# GDPR Article 76 — Confidentiality

- Source: https://support.icompaas.com/compliance/gdpr/article-76-confidentiality
- Section: [Compliance](https://support.icompaas.com/compliance) › [GDPR (Regulation (EU) 2016/679)](https://support.icompaas.com/compliance/gdpr) › Articles 71–80
- Last updated: 2026-06-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**GDPR**·Article `Article 76`·low·Component: **Chapter VIII: Remedies**

## What this control requires

> Ensure Board discussions are confidential when deemed necessary per its rules of procedure. Regulate access to documents for Board members, experts, and third-party representatives in accordance with Regulation (EC) No 1049/2001. This control addresses Remedies, Liability and Penalties.
> 
> — GDPR, Article Article 76

### In plain English

Ensure Board discussions are confidential when deemed necessary per its rules of procedure. In practice, this means you can prove you representatives board-level controls on a defined cadence.

## Why it matters

GDPR administrative fines reach the greater of €20 million or 4% of global annual turnover. The European Data Protection Board (EDPB) coordinates supervisory-authority enforcement across the EU/EEA, and DPAs publish enforcement decisions citing specific Articles.

## What an auditor looks for

A DPA or privacy auditor expects: a Records of Processing Activities (RoPA) entry, a documented lawful basis, evidence the Article's data-subject right is operationalised end-to-end, a named DPO contact (where required), and Article 30 records that match what the front-end actually does.

Within **Chapter VIII: Remedies**, the assessor will trace your implementation back to the catalogue reference (Article Article 76) and look for objective evidence on the latest two assessment cycles.

## How to implement

1.  Write a short policy stating intent, scope and named owner.
2.  Encode it as a platform guardrail — SCP, Azure Policy initiative, Organisation Policy, or repository policy.
3.  Wire a monitoring signal that catches drift (CSPM rule, SIEM rule, scheduled query, Workspace alert) and ticket it.
4.  Review on a documented cadence and capture the review in the risk register or compliance tracker.

### Operational checklist

-   **Representatives.** Document the trigger, the owner and the cadence.
-   **Security.** Document the trigger, the owner and the cadence.
-   **Rules.** Document the trigger, the owner and the cadence.
-   **Procedure.** Document the trigger, the owner and the cadence.
-   **Confidentiality.** Document the trigger, the owner and the cadence.
-   **Scope:** board, procedure.

## Evidence to collect

-   **Vendor Risk Management.** `vendor_risk_management` evidence

Third-party risk management evidence (assessments, contracts, due diligence) shows supplier oversight. Focus: Confidentiality.

## How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

-   [**SOC 2 (2017 TSC) CC9.2** — Vendor Risk Management](https://support.icompaas.com/compliance/soc-2-trust-services-criteria/cc9-2-vendor-risk-management)
-   [**CIS Controls v8 9.1** — Ensure Use of Only Fully Supported Browsers and Email Clients](https://support.icompaas.com/compliance/cis-controls-v8/9-1-ensure-use-of-only-fully-supported-browsers-and-email-clients)
-   [**BSI C5:2020 OIS-03** — Interfaces and Dependencies](https://support.icompaas.com/compliance/bsi-c5-2020/ois-03-interfaces-and-dependencies)
-   [**ISO/IEC 27001:2022 A.5.20** — Addressing information security within supplier agreements](https://support.icompaas.com/compliance/iso-27001-2022/a-5-20-addressing-information-security-within-supplier-agreements)
-   [**ISO/IEC 42001:2023 A.10.2** — Allocation of responsibilities](https://support.icompaas.com/compliance/iso-42001-2023/a-10-2-allocation-of-responsibilities)

## Related controls in GDPR

-   [**Article Article 28** — Processor](https://support.icompaas.com/compliance/gdpr/article-28-processor)

## References

-   [European Union — GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
-   Catalogue identifier: `Article Article 76`

Topics: vendor riskvendor managementsupply chain securitythird party monitoring

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Start with the full GDPR implementation guide — scope, roadmap, evidence and how the assessment runs.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): The security management system most EU procurement teams ask for alongside a DPA; its controls supply much of the Article 32 evidence.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If engineering or support teams sit in India, the same data flows are also subject to India’s Digital Personal Data Protection Act.