make your free consultant privacy notice
what we'll cover
what is a consultant privacy notice?
a consultant privacy notice explains how consultants’ personal data (eg their names, addresses or professional qualifications) are processed (eg collected or stored) by the business engaging them (ie the ‘data controller’). consultant privacy notices set out the ‘what, how, where, why and when?’ of the data processing.
this document is gdpr compliant.
when should i use a consultant privacy notice?
use this consultant privacy notice:
-
if you engage consultants for your business in england, wales or scotland
-
to communicate how you collect, store, retain and disclose consultants’ personal data
-
to ensure that your data processing is safe and compliant with data protection laws
sample consultant privacy notice
the terms in your document will update based on the information you provide
about consultant privacy notices
learn more about making your consultant privacy notice
-
how to make a consultant privacy notice
making a consultant privacy notice online is simple. just answer a few questions and 2022世界杯32强抽签时间 will build your document for you. when you have all of the details prepared in advance, making your document is a quick and easy process.
to make your consultant privacy notice you will need the following information:
business details
-
what is the name of the business engaging consultants?
-
who can consultants contact for information about their data rights?
data transfers
-
will personal data be transferred outside of the uk and the european economic area (eea)?
data retention
-
how will information about data retention practices be communicated?
-
if this will be done by way of a data retention policy, where can a copy of the policy be found?
-
-
-
common terms in a consultant privacy notice
consultant privacy notices help businesses ensure that they comply with data protection legislation when they engage consultants and process their personal data. to do this, this consultant privacy notice template covers:
statement and purpose
this section sets out why the business is adopting a consultant privacy notice and explains the business’ commitment to transparency.
what information do we collect?
this section details examples of the types of personal data the business collects. it also explains that consultant personal data is collected through various means and is stored in various locations and provides examples.
why do we process personal data?
this section provides details as to the reason for the personal data processing. this is provided in a simple, easy-to-understand manner so that consultants can easily understand why the business is processing their personal data.
who has access to data?
this section sets out that consultant personal data will be shared internally. it also sets out that consultant personal data can be shared externally with third parties that process data on behalf of the business in connection with making payments. further, this section sets out in what other circumstances the business may share personal data with third parties.
choice
this section sets out that the business does not currently share the consultants’’s personal data with third parties other than those which fall under the section ‘who has access to data?’. it explains that, should the business choose to share personal data with other third parties, the consultants will be given a choice regarding the disclosure. in other words, the consultants can opt out of having their personal data shared.
transfers outside the united kingdom and european economic area
if consultant personal data will be transferred outside the uk and eea, this section sets out the safeguarding requirements that the business must have in place.
how do we protect data?
this section reiterates that the business takes the security of personal data seriously and highlights that relevant data protection policies are in place.
for how long do we keep data?
this section sets out the periods for which the business will retain (ie keep) a consultant’s personal data. this will always be for the length of the consultant’s engagement, while any specific retention periods post-engagement will be governed by the business’ relevant data protection policies or practices.
your rights
this section sets out the rights that consultants have in relation to their personal data. it also provides the details of the person within the business that consultants should contact if they wish to exercise their data protection rights.
complaint resolution
this section sets out how consultants can complain about how their personal data is processed. while this includes complaining directly to the ico, the privacy notice encourages consultants to first attempt to resolve issues internally with the business.
what if you do not provide personal data?
this section sets out that the consultant has to provide the business with certain information under the terms of engagement. it highlights that without this information the business will not be able to properly manage and administer the consultant’s engagement.
changes to this privacy notice
this section highlights that the consultant privacy notice may be changed by the business whenever thisit is considered necessary and explains that consultants will be provided with an updated copy in due course.
if you want your consultant privacy notice to include further or more detailed provisions, you can edit your document. however, if you do this, you may want a lawyer to review or change the privacy notice for you, to make sure it complies with all relevant laws and meets your specific needs. ask a lawyer for assistance.
