Article 90 GDPR
Obligation to maintain confidentiality

1. Member States may adopt specific provisions defining the powers of the supervisory authorities established under Article 58(1)(e) and (f) in relation to controllers or processors who are subject – by Union or Member State law or by rules established by competent national authorities – to professional secrecy or other equivalent duties of confidentiality, where necessary and proportionate to reconcile the right to the protection of personal data with the duty of confidentiality. These provisions apply only to personal data that the controller or processor has received or obtained as a result of or in the course of an activity covered by that duty of confidentiality.

2. By May 25, 2018, each Member State shall notify the Commission of its regulations enacted pursuant to paragraph 1, and immediately thereafter of any subsequent amendment concerning them.