This policy sets out the organisation’s approach to processing special category

This clause should be inserted into a contract of employment. This clauses informs an employee how their information Is processes.

This clause can be inserted into a contract of employment when employer monitors the communication structures within the organisation.

This letter can be sent to an employee’s GP when the employer has obtained consent from the employee to contact the GP directly to obtain a medical opinion on the employee.

This letter can be sent to an employee when an employer wishes to obtain their consent to access a medical report on the employee. This letter should be sent to accompany the Consent form to obtain a medical report.

This letter can be sent to an individual who has completed a SARS requesting the individual to provide identification

This form can be used to request consent of a job applicant to continue to hold their personal information on file. This form should only be used when the employer has no other legitimate reason for processing the information. For example an employer will have a legal basis to process an unsuccessful job applicants details for a year in order to be able to defend any future claims from an unsuccessful applicant. If the employer wishes to process their information after this period of time they will need to seek consent.

This form seeks consent of former employees for the employer to process data in relation to the employee. This form should only be completed when consent can be relied upon and there is no other legitimate basis under GDPR that the employer has for processing the employee’s information.

This form seeks consent of new employees for the employer to process data in relation to the employee. This form should only be completed when consent can be relied upon and there is no other legitimate basis under GDPR that the employer has for processing the employee’s information.

This form seeks consent of existing employees for the employer to process data in relation to the employee. This form should only be completed when consent can be relied upon and there is no other legitimate basis under GDPR that the employer has for processing the employee’s information.

This form seeks consent from an employee for the employer to contact the employee’s GP or an independent medical professional for the purposes of obtaining a medical report on the employee.

This form seeks consent from an employee for an employer to obtain their photo. This form outlines the reason for the request amd how the employer will process the photo.

This guide provides information on how an employer can remain compliant with data protection

This form should be completed by an individual who wishes to have data erased about them. This form requests the employee to let the employer know the reasons for the deletion, the data to be deleted and any supporting information.

This form should be completed by individuals who wish to have incorrect data in relation to them rectified. This form outlines the data the employee wishes to have rectified and what they request it is amended to.

This form should be completed by an individual who wishes to complete a SARS. This form outlines the information the employee requests and who they should return the form too.

This form should be completed whenever the organisation is considering processing personal information of its employees. This form will identify the impact of the processing and if it is necessary and compliant with GDPR and The Data Protection Act 2018.

This letter responds to an individuals request for erasure of their data refusing the request. The letter outlines the reasons for refusal such as the request is excessive or manifestly unfounded.

This letter responds to an individual who has requested the erasure of data relating to them. This letter confirms that the employer is willing to comply with the request but they need additional time due to the complexity of the information requested.

This letter responds to an individual who has requested the erasure of data relating to them. This letter confirms that the employer is willing to comply with the request but they need further information.

This letter responds to an individual who has requested the erasure of data relating to them. This letter confirms that the employer has completed this request.

This leter responds to an individual who has requested their data is rectified. This letter refuses the request as it is either excessive or unfounded.

This letter requests further time to deal with a subject access request. The reason for the extension is due to the complex nature of the information requested.

This letter can be sent to a data subject who has requested that incorrect data in relation to them is rectified. This letter requests further information on the data to permit the employer to complete the request.

This letter can be sent to a data subject to inform them that their request to have data that was incorrect recified is complete

The employer is not normally permitted to charge a fee for a SARS request. However, if the request is manifestly unfounded or repetitive they may charge a fee.

This letter can be sent to a data subject where the employer perceives the request to be unfounded or excessive. The lette provides options for the employer to explain their rationale.

This letter is responding to a subject access request informing the data subject that the employer will comply with the request however, as the request is complex the employer will need more information.

This letter is responding to a subject access request informing the data subject that the employer will comply with the request however, as the request is complex the employer will need more information.

This letter responds to a subjet access request and provides a copy of the information that is held and also lets the data subject know how it is processed