Protecting Your Student List: Martial Arts School Data, Trade Secrets and Confidentiality Agreements
Copying a school’s CRM and using it to recruit families is materially different from opening a competing school and attracting people through public advertising. The first can be actionable almost everywhere. The second usually is not. Which side of that line a departure falls on depends largely on what the school did with its data before anyone left.
Researched October 21, 2026. General information, not legal advice. Part of the Martial Arts Employment Law Center. Privacy obligations for student and parent data vary by state and province; see the jurisdiction guides.
When is a student list a trade secret?
Under the U.S. federal Defend Trade Secrets Act and the state versions of the Uniform Trade Secrets Act, information is a trade secret only if it derives economic value from not being generally known and the owner takes reasonable measures to keep it secret. A contract’s label is not enough. Stamping “confidential” on a list every instructor can download to a personal phone is not a reasonable measure.
| Information | Protection assessment |
|---|---|
| Student names visible on public social media | Weak trade-secret claim on names alone |
| Private CRM compilation of student and parent contacts | Potentially protectable |
| Enrollment dates, tuition, renewal history, attendance, cancellation risk | Stronger confidentiality case when genuinely restricted |
| Private prospect records and sales notes | Potentially protectable |
| Children’s medical, behavioural or family information | Sensitive personal information; privacy duties also apply |
| Public schedules, advertised prices, common techniques | Generally weak candidates |
| An instructor’s general teaching skill and experience | Cannot simply be declared school-owned secrets |
Which CRM controls make the claim credible?
| Control | Practical purpose |
|---|---|
| Individual logins and multifactor authentication | Establish who accessed information |
| Access based on duties | Keep teaching access separate from unrestricted database access |
| Restricted exports and integrations | Reduce bulk extraction |
| School-controlled email and messaging accounts | Preserve business communications and continuity |
| No syncing to personal contacts or cloud storage | Prevent uncontrolled copies |
| Access and export logs, where available | Preserve evidence of unusual activity |
| Prompt removal of access at separation | Stop continued access |
| Written return and deletion process | Identify and recover copies |
In GoHighLevel and similar platforms, that means user roles that limit instructors to their classes and messaging, admin-only exports, two named administrators, and parent communications kept in school channels. Let instructors build rapport; keep the records and the conversation history in school systems.
What should a confidentiality agreement contain?
| Provision | What it should accomplish |
|---|---|
| Defined confidential information | Identify actual nonpublic information, not “everything learned here” |
| Permitted use | Limit use to authorized school business |
| Copying and transfer restrictions | Exports, screenshots, forwarding, personal storage, uploading to another CRM |
| Access restrictions | No sharing credentials or bypassing permissions |
| Incident reporting | Prompt reporting of unauthorized disclosure or loss |
| Return and deletion | Devices, backups, cloud accounts and third-party copies |
| Continuing obligations | Protection after employment while information remains protectable |
| Protected-disclosure exceptions | Preserve lawful reporting, testimony and employee rights |
For U.S. agreements, include the DTSA whistleblower-immunity notice or a reference to a policy containing it. Leaving it out can bar recovery of exemplary damages and attorney fees against the employee under the federal statute. An NDA should restrict misuse of information; it should not operate as a disguised ban on working in martial arts.
Who owns the school’s accounts?
A school can lose its audience without anyone exporting a spreadsheet. Keep an inventory and school-controlled recovery addresses for the website and domain, Google Business Profile, social pages and ad accounts, phone numbers and texting accounts, the CRM, email lists, parent groups, and school-created photos, videos and teaching materials. Use at least two administrators where the platform allows. Never let the school’s main phone number, Facebook page or parent group depend on one instructor’s personal account. Employment agreements should address account administration and ownership of work product, with fair treatment of material the instructor created before joining.
What privacy law applies to student data?
Most U.S. state comprehensive privacy laws apply only above high data-volume thresholds that a single school will not meet, but there are exceptions: Connecticut’s 2026 amendments reach businesses processing sensitive data, which includes known children’s data; Washington’s My Health My Data Act has no small-business exemption; Illinois’ biometric law applies to fingerprint or face check-in systems at any size; Massachusetts requires a written security program for residents’ personal information. In Canada, student and parent information is personal information under PIPEDA, Alberta and BC PIPA, or Quebec’s Law 25, which applies to every business and requires a person in charge of personal information. Confidentiality strategy has to work alongside those duties.
Frequently asked questions
Is my martial arts school’s student list a trade secret?
It can be, if it has value because it is not public and you take reasonable steps to keep it secret: restricted access, export controls, confidentiality agreements. A list every instructor can freely download is a weak claim.
Can I stop a former instructor using my student list?
Usually yes, if the list was genuinely confidential and protected. Misuse of confidential records can be actionable even in states that ban non-competes, including California.
What is the DTSA notice and do I need it?
It is a required notice in U.S. agreements governing confidential information that tells employees about immunity for reporting suspected legal violations to the government. Without it, a school may lose the right to exemplary damages and attorney fees under the federal statute.
What every martial arts school staff package should contain
- Offer or employment agreement: the legal employer, the role and duties, workplace, pay, employment status and termination terms, reviewed against local rules. U.S. at-will language does not belong in a Canadian contract.
- Compensation schedule: hourly or salary terms, commissions and bonuses, and exactly when each is earned and paid. Record all working time, not only time on the mat. See instructor pay structures and overtime.
- Appearance and conduct policies: functional uniform, hygiene and safety standards with a written accommodation process. See the dress code and grooming guide.
- Child-protection policy: boundaries, private communications, transport, supervision and reporting. See the conduct clause guide and background checks for instructors.
- Confidentiality and data-security agreement: student records, CRM access, permitted use, return and deletion, and protected-disclosure exceptions (in the U.S., the federal DTSA whistleblower-immunity notice). See student data and trade secrets.
- Restrictive-covenant addendum: only what local law permits, usually a narrow student or staff non-solicitation clause; a non-compete only in exceptional cases. See non-compete laws by state and non-solicitation agreements.
Planning for a departure? Read When an instructor leaves: protecting students and records. Every state and province is indexed in the Martial Arts Employment Law Center.
Before you act on this
This article provides general information and is not legal advice. Employment, wage, human-rights, privacy and restrictive-covenant laws change, and their application depends on the exact wording of an agreement, the employee’s duties and pay, where the work is done and when the agreement was signed. Confirm the current statute, regulations and agency guidance, and take advice from a lawyer admitted in the relevant state or province, before drafting, changing or enforcing an employment agreement. Corrections: see our editorial policy.
