If a non-disclosure agreement contains information about the entrustment of personal data, is it necessary to conclude a separate data processing agreement?
ANSWER
If the "information about the entrustment of personal data" satisfies the requirements of Art. 28(3) GDPR, there is no need to conclude a separate data processing agreement, because such an agreement is already "contained" in the non-disclosure agreement. A data processing agreement does not need to be a separate document; it may be an expanded clause within a cooperation agreement or a non-disclosure agreement – what matters is that it contains the elements required by Art. 28(3) GDPR.
