Should an Information Clause Regarding the Processing of Personal Data Be Included in a Cooperation Agreement?

ANSWER

There is no obligation to include an information clause under Article 13 GDPR in the body of a cooperation agreement. The data controller is required to fulfil the information obligation vis-à-vis a natural person once — at the time of collecting their personal data in the context of a given processing purpose. The provisions of the GDPR do not specify the form in which the controller is required to provide this information; accordingly, any form is considered permissible and correct, including providing it in a written statement, incorporating it into the agreement, reading it aloud, sending it by e-mail, and so forth.

It should also be noted that the data controller is not required to collect signatures under the information obligation confirming that the natural person has read it.