The Lawful Bases
<\/h1>\n
The fundamental principle for handling personal data is that data must be processed lawfully and in a transparent manner. GDPR defines six lawful bases to process data. It is important to understand all of them as no one lawful basis is better than the others. Choosing the most appropriate basis depends on the purpose of data processing and your business requirements.
<\/p>\n
- \n
- Consent<\/strong> - When you have consent from the data subject to process their personal data. There must be a deliberate action on the part of the data subject to opt-in or give consent.
Example: Collecting and processing personal data for marketing purposes or sending newsletters.
<\/li>\n- Contract<\/strong> - When you have a contract with an individual to supply goods or services requested by them. In this case, you process data to fulfill the contract.
Example: During a contract, when the customer asks for more information via email, the organization processes their personal data to respond to the request.
<\/li>\n- Legal<\/strong> Obligation<\/strong> - When you have to process the data to comply with the law.
Example: An employee's salary details are needed by a government institution or an investigation requires the processing of the personal data.
<\/li>\n- Vital<\/strong> Interests<\/strong> - When you need to process data to protect someone's life or in an emergency.
Example: Collecting personal details of the people to ensure their safety during an emergency or a fire.
<\/li>\n- Public<\/strong> Tasks<\/strong> - When you need to carry out tasks in the public interest, usually as a government institution, political party, etc.
Example: As a public authority who processes data for scientific research, surveys, or public health studies.
<\/li>\n- Legitimate<\/strong> Interests<\/strong> - When your organization holds a genuine, legitimate reason to process data and the purpose does not harm the data subject's rights.
Example: A customer has not paid their invoice and so the company needs to process the customer's data to collect payment. Alternatively, for administrative purposes, when an organization processes an employees' personal data for payroll.<\/li>\n <\/ul>\nConsent Management in Zoho Recruit
<\/h1>\nThere are three stages that you can track in Zoho Recruit with respect to consent as the lawful basis for processing data. Please note that primary email field is used to update the consent status in all the similar records that have the same email address as the primary one in your Zoho Recruit account. For example, you get consent from a candidate, and when you convert the candidate to a contact, the created contact will be updated with the consent status. If the primary email address is changed, you will need to get consent again.<\/span>
\n <\/div>\n
\n <\/div>\n
\n <\/div>\n\n- \n
- Pending<\/strong> - When the request for consent is not sent to the data subjects.
<\/li>\n- Waiting<\/strong> - When the consent form has been sent and you are waiting for a reply.
<\/li>\n- Obtained<\/strong> - When you have received consent from the data subject.
<\/li>\n- Not Responded<\/b> - When you have not received consent from the data subject within the waiting period defined in the Consent Settings.<\/li>\n <\/ul>\n <\/div>\n
Defining Consent Settings<\/u>
<\/h2>\nTo define consent settings in Zoho recruit;<\/b><\/span><\/span>
\n <\/div>\n<\/div>\n\n- \n
- Click Setup<\/b> > Users and Control<\/b> > Compliance Settings<\/b> > Preferences<\/b>.
<\/li>\n- \n
\n Under Consent Settings <\/i>section, do the following:
\n <\/div>\n- \n
- Waiting Period<\/b> - Select the period in Days<\/i> or Months<\/i>.
After this waiting period is over, the consent status is updated as Not Responded or Record Deleted<\/i>.
\n\n <\/div><\/li>\n
- \n
\nData Deletion Consent
<\/b>
The Data Deletion Consent gives you an option to delete data automatically once the \"Waiting Period\" defined by you is completed. To enable this option, select the check box and save.
If you wish to manually manage this process and not have an automatic data deletion option, you can uncheck this box at any point. <\/span>\n <\/div>\n <\/div><\/li>\n- \n
Manage Actions in a record when the consent is unavailable <\/b>- Select one of the following:
\n <\/div>\n- \n
- Process data as usual<\/b> - You can continue to work with the records as usual.
<\/li>\n- Stop processing data<\/b> - The records will be locked and data form the record will not be processed.
<\/li>\n- Restrain certain actions<\/b> - Select the actions that needs to be restricted when the consent is yet to be received.
<\/li>\n <\/ul><\/li>\n <\/ul><\/li>\n- Click Save<\/b>.
<\/li>\n <\/ol>\n<\/div>\nSetting up the Consent Form<\/u>
<\/h2>\nThe consent form can be customized and it allows controllers to state the explicit details for which they are obtaining consent. The following can be added in the form: <\/span>
\n<\/div>\n- \n
- The purpose of data collection.
<\/li>\n - Preferred communication channel.
<\/li>\n<\/ul>\nTo set up the consent form<\/span>\n<\/div>\n- \n
- Click Setup<\/strong> > Compliance<\/strong> > GDPR<\/strong>.
<\/li>\n- In the GDPR<\/em> page, enable the option using the button.
