or hurt depending on your situation.
Choose the Right Court
Most breach of confidentiality lawsuits go in state court. The case typically belongs in the county where the defendant lives, where the breach happened, or where the agreement was performed. State rules control the specifics.
Federal court is open in two situations. First, claims under a federal statute like the DTSA can be filed there directly. Second, if you and the defendant are citizens of different states and the amount in controversy exceeds $75,000 (not counting interest and costs), federal diversity jurisdiction applies.5Office of the Law Revision Counsel. 28 USC 1332 – Diversity of Citizenship; Amount in Controversy; Costs Filing in the wrong court wastes time and money.
File the Complaint and Serve the Defendant
The suit begins when you file a complaint. The complaint states the court’s jurisdiction, describes what happened in plain language and why it entitles you to relief, and demands a specific remedy: damages, an injunction, or both. A filing fee is due when you submit it, and the amount varies by court.
After filing, the complaint has to be formally delivered to the defendant through service of process. That means a copy of the complaint and a court-issued summons delivered in a legally approved way, typically by a professional process server, a sheriff’s deputy, or in some cases by certified mail.6Legal Information Institute. Federal Rules of Civil Procedure Rule 4 – Summons You cannot serve the papers yourself. The defendant can agree to waive formal service in exchange for extra time to respond.7Legal Information Institute. Service of Process
What Happens After Filing
Once served, the defendant has 21 days to file an answer. A defendant who waived formal service gets 60 days.8Legal Information Institute. Federal Rules of Civil Procedure Rule 12 – Defenses and Objections The answer addresses each allegation and raises defenses. If the defendant does not respond, you can move for default judgment.
Then comes discovery, the formal exchange of evidence. Discovery tools include depositions (witness testimony under oath), interrogatories (written questions answered in writing under oath), and requests for production (documents like emails, internal communications, and financial records).9National Institute of Justice. Law 101 Legal Guide for the Forensic Expert – Procedures Which Govern Civil Discovery Discovery is usually the most expensive phase and is where most cases are decided, because the documents and testimony that emerge drive settlement or trial.
What You Can Recover
Economic Damages
Economic damages cover measurable financial losses: lost income, lost business opportunities, and containment costs like a cybersecurity assessment or a public relations consultant. Each dollar figure needs documentation tying it to the breach.
Non-Economic Damages
Non-economic damages compensate harm that does not come with a receipt: emotional distress, anxiety, humiliation, reputational damage. These are harder to prove without invoices, but therapy records, testimony from people who saw the impact, and your own detailed account of the harm all help.
Punitive Damages
Where the defendant acted with malice or reckless disregard for your rights, a court may add punitive damages to punish the conduct and deter others. Under the DTSA, exemplary damages for willful and malicious misappropriation are capped at twice the compensatory award.1Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings State-law caps vary widely.
Injunctive Relief
Sometimes money is not the point. You need the disclosure to stop. An injunction orders the defendant to cease disclosing or using your confidential information. When you need protection before the case is fully litigated, a temporary restraining order or preliminary injunction is available. Irreparable harm, one of the standard requirements for emergency relief, is often easier to show in confidentiality cases than in other disputes, because information once disclosed cannot be pulled back.
Attorney Fees
Each side usually pays its own fees. Many NDAs contain prevailing-party fee provisions that shift the winner’s costs to the loser. When your agreement has one, winning recovers your litigation expenses on top of damages. Under the DTSA, a court can award reasonable attorney fees when misappropriation was willful and malicious, or when a claim or motion was made in bad faith.1Office of the Law Revision Counsel. 18 USC 1836 – Civil Proceedings
Defenses to Expect
Knowing what the other side will argue sharpens your evidence gathering. These come up most often.
- The information was not confidential. If it appeared in a public filing, a published article, or was shared openly elsewhere, the defense will argue it had lost its protected status.
- You disclosed it first. If you shared the information with third parties before the defendant did, the argument will be that you did not treat it as confidential yourself.
- The agreement was unenforceable. Courts sometimes refuse to enforce NDAs that sweep too broadly, run indefinitely, or restrict more activity than needed to protect a legitimate interest.
- Disclosure was legally required. A confidentiality agreement cannot override a court order, subpoena, or regulatory investigation.
- Whistleblower protection. Federal law provides immunity from trade secret liability for anyone who discloses a trade secret in confidence to a government official or attorney solely to report a suspected legal violation. Other federal and state whistleblower protections may also shield a defendant who reported illegal activity.10Office of the Law Revision Counsel. 18 USC 1833 – Exception to Prohibition
If any of these defenses look likely, address them while you are still gathering evidence. Document why the information was genuinely confidential, how you protected it, and that no legal obligation required the defendant’s disclosure.