Once you have identified:
For general personal data:
And in respect of sensitive personal data you have identified:
The GDPR sets out information which you are obliged to inform those of how you will use personal and sensitive data. This is called a “fair processing notice” also known as a “Privacy Notice” to the employee setting out what will happen to their personal data? You can use this notice to notify employees, workers, contractors, customers and businesses about the personal data that you hold relating to them, how they can expect their personal data to be used and for what purposes. i.e your intended purpose for processing the personal data and the lawful basis for the processing.
Within the privacy notice it asks you to identify the Data Controller and Data Processor.
The company or the body should be considered ultimately responsible for data processing and the obligations arising from data protection legislation, unless there are clear elements indicating that a natural person is responsible, for example, when a natural person working within a company or a public body uses data for his own purposes outside the activities of the company or body.
Looking for Privacy Notice Help?