Geheimhaltungsvereinbarung (NDA)

Before a service provider dismantles your servers or sees your device list, it learns a lot about your company: locations, systems, quantities, sometimes projects. A non-disclosure agreement determines what remains confidential. Here you can read what belongs in such an agreement and how it differs from the data processing agreement.

What does a non-disclosure agreement regulate?

Other names are confidentiality agreement, secrecy agreement or Confidentiality Agreement. The meaning is always the same: whoever receives confidential information may not pass it on to third parties and may not use it for their own purposes. There are one-sided NDAs, in which only one party discloses information, and mutual NDAs, when both sides disclose something.

Component	Contents
Confidential information	What exactly is protected, such as device lists, network diagrams, locations, prices
Purpose	What the information may be used for, for example for the quote and the execution of the decommissioning
Exceptions	Information that is already public or lawfully known otherwise
Disclosure	Who receives access internally and whether subcontractors may be involved
Term	How long the obligation applies, often beyond the end of the contract
Return and destruction	What happens to documents and files after completion
Consequences of a breach	For example damages or a contractual penalty

Since 2019, the Trade Secrets Act (GeschGehG) protects information as a trade secret only if the owner takes "reasonable confidentiality measures". NDAs are among the usual measures to demonstrate this.

NDA, DPA and data secrecy: the difference

An NDA protects company information. Personal data that a service provider processes on your behalf is governed, by contrast, by the data processing agreement under Art. 28 GDPR. For data erasure on decommissioned devices, you usually need both. In addition, companies commit their employees internally to confidentiality, often as an obligation to Data secrecy. For holders of professional secrets such as doctors or lawyers, the criminal-law protection under § 203 StGB.

What to watch for in IT decommissioning

• Define the purpose narrowly: Information only for handling the order.
• Regulate subcontractors: Who may transport, erase or dispose of the devices? Every further party should also be bound.
• Include employees: The service provider should verifiably commit its personnel to confidentiality.
• Combine with proof: An NDA does not replace erasure. Only the erasure certificate per device proves that no data remains.

Which further questions you should ask a service provider is shown by the checklist Choosing an ITAD provider. This entry explains terms and does not replace legal advice.

Confidentiality at Second IT

Second IT works with individual non-disclosure agreements (NDAs). All employees are committed to data secrecy and are trained regularly. Processing takes place in areas with access control and video surveillance, and Second IT is certified to ISO/IEC 27001. Data carriers are erased with Blancco or destroyed in-house according to DIN 66399, in each case with a certificate per device.

Frequently asked questions about the non-disclosure agreement

What is the difference between an NDA and a non-disclosure agreement?

There is none. NDA stands for Non-Disclosure Agreement and is the English term for the non-disclosure agreement. A secrecy agreement means the same thing.

Does an NDA replace the data processing agreement?

No. The NDA protects business information. If a service provider processes personal data on your behalf, Art. 28 GDPR requires a data processing agreement with specified contents. The two contracts complement each other.

How long does a non-disclosure agreement apply?

The parties determine that. A term that extends beyond the end of the cooperation is usual, because confidential information remains worth protecting afterwards.

Do I need a non-disclosure agreement for IT decommissioning?

It is not generally mandatory. It makes sense, however, because a service provider gains insight into locations, systems and quantities. The Trade Secrets Act also requires reasonable confidentiality measures for information to count as a trade secret.

What is the difference between a one-sided and a mutual NDA?

With a one-sided NDA, only one party discloses confidential information. With a mutual NDA, both sides disclose something. In IT decommissioning, the client often passes on information about devices, locations and systems.