The Lawful Bases

The fundamental principle for handling personal data is that data must be processed lawfully and in a transparent manner. GDPR defines six lawful bases to process data. It is important to understand all of them as no one lawful basis is better than the others. Choosing the most appropriate basis depends on the purpose of data processing and your business requirements.

• Consent - When you have consent from the data subject to process their personal data. There must be a deliberate action on the part of the data subject to opt-in or give consent.
  Example: Collecting and processing personal data for marketing purposes or sending newsletters.
  
• Contract - When you have a contract with an individual to supply goods or services requested by them. In this case, you process data to fulfill the contract.
  Example: During a contract, when the customer asks for more information via email, the organization processes their personal data to respond to the request.
  
• Legal Obligation - When you have to process the data to comply with the law.
  Example: An employee's salary details are needed by a government institution or an investigation requires the processing of the personal data.
  
• Vital Interests - When you need to process data to protect someone's life or in an emergency.
  Example: Collecting personal details of the people to ensure their safety during an emergency or a fire.
  
• Public Tasks - When you need to carry out tasks in the public interest, usually as a government institution, political party, etc.
  Example: As a public authority who processes data for scientific research, surveys, or public health studies.
  
• Legitimate Interests - When your organization holds a genuine, legitimate reason to process data and the purpose does not harm the data subject's rights.
  Example: A customer has not paid their invoice and so the company needs to process the customer's data to collect payment. Alternatively, for administrative purposes, when an organization processes an employees' personal data for payroll.

Consent Management in Zoho Recruit

Defining Consent Settings

1. Click Setup > Users and Control > Compliance Settings > Preferences.
   
2. Under Consent Settings section, do the following:
   
   • Waiting Period - Select the period in Days or Months.
     After this waiting period is over, the consent status is updated as Not Responded or Record Deleted.
     
     
   • Data Deletion Consent
     
     The Data Deletion Consent gives you an option to delete data automatically once the "Waiting Period" defined by you is completed. To enable this option, select the check box and save.
     
     If you wish to manually manage this process and not have an automatic data deletion option, you can uncheck this box at any point.
   • Manage Actions in a record when the consent is unavailable - Select one of the following:
     
     • Process data as usual - You can continue to work with the records as usual.
       
     • Stop processing data - The records will be locked and data form the record will not be processed.
       
     • Restrain certain actions - Select the actions that needs to be restricted when the consent is yet to be received.
       
3. Click Save.
   

Best Practices for Consent Management

• Inform the data subjects on the purpose of consent and data processing.
  
• If you deviate from the original purpose of data processing for which you received consent, then you will need to get consent from the data subjects again.
  
• Make sure to keep your consent requests separate from any other terms and conditions.
  
• The consent request or form should contain details about who is collecting the consent (data controller), where the data is processed (data processor), and where the data is being shared.
  
• Maintain a proper record of the consent collected. This is important to demonstrate that the data subject has given proper consent to process data.
  
• Avoid usage of technical terms and legal jargons while getting consent. Keep your message clear and simple.
  
• Make a point of refreshing consent at regular intervals.