One contractor's bad move fixed a Niagara Falls franchisee's NDA gaps

The situation

The call came in on a Thursday afternoon. Thalia had just learned that Shira, a contractor who had done marketing and customer list work for her franchise location for the better part of a year, had left to help set up a competing operation two cities over, and had apparently taken a copy of the customer database and the location's internal pricing sheet with her. Thalia did not know yet whether Shira had actually used any of it, only that the files were gone from a shared drive and Shira was no longer answering calls.

Thalia's business was a single franchise location, part of a national brand but locally owned and operated, with revenue in the range of a few hundred thousand dollars a year. She ran it with the help of an administrative assistant, Sophia, who managed the office and had noticed the missing files first, and a rotating handful of contractors who handled marketing, deliveries, and seasonal work, including a long-haul truck driver who picked up supply runs between highway routes whenever his schedule allowed. Shira had been one of the more trusted of those contractors, brought on informally through a mutual acquaintance, with no more than a short services agreement that Thalia had adapted from a template she found online years earlier.

That agreement, it turned out once we reviewed it, said almost nothing about confidentiality. It covered payment terms and the scope of marketing work in reasonable detail, but the single sentence addressing confidential information was vague enough that it was unclear whether it covered a customer list at all, let alone pricing strategy or supplier terms. None of Thalia's other contractor agreements were any stronger, and several contractors were working under no written agreement whatsoever, on the strength of a conversation and an invoice.

Thalia's first instinct was to call Shira directly and demand the files back. We advised against that before we had a clearer picture of what had actually happened and what leverage, if any, existed to enforce a return. The information itself, customer names, order histories, and internal pricing, was exactly the kind of business information that competition law and general principles of confidentiality are built to protect, but only if it had actually been treated as confidential in the first place, and Thalia's paperwork did not make that case cleanly.

Sophia, still shaken by discovering the missing files, kept asking the same question over the following days: how could someone just take this and walk away. It was a fair question, and the honest answer was that nothing in the business's own records made clear the files were meant to be treated as off-limits once a contractor's work ended. Thalia had trusted the people she worked with, which had served her well for years, right up until it did not.

What the law actually said

Ontario does not have a single statute that hands a business owner a straightforward remedy the moment a former contractor walks off with a customer list. Protection for confidential business information, what is often called trade secret protection, rests on general legal principles rather than one clear rulebook, and the strength of a claim depends heavily on how the business itself treated the information before the dispute arose. Information that was shared loosely, without any written confidentiality obligation, without access limits, and without any internal indication that it was treated as sensitive, is much harder to protect after the fact than information a business can show it consistently guarded.

That meant the weak contractor agreement was not a minor drafting gap. It went to the heart of whether Thalia had a real claim at all. A court asked to restrain Shira from using the customer list, or to award damages for taking it, would look first at what obligation Shira had actually agreed to, and a single vague sentence buried in a template services agreement is thin ground to stand on. The contractor label was not the end of the story, though. A duty of confidence can attach to anyone who receives information in circumstances that make its confidentiality obvious, whether they are an employee or a contractor, and that duty survives the end of the engagement rather than expiring with it. A contractor who works almost exclusively for one business, or who holds a genuine position of trust within it, can end up owing broader obligations than the bare contractor label suggests, and a written confidentiality term, which Shira's agreement did not really have, settles the question either way rather than leaving it to be argued after the fact.

That principle was the second angle. Even without a strong contractual claim, Thalia's business had some protection from general legal principles around confidential information obtained in circumstances that made its sensitivity obvious, particularly where a contractor understood, or should reasonably have understood, that the customer list and pricing data were not meant to be taken and reused for a competing business. Courts asking that question generally look at three things: whether the information genuinely had the character of something confidential rather than something generally known, whether it was shared in circumstances that made an obligation not to misuse it obvious even without a written promise, and whether the person who took it then used it, or was positioned to use it, in a way that caused harm. That kind of claim is harder to prove and less predictable than a straightforward contract claim, but it was not nothing, especially with the right facts behind it.

