Audit modelGDPR compliance assessment of data processing

Consent must not be coerced or influenced. The person must be offered a real choice, without having to suffer negative consequences if they refuse.

A consent must correspond to a single processing operation, for a specific purpose.

For consent to be valid, it must be accompanied by a certain amount of information communicated to the person before they consent.

Beyond the obligations linked to the transparency, the controller should provide the following information to data subjects to obtain their informed consent:

• the identity of the controller ;

• the purposes pursued ;

• the categories of data collected;

• the existence of a right to withdraw consent ;

• as appropriate : the fact that the data will be used in the context of individual automated decisions or that they will be the subject of a transfer to a country outside the European Union.

Consent must be given by the data subject by means of a declaration or any other clear positive act. No ambiguity as to the expression of consent may remain.

Interests are presumed legitimate for data processing :  

• aimed at guaranteeing network and information security,

• implemented for fraud prevention purposes,

• necessary for commercial canvassing operations with a company's customers,

• related to customers or employees within a group of companies for internal administrative management purposes.

In other words, the nature of the interest pursued by an organisation may be presumed if the following 3 conditions are met:

• the interest is manifestly lawful under the law ; 

• it is determined in a sufficiently clear and precise manner ;

• it is real and present for the organisation concerned, and not fictitious.

You can identify the legal text that asks you to perform the data processing.

This is information revealing

• alleged racial or ethnic origin,

• political opinions,

• religious or

• philosophical beliefs or

• trade union membership,

• and the processing of genetic data,

• biometric data for the purpose of uniquely identifying a natural person,

• data concerning health or

• data concerning the sex life or sexual orientation of a natural person.