Third-Party Employee NDA Spain (Acuerdo de Confidencialidad para Empleados de Terceros)

A Third-Party Employee NDA Spain (Acuerdo de Confidencialidad para Empleados de Terceros) is a direct confidentiality agreement signed by an individual employee, contractor, or consultant of an external organisation — such as a technology vendor, professional services firm, or outsourcing provider — who requires access to the disclosing company's confidential information in the course of delivering services in Spain. The agreement is governed by Código Civil Article 1255 (freedom of contract — autonomía de la voluntad), Ley 1/2019, de 20 de febrero, de Secretos Empresariales (LSE), and Ley Orgánica 3/2018 (LOPDGDD) supplementing Reglamento (UE) 2016/679 (RGPD), with the individual bound directly rather than through their employer organisation alone.

The distinction between this agreement and a standard inter-company NDA is critical under Spanish law. Under Código Civil Article 1257, contracts bind only the contracting parties (relatividad contractual) — an NDA signed between Company A and Vendor B does not automatically bind Vendor B's individual employees. Ley 1/2019 LSE Article 5 does impose direct liability on individuals who acquire, use, or disclose trade secrets obtained through their employment or service duties, but a written individual NDA with each third-party employee provides clearer, more enforceable obligations and enables direct legal action against the individual under Código Civil Articles 1101 and 1106 without needing to pierce the corporate veil of the vendor entity.

Third-party employees who typically require this agreement in Spain include: IT contractors (desarrolladores de software, administradores de sistemas) implementing or maintaining the disclosing company's information systems; auditors (auditores) and tax consultants (asesores fiscales) reviewing confidential financial records for Agencia Tributaria (AEAT) compliance; management consultants (consultores de gestión) advising on restructuring or strategy; data processors (encargados del tratamiento) under RGPD Article 28 whose individual staff access personal data stored by the disclosing company; and Empresa de Trabajo Temporal (ETT) workers placed under Ley 14/1994 at the disclosing company's premises who access confidential business systems.

The RGPD framework adds a specific dimension to Third-Party Employee NDAs in Spain: where the third-party employee accesses personal data belonging to the disclosing company's customers, employees, or data subjects, the individual must be bound by data processing obligations under RGPD Article 29 — processing only on documented employer instructions and maintaining confidentiality of personal data. The Agencia Española de Protección de Datos (AEPD) has confirmed that processor sub-contracting chains must bind each individual processor to equivalent confidentiality and data security obligations under RGPD Article 28.4.

The Juzgado de lo Mercantil has jurisdiction over trade secret misappropriation claims under Ley 1/2019 LSE Article 13, and civil damages claims may be brought against the individual third-party employee directly under Código Civil Articles 1101 and 1902 (extracontractual liability — responsabilidad extracontractual) even where no direct contractual relationship exists between the disclosing company and the individual, if the individual has acted unlawfully under LSE Articles 3 through 5.

The legal framework governing the Third-Party Employee NDA Spain (Acuerdo de Confidencialidad para Empleados de Terceros) in Spain draws on several key statutes and regulatory bodies. Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255. Parties executing a Third-Party Employee NDA Spain (Acuerdo de Confidencialidad para Empleados de Terceros) in Spain should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Código Civil art. 1255; Ley 1/2019 de Secretos Empresariales art. 3–5 sets the foundational requirements.

A Third-Party Employee NDA Spain is needed when a company's confidential information, trade secrets, or personal data will be accessed by named individuals employed by or contracted through an external vendor, consultancy, or service provider.

The agreement is needed when an IT outsourcing provider (proveedor de servicios TI) deploys individual contractors at the disclosing company's premises or remotely on the company's systems — each contractor should sign a personal NDA in addition to any framework services agreement between the companies, because the individual contractor is the person with actual physical access to sensitive systems and data.

A Third-Party Employee NDA Spain is needed when an external auditing firm (firma de auditoría) or tax advisory firm (asesoría fiscal) sends individual partners and staff to review confidential accounting records, unpublished financial statements, or pending AEAT tax inspections — the individual professionals access information far beyond what is covered by the firm's standard engagement letter.

