Article 90 — Obligations of secrecy

GDPR, Regulation (EU) 2016/679

What does GDPR Article 90 say?

Short answer, straight from the official text

1. Member States may adopt specific rules to set out the powers of the supervisory authorities laid down in points (e) and (f) of Article 58(1) in relation to controllers or processors that are subject, under Union or Member State law or rules established by national competent bodies, to an obligation of professional secrecy or …

Source: GDPR, Regulation (EU) 2016/679, read 2026-08-14.

Official text

Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.

Jump to a point: Point 1 · Point 2

1. Member States may adopt specific rules to set out the powers of the supervisory authorities laid down in points (e) and (f) of Article 58(1) in relation to controllers or processors that are subject, under Union or Member State law or rules established by national competent bodies, to an obligation of professional secrecy or other equivalent obligations of secrecy where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy. Those rules shall apply only with regard to personal data which the controller or processor has received as a result of or has obtained in an activity covered by that obligation of secrecy.

2. Each Member State shall notify to the Commission the rules adopted pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Open the article on EUR-Lex

• Previous article
• Next article

Other articles in this chapter

• Article 85
• Article 86
• Article 87
• Article 88
• Article 89
• Article 91

Who does this apply to

The register names five roles. Open a role to see the duties this act places on it, each row with its article and its source.

• Cloud service provider

Does this apply to us?

• Do ai governance rules apply to a cloud provider?
• Do personal data rules apply to a cloud provider?
• Do cross-border data rules apply to a cloud provider?
• Do cybersecurity rules apply to a cloud provider?
• Do health data rules apply to a cloud provider?
• Do online platforms rules apply to a cloud provider?

All roles in the register · All questions by role

The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.

Back to the act · EU acts, read down to the national law

ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.

Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.