-
legal tips for making a consultant privacy notice
make sure that you have a legal basis for processing personal data
to process personal data you meet at least one of the stringent legal grounds set out in data protection laws. before you begin to process personal data belonging to consultants, you have to ensure that you have a legal basis for doing so. examples include consultants’ consenting to the processing or your business having a legitimate interest in the processing.
consider what other data protection documents you may need
there are a number of data protection documents you may wish to create to further ensure your compliance with data protection laws. these include, but are not limited to:
-
a data protection and data security policy - to protect your employees’ and clients' data and provide a clear framework forto compliancey with relevant data protection obligations
-
an employee privacy notice - this document is similar to a consultant privacy notice but applies to employees instead of consultants
-
a privacy policy - if you run a website, you should inform users about the types of personal data you are collecting, the reasons for collection and how users can access their data
-
a data protection impact assessment (dpia) - if the processing of personal data is likely to result in a high risk to individuals’ rights and freedoms
-
a data processing agreement (dpa) - if you’re transferring personal data to someone else so they can process it for you (eg a cloud storage service)
make sure the business follows the right data protection procedures
recording how your business will meet its data protection obligations is a crucial first step toward compliance. however, simply having a consultant privacy notice in place and providing it to consultants does not mean that you’ve actually complied with your legal obligations. instead, you need to ensure that the steps outlined in your privacy notice and all other relevant data protection documents are implemented and followed. if you need help with data protection compliance, seek gdpr compliance advice.
understand when to seek advice from a lawyer
ask a lawyer for advice if:
-
issues arise when consultants’ data is used in a way which could infringe upon their privacy or which could relate to their activities outside of work
-
advice is required on the use of covert monitoring in the workplace
-
an existing consultant privacy notice needs to be changed
-
consultant privacy notice faqs
-
what is included in a consultant privacy notice?
this consultant privacy notice template covers:
-
details of the business that is engaging consultants
-
the types of personal data that are collected
-
how the data is collected and stored
-
the reasons why the data is processed
-
who has access to the data
-
international transfers of personal data outside of the uk and the european economic area (eea)
-
the measures taken to protect the data
-
how policies on data storage can be accessed
-
the consultants’ rights as data subjects
-
-
do i need a consultant privacy notice?
transparency is a key principle of the uk general data protection regulation (gdpr). this means that, to comply with data protection legislation (such as the data protection act 2018), a data controller must be clear and honest with all data subjects regarding how their personal data will be used. data subjects are the individuals to which personal data relates. for the purposes of the consultant privacy notice, the consultants are the data subjects. using a consultant privacy notice allows businesses to provide the information necessary to comply with this transparency principle.
-
how can i implement a consultant privacy notice?
this template can be used to create your consultant privacy notice. once created, the notice will be incorporated into your business as long as you ensure that it’s readily available for consultants to read.
you should also ensure that consultants know to whom to direct any data protection questions or concerns (eg a data protection officer (dpo)). the consultant privacy notice could also be included in any starter information provided to consultants.
-
for how long can personal data be stored?
the uk gdpr and dpa do not impose a defined time limit for processing or storing data. however, data should not be stored for longer than necessary. usually, data should be deleted once a the consultant’s engagement has ended. in some cases retaining data for a longer period of time may be justified, for instance on the grounds of a legitimate interest.
how long you retain data for should be set out in a document, for instance, a data retention policy.
-
can data be transferred outside of the uk?
transferring personal data to recipients outside of the uk is prohibited under data protection laws unless certain safeguards are put in place. the international transfer of personal data may be permitted:
-
if the ‘third country’ (ie the country that the recipient is in) has an adequate level of data protection, as determined by the uk’s information commissioner's office (ico). this includes countries within the eea
-
on the basis of standard data protection clauses approved by the uk
for more information, read international transfers of personal data.
-
-
what rights do consultants have in relation to their personal data?
consultants have certain rights relating to personal data held about them, including:
-
the right to access and obtain a copy of their data and to be informed about how their data is being processed
-
the right to have their data rectified if it's inaccurate or incomplete
-
the right to object to the data processing
-
the right to have their data erased in certain circumstances
for more information, read data protection requests.
-
-
what if a consultant has an issue with your data protection practices?
if a consultant believes that a business hasn’t complied with a consultant privacy notice or has otherwise infringed on their rights under data protection legislation, they are able to file a complaint with the ico. however, businesses can encourage consultants to engage with them to attempt to resolve any issues before making a complaint.
our quality guarantee
we guarantee our service is safe and secure, and that properly signed 2022世界杯32强抽签时间 documents are legally enforceable under uk laws.
need help? no problem!
ask a question for free or get affordable legal advice from our lawyer.