GDPR: New model documents on consent, rectification and erasure
HR & Compliance Centre has added a new form to seek consent to process personal data for a specific purpose, where no other legal basis for the processing applies under the General Data Protection Regulation (GDPR). We also provide new forms and letters for requests for rectification and erasure of personal data under the GDPR.
Further resources
Employers should not generally rely on consent as the basis for processing personal data under the GDPR because the imbalance in the employment relationship means that consent is rarely freely given. However, consent may be appropriate where there are no adverse consequences in a refusal to consent.
Examples include requests to retain an unsuccessful job applicants' details or for an employee to appear in a recruitment video for its website.
Under the GDPR, there are specific mechanisms to allow individuals to have:
- incorrect or incomplete personal data rectified; and
- personal data erased in certain circumstances, for example where the employer no longer needs to process the data.
Consent
Rectification of personal data
- Form for individual to request rectification of incorrect or incomplete personal data
- Letter informing individual that incorrect or incomplete personal data has been rectified
- Letter asking for more information on request for rectification of incorrect or incomplete personal data
- Letter extending time to respond to request for rectification of incorrect or incomplete personal data
- Letter refusing request for rectification of incorrect or incomplete personal data or asking for administrative fee
Erasure of personal data
- Form for individual to request erasure of personal data
- Letter informing individual that personal data has been erased
- Letter asking for more information on request for erasure of personal data
- Letter extending time to respond to request for erasure of personal data
- Letter refusing request for erasure of personal data or asking for administrative fee