The "processing” of personal data refers to an operation (or series of transactions) carried out with personal data. This includes collecting, recording, organizing, structuring or storing this data (but not limited to) which is a broad definition. An example of a consultant who handles personal data could be an HR consultant who advises clients on daily HR issues, such as disciplinary issues and complaints, as they have access to the details of the client`s staff. On the other hand, a human resources consultant who advises clients as part of the PERSONAL strategy cannot process personal data. Historically, advice agreements may include clauses by which the advisor agrees to the client to retain and process his personal data. However, according to the RGPD, this type of general consent is no longer as useful as it can be revoked at any time. The RGPD introduces more rights for those affected. In particular, they will have the right to be informed of how their data is processed and why, the right to be forgotten in certain circumstances and the right to data portability, which allows a person concerned to receive and reuse his personal data for his own purposes, on different services. Given the new obligations and responsibilities, it is important that consultants and clients take these considerations before entering into (or pursuing) a consulting contract. If necessary, the consultation procedures should be changed. Limits the consultant`s ability to engage a subprocessor or subprocessor by asking the advisor to obtain written permission from the client.
If the client gives permission, the advisor must enter into a contract with the replacement or subcontractor processor that provides the same protection-oriented personal data as in the contract between the client and the advisor. Some of these commitments will have a significant financial impact on a single advisor, such as the obligation. B to take appropriate technical and organizational measures to ensure personal data, and the only way to manage this data may be to pass on costs to the customer. Restrictions on the appointment of subcontractors will also affect the ability to appoint a substitute. The advisor requires the advisor to take "appropriate technical and organizational measures” to ensure personal data. This effectively means that the advisor must take the same security measures as the client himself.