The agreement is needed when a management consulting firm (consultora de gestión) is engaged for a strategic project — such as a merger integration, operational restructuring, or market entry analysis — and its individual consultants will be briefed on non-public pricing data, customer strategies, or competitive positioning.

A Third-Party Employee NDA Spain is required when an Empresa de Trabajo Temporal (ETT) places temporary workers at the company under Ley 14/1994 — ETT workers are employed by the ETT, not the host company (empresa usuaria), so the host company cannot rely on the ET Article 5.a duty of loyalty running from the ETT worker to the host. A direct NDA bridges this gap.

The agreement is also needed when a freelance professional (profesional autónomo) — a graphic designer, copywriter, software developer, or financial analyst — is engaged for a specific project involving access to the company's confidential business data, customer information, or unreleased product details, particularly where the freelancer's services agreement does not contain a detailed confidentiality clause meeting the requirements of Ley 1/2019 LSE.

Parties in Spain should prepare a Third-Party Employee NDA Spain (Acuerdo de Confidencialidad para Empleados de Terceros) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A valid Third-Party Employee NDA Spain under Código Civil Article 1255 and Ley 1/2019 de Secretos Empresariales must contain the following essential elements to be directly binding on the third-party individual.

Identification of Parties: Full name, DNI or NIE (or passport number for non-Spanish nationals), employer organisation, job title, and contact address of the individual signatory (empleado de tercero or contratista). Full legal name, NIF, and registered address of the disclosing company (empresa divulgadora). The agreement should reference the underlying commercial contract between the disclosing company and the individual's employer organisation.

Scope of Access: Clear description of the specific systems, premises, projects, or information categories to which the individual will have access — for example, customer database access, financial reporting systems, research and development documentation, or personal data archives. The specificity of the access scope limits the individual's liability to information actually accessible and prevents the agreement from being challenged as disproportionately broad.

Definition of Confidential Information: Thorough definition of información confidencial under Ley 1/2019 LSE Article 1 criteria — information that is not publicly known, has commercial value, and has been kept secret — plus business-specific categories: trade secrets, customer data, supplier terms, technical specifications, software code, financial projections, and any information marked confidential by the disclosing company.

Obligations of the Individual: The individual must: (1) maintain strict confidentiality during and after the engagement period; (2) access confidential information only to the extent necessary for the assigned project or service; (3) not copy, transmit, download, or store confidential information on personal devices or non-authorised systems; (4) immediately notify the disclosing company of any suspected security breach, unauthorised access, or loss of confidential materials; and (5) return or certifiably destroy all confidential materials upon completion of the project or engagement.

Duration: The confidentiality obligation during the engagement is absolute. Post-engagement duration — typically 2 to 3 years — must be clearly stated. For trade secrets qualifying under Ley 1/2019 LSE, the individual's obligation not to disclose continues as long as the information remains secret, independent of the contractual term.

Data Protection Obligations: Where the individual will access personal data belonging to the disclosing company's data subjects — customers, employees, or others — the agreement must include RGPD Article 29 processor obligations: processing only on the disclosing company's documented instructions, maintaining confidentiality of personal data, implementing appropriate technical and organisational measures (medidas técnicas y organizativas) under RGPD Article 32, and reporting personal data breaches to the disclosing company's DPD within the timeframe required by RGPD Article 33 (72 hours from discovery).

Remedies: Reference to civil remedies under Ley 1/2019 LSE Articles 9 through 11 against the individual — injunctions (medidas cautelares), damages, and seizure of infringing materials — and civil liability under Código Civil Articles 1101 and 1902. AEPD administrative sanctions under RGPD Article 83 for data protection breaches reaching up to €20 million or 4% of global annual turnover may also apply.

Governing Law and Jurisdiction: Spanish law as governing law and the Juzgado de lo Mercantil (for trade secret claims) or Juzgado de Primera Instancia (for general civil claims) of the disclosing company's registered domicile as the competent court.

Forms-legal.com provides this Third-Party Employee NDA Spain template as a practical supplement to inter-company services agreements. Legal review by a Spanish abogado is recommended to confirm the agreement is appropriately tailored to the individual's specific access scope and the applicable sector data protection requirements.

Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255.