Those facts arrived sooner than expected. Shira, apparently confident that the vague services agreement gave her nothing to worry about, sent a message to Sophia asking whether Thalia would be interested in a friendly conversation about the new competing operation, and mentioned in passing that she already had a solid client list to start from. That message, casual as it was, became the clearest evidence in the file that Shira had taken the information and understood exactly what it was.

What we did

1. Reviewed the message Shira sent to Sophia as a piece of evidence, not just a conversation. Shira's reference to already having a client list from the old business, sent casually and without legal advice on her side, was more useful to Thalia's position than anything in the weak contractor agreement. We preserved the message immediately and treated it as the anchor for everything that followed, since it removed any real dispute about whether Shira had taken the information.
2. Sent a formal letter to Shira addressing the specific conduct, not the whole relationship. Rather than a broad accusatory letter, we focused narrowly on the customer list and pricing sheet, referencing her own message as evidence she understood what she had taken, and requested confirmation the files would not be used or shared further. A narrow, specific letter is harder to dismiss than a sweeping one, and it left less room for Shira to argue she was being unfairly targeted for ordinary competition.
3. Assessed realistically what a court claim would cost against what it would recover. Given the size of Thalia's business and the modest scale of the information taken, a full court proceeding risked costing more than any likely recovery, even with the strong evidence in hand. We laid that out plainly for Thalia so she could weigh a negotiated resolution against a longer fight from an informed position rather than out of frustration.
4. Negotiated a settlement directly with Shira. Shira, aware that her own message undercut any argument that she had done nothing wrong, agreed to confirm in writing that the customer list and pricing information would not be used, and to a modest payment covering the cost of the response. It was not a large recovery, but it closed the immediate exposure without a drawn-out dispute.
5. Audited every other contractor relationship Thalia had. The gap in Shira's agreement was not unique to her. We reviewed every contractor Thalia worked with, formal and informal, and found the same weak or missing confidentiality language across nearly all of them, along with several contractors who had broad, unmonitored access to the customer database with no operational reason to need it.
6. Built a standardized confidentiality and non-use agreement for all contractors going forward. We drafted a single NDA template, tailored to Thalia's business and clear about what counted as confidential, including customer data, pricing, and supplier terms, and requiring its return or deletion at the end of any engagement. Every contractor, current or new, signed the updated version before continuing work.
7. Set up basic access controls to match the paperwork. A confidentiality agreement means little if every contractor still has open access to everything regardless of their actual role. We worked with Thalia and Sophia to limit database and pricing access to contractors who genuinely needed it for their work, so the protection existed in practice and not just on paper.

The outcome

Shira signed the confirmation and paid the agreed amount within a few weeks, and there was no indication afterward that the customer list or pricing information was used in the competing operation. The resolution was a compromise rather than a clean win. Thalia did not pursue the larger claim a court proceeding might theoretically have supported, and the payment she recovered was modest relative to what the information might have been worth if it had been used aggressively against her business.

The larger value of the file turned out to be the audit that followed, not the settlement itself. Standardizing the contractor agreements and tightening access controls addressed a gap that had existed across the entire business, not just in Shira's file, and that gap could easily have caused a much larger loss with a less careless contractor on the other side. Thalia said afterward that she had assumed a lawyer's involvement would be about winning the dispute with Shira, and was surprised the more lasting work was fixing the paperwork everyone else was still operating under.

Sophia now handles onboarding for new contractors using the standardized agreement as a matter of course, and Thalia reviews access permissions every few months rather than leaving them set once and forgotten. The leak scare cost the business time, a modest settlement payment, and some uncomfortable weeks not knowing what had actually happened to its customer data. It also left the business considerably better protected than it had been the day before Shira's files went missing.

Thalia has since had two contractors ask, unprompted, why the new agreement is so much more detailed than what they had signed elsewhere. She tells them the short version: a leak scare that could have gone much worse, resolved by luck as much as by anything else, and a decision not to leave the next one to luck again.

What you can learn from this