Oposiciones →
Module 4 of 7 · 20 min

Your duty: confidentiality and instructions

Free data protection course: read the module, review with the questions and move on to the next one. At the end, a test and a PDF certificate.

Module 4 of 7 · Course contents

Confidentiality

Everyone involved in any stage of processing is bound by a duty of confidentiality, and this duty continues even after the relationship with the employer ends (Organic Law 3/2018, article 5).

Only on instructions

Anyone acting under the controller's authority with access to data may only process it on the controller's instructions (GDPR, articles 29 and 32.4).

Habits that comply

  • Look only at the data you need for your task.
  • Do not move data to your personal email or phone unless your employer allows it.
  • Lock your screen when you get up; do not leave papers with data in view.
  • Check the recipient before sending an email containing data.
  • When you leave the company, do not keep customer lists.
In practiceA clinic receptionist cannot tell a neighbour that «your brother-in-law came in yesterday», even if it is true and even after she has left the job.

Source: Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (Spanish data protection act, in Spanish), article 5 · Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), articles 29 and 32.4

Quick review

Check that you've understood. These are questions from the final test: tap an answer to see whether it's right and why.

How long does your duty of confidentiality over the data you see at work last?

How may a worker with access to data process it?

Module practice test

5 new questions, different from the final test. Tap an answer to see whether it is right, why, and which rule it comes from.

1. Who is bound by the duty of confidentiality in Organic Law 3/2018?

2. Does the duty of confidentiality replace doctors' or lawyers' professional secrecy?

3. A colleague asks for a customer's address «to send her flowers». What do you do?

4. Who must ensure staff only process data on instructions?

5. Which GDPR principle does the duty of confidentiality give effect to?

Course contents