FORMAL ANSWER

Persons authorised to process personal data should be required to keep those data and the methods of securing them confidential. To ensure the security of personal data and the controller’s accountability, employees and collaborators should be required to sign a confidentiality undertaking for personal data to which they may have access in the performance of their duties.

PRACTICAL ANSWER

In practice, it is best to collect the undertaking after training employees on new personal data protection rules and internal policies and procedures they are to implement. Such a document can then cover both confirmation that they have read the new rules and an undertaking to keep personal data confidential. When collecting undertakings, you can verify that authorisations to process personal data are up to date and, if needed, issue new authorisations as part of the same task.

MORE:

• You can find more information in the guide: How to process personal data