Notices and The Right to be Informed

Once you have identified:
For general personal data:

• The principles
• The lawful processing

And in respect of sensitive personal data you have identified:

• The principles
• The lawful processing
• And the condition

The GDPR sets out information which you are obliged to inform those of how you will use personal and sensitive data. This is called a “fair processing notice” also known as a “Privacy Notice” to the employee setting out what will happen to their personal data? You can use this notice to notify employees, workers, contractors, customers and businesses about the personal data that you hold relating to them, how they can expect their personal data to be used and for what purposes. i.e your intended purpose for processing the personal data and the lawful basis for the processing.

Within the privacy notice it asks you to identify the Data Controller and Data Processor.

• The Data Controller – can be a legal or natural person which either alone or jointly with others determines the purposes and means of personal data processing. Guidance suggests it is the company or body on whose behalf personal data is processed, rather than a specific person within the company or the body.

The company or the body should be considered ultimately responsible for data processing and the obligations arising from data protection legislation, unless there are clear elements indicating that a natural person is responsible, for example, when a natural person working within a company or a public body uses data for his own purposes outside the activities of the company or body.

• A processor is responsible for processing personal data on behalf of a controller.

Looking for Privacy Notice Help?

Buy Your Privacy Notice Online