<\/li>\n- Select the Language<\/strong> that you want your data subjects to view the form in.
<\/li>\n- Under the Consent Portal<\/strong>, do the following to customize the form: \n
- \n
- Add relevant text to state the purpose of using their personal data and why you are getting consent.
<\/li>\n - For the Communication<\/strong> Preferences<\/strong>, add a short description. For example: Allow us to contact you through:<\/em>
<\/li>\n- Click the Show/Hide<\/strong> links for the corresponding options (Email, Phone) to make them visible/hidden in the form.
<\/li>\n- Based on the selection, the option to send emails or make calls will be disabled for the corresponding records.
<\/li>\n- For Consent<\/strong> Statement<\/strong>, add a message that asks the data subjects to provide remarks, if any.
<\/li>\n- Add your Privacy<\/strong> Statement<\/strong> in the text box.
<\/li>\n- Specify any additional text before the Submit button in the form.
<\/li>\n <\/ul><\/li>\n- Click Preview<\/strong> to check the form, then click Save<\/strong>.
<\/li>\n<\/ol>\nGetting Consent from Candidates<\/u><\/h2>\n
- \n
- Open a data subject's record in your Zoho Recruit account.
The record could be in the Candidates or Contacts for which GDPR Compliance is enabled.
<\/li>\n - Click Data<\/strong> Privacy<\/strong>.
<\/li>\n- Mark the Data<\/strong> Processing<\/strong> Basis<\/strong> as Applicable<\/em> and select Consent<\/em> from the drop-down list.
<\/li>\n- Under the Pending<\/em> status, click the Send<\/strong> consent<\/strong> form<\/strong> link.
<\/li>\n- The Send Email<\/em> page opens from where you can request for the consent. Attach files if there are any and click Send<\/strong>.
<\/li>\n- Once sent, the status will change from Pending<\/em> to Waiting<\/em>.
<\/li>\n<\/ol>\nUpdating Consent Manually<\/u>
<\/h3>\n- \n
- Under the Pending<\/em> or Waiting<\/em> status, click the Update consent details<\/strong> link.
<\/li>\n- In the Update Consent Details<\/em> popup, do the following:
![\"\"](\"https://zcmss.zohocorp.com/sites/default/files/recruit/update-details.png\")
\n - \n
- Select Email<\/strong> or Call<\/strong>, to maintain a record of how you received the consent.
<\/li>\n- In the Consent Date<\/strong> field, specify the date when you got the consent.
<\/li>\n- Add Consent Remarks<\/strong>, if any.
<\/li>\n- Select from the list of Communication Preferences<\/strong> mentioned by the data subject.
<\/li>\n- Click Save<\/strong>.
<\/li>\n <\/ul><\/li>\n- The status will change to Obtained<\/em>.<\/li>\n<\/ol>\n
\nBest Practices for Consent Management
<\/h1>\n- \n
- Inform the data subjects on the purpose of consent and data processing.
<\/li>\n - If you deviate from the original purpose of data processing for which you received consent, then you will need to get consent from the data subjects again.
<\/li>\n - Make sure to keep your consent requests separate from any other terms and conditions.
<\/li>\n - The consent request or form should contain details about who is collecting the consent (data controller), where the data is processed (data processor), and where the data is being shared.
<\/li>\n - Maintain a proper record of the consent collected. This is important to demonstrate that the data subject has given proper consent to process data.
<\/li>\n - Avoid usage of technical terms and legal jargons while getting consent. Keep your message clear and simple.
<\/li>\n - Make a point of refreshing consent at regular intervals.<\/li>\n <\/ul>\n<\/div>\n
\n<\/div>","translationId":"205219002564154315","webUrl":"https://help.zoho.com/portal/en/kb/recruit/compliance/gdpr/new-version/articles/gdpr-consent-management","followersCount":"0","category":{"name":"New Version","id":"205219014944439446","locale":"en"},"permalink":"gdpr-consent-management","categoryId":"205219014944439446"}
- In the Consent Date<\/strong> field, specify the date when you got the consent.
- In the Update Consent Details<\/em> popup, do the following:
- Mark the Data<\/strong> Processing<\/strong> Basis<\/strong> as Applicable<\/em> and select Consent<\/em> from the drop-down list.
- Click the Show/Hide<\/strong> links for the corresponding options (Email, Phone) to make them visible/hidden in the form.
- In the GDPR<\/em> page, enable the option using the button.
- Click Setup<\/strong> > Compliance<\/strong> > GDPR<\/strong>.
- Stop processing data<\/b> - The records will be locked and data form the record will not be processed.
- \n
- \n
- Waiting<\/strong> - When the consent form has been sent and you are waiting for a reply.
- Contract<\/strong> - When you have a contract with an individual to supply goods or services requested by them. In this case, you process data to fulfill the contract.