This is part 6 of a 7 part series exploring the far-reaching subject of GDPR. If you’ve missed the first part, you can find it here.

GDPR Session 6

For ‘consent’ to be valid and lawful it must be:-

  • Freely given;
  • Employees must have a ‘genuine’ choice;
  • The Data Subject must give clear ‘affirmative’ consent, a positive opt-in e.g. the Data Controller cannot rely on implied, automatic or blanket consent, use pre-ticked boxes or any other method of default consent e.g. by signing this document it is assumed that you are agreeing/giving us permission to …..;
  • The reason for the request to ‘consent’ must be clear and transparent;
  • The tone and language used must be in clear and plain language and easily accessible;
  • Confirm the actions and processes that will be followed once consent is given;
  • Be recorded (version controlled) so there is an audit trail;
  • Allow the Data Subject to withdraw consent at any time.Consent can be given:-
  • In writing;
  • Electronically e.g. HR self-service system;
  • Signing a separate form;
  • Signing an Employee Privacy Letter (or Processing Notice);
  • Oral Statement (it is recommended that this type of consent is avoided unless you can categorically demonstrate it was obtained).

 

The content of this document refers to GDPR compliance in relation to HR data and employees only.  Therefore it is recommended that further guidance is sought for GDPR compliance in other business areas.  Unsurprisingly we’ve been unable to cover all HR-related topics in this Blog, please contact us if you would like to receive a copy of the full document by sending an email to: jannine@nullb2phr.co.uk. 

We have also compiled an HR GDPR pack (please note these documents only relate to HR-activities) consisting of the following templates:-

  • Data Protection Impact Assessment (DPIA) spreadsheet;
  • Employee Privacy Notice Template (individual employee notification letters)
  • Privacy Notice (General to be issued to employees explaining how HR-related activities will be processed in-line with GDPR)
  • Privacy Notice (Candidate version for potential job applicants explaining how HR-related activities will be processed in-line with GDPR)
  • Data Protection Policy (template)

We would be very happy to share these with you for a small one-off fee of £150 + VAT (to cover research / development time and costs).