---
title: "Art. 90 GDPR: Obligations of secrecy"
canonical: "https://dposchool.com/gdpr/article/90"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_90"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 90 GDPR · Chapter IX: Provisions relating to specific processing situations

# Article 90 GDPR: Obligations of secrecy

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Official text

### Article 90(1)

**1.** Member States may adopt specific rules to set out the powers of the supervisory authorities laid down in points (e) and (f) of Article 58(1) in relation to controllers or processors that are subject, under Union or Member State law or rules established by national competent bodies, to an obligation of professional secrecy or other equivalent obligations of secrecy where this is necessary and proportionate to reconcile the right of the protection of personal data with the obligation of secrecy. Those rules shall apply only with regard to personal data which the controller or processor has received as a result of or has obtained in an activity covered by that obligation of secrecy.

### Article 90(2)

**2.** Each Member State shall notify to the Commission the rules adopted pursuant to paragraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 90 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_90)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 164](https://dposchool.com/gdpr/recital/164)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IX](https://dposchool.com/gdpr/chapter/9) / Article 90

Previous: [Art. 89 GDPR: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes](https://dposchool.com/gdpr/article/89)

Next: [Art. 91 GDPR: Existing data protection rules of churches and religious associations](https://dposchool.com/gdpr/article/91)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents