Introduction

Non-Disclosure Agreements (NDAs) have long been a cornerstone of corporate confidentiality, protecting trade secrets, sensitive business information, and intellectual property. However, in the era of stringent data protection laws such as the EU’s General Data Protection Regulation (GDPR) and South Africa’s Protection of Personal Information Act (POPIA), NDAs face new challenges. The question arises: do NDAs align with modern privacy regulations, or do they create potential conflicts?

NDAs and Their Purpose

• Confidentiality tool: NDAs restrict parties from disclosing sensitive information.
• Scope: Traditionally covers business strategies, financial data, client lists, and proprietary technology.
• Enforcement: Breach of an NDA can lead to civil liability and reputational damage.

GDPR and POPIA: Key Principles

Both GDPR and POPIA emphasize:

• Lawful processing: Personal data must be collected and processed under clear legal grounds.
• Transparency: Individuals must be informed about how their data is used.
• Data minimization: Only necessary personal data should be processed.
• Security obligations: Organizations must implement “appropriate and reasonable” safeguards.

Points of Compliance

NDAs can support compliance when:

• Explicitly excluding personal data: Drafting NDAs to focus on business information rather than personal data.
• Aligning with lawful processing: Ensuring that any personal data shared under an NDA has a legal basis under GDPR/POPIA.
• Cross-border transfers: NDAs can complement data transfer agreements by reinforcing confidentiality obligations.

Potential Conflicts

NDAs may clash with privacy laws in several ways:

• Overreach: Broad NDAs that cover “all information” risk unlawfully restricting data subject rights.
• Transparency conflict: NDAs may prevent disclosure of how personal data is processed, conflicting with GDPR/POPIA’s transparency requirements.
• Data subject rights: NDAs cannot override rights such as access, correction, or deletion of personal data.
• Regulatory enforcement: POPIA allows penalties up to R10 million and criminal prosecution for violations, making non-compliant NDAs risky.

Practical Guidance for Businesses

• Tailor NDAs carefully: Avoid blanket clauses; specify categories of information covered.
• Separate personal data: Use Data Processing Agreements (DPAs) alongside NDAs to handle personal information lawfully.
• Review cross-border clauses: Ensure NDAs do not conflict with GDPR’s restrictions on international data transfers.
• Train employees: Legal and compliance teams should understand the interplay between confidentiality and privacy obligations.

Conclusion

NDAs remain vital tools for protecting corporate secrets, but in the age of GDPR and POPIA, they must be drafted with precision. Rather than creating conflict, NDAs can coexist with privacy laws if businesses adopt a compliance-first approach. The key lies in balancing confidentiality with transparency and respecting individual rights.

References and Further Information

• https://qualysec.com/popia-compliance/
• https://captaincompliance.com/education/the-protection-of-personal-information-act-popia-a-comprehensive-guide-to-south-africas-data-privacy-regulation/
• https://oreillylaw.co.za/privacy-and-data-protection-lawyers-popia-and-gdpr-compliance-roadmaps/

Disclaimer

This practice note is for informational purposes only and does not constitute legal advice. Readers should consult qualified legal professionals for advice tailored to their specific circumstances.