Zoho Workerly's consent management settings help you get consent from your data subjects. You can customize a consent form, include it in your email templates, set consent-related preferences, and most importantly, keep track of consent details much easier.

The lawful basis

The fundamental principle for handling personal data is that data must be processed lawfully and transparently. GDPR defines six lawful foundations for processing data. It's important to understand all of them. Choosing the most appropriate basis depends on the purpose of data processing and your business requirements.

• Consent - You have consent from the data subject to process their personal data. There must be a deliberate action on the part of the data subject to opt in or give consent.
  Example: Collecting and processing personal data for marketing purposes or sending newsletters.
   

• Contract - You have a contract with an individual to supply goods or services requested by them. In this case, you process data to fulfill the contract.
  Example: During a contract, when the customer asks for more information via email, the organization processes their personal data to respond to the request.
   

• Legal Obligation - You have to process the data to comply with the law.
  Example: An employee's salary details are needed by a government institution or an investigation requires the processing of personal data.
   

• Vital Interests - You need to process data in an emergency or to protect someone's life.
  Example: Collecting the personal details of people to ensure their safety during an emergency or a fire.
   

• Public Tasks - You need to carry out tasks in the interest of the public, usually as a government institution, political party, etc.
  Example: A public authority who processes data for scientific research, surveys, or public health studies.
  
  

• Legitimate Interests - Your organization holds a genuine, legitimate reason to process data and the purpose does not harm the data subject's rights.
  Example: A customer has not paid their invoice, and the company needs to process the customer's data to collect payment. Another example is when an organization processes an employees' personal data for payroll.

Understanding consent management in Zoho Workerly

  Best practices for consent management  

• Inform your data subjects on the purpose of consent and data processing.

• If you deviate from the original purpose of data processing for which you received consent, then you will need to get consent from the data subjects again.

• Make sure to keep your consent requests separate from any other terms and conditions.

• The consent request or form should contain details about who is collecting the consent (data controller), where the data is processed (data processor), and where the data is being shared.

• Maintain a proper record of the consent collected. This is important to demonstrate that the data subject has given proper consent to process data.

• Avoid using technical terms and legal jargon while getting consent. Keep your message clear and simple.

• Make a point of refreshing consent at regular intervals.
  
  

Stages of consent management
  

There are three stages that you can track in Zoho Workerly with respect to consent as the lawful basis for processing data. Please note that the primary email field is used to update the consent status in all the similar records that have the same email address as the primary one in your Zoho Workerly account. For example, you get consent from a temp, and when you convert the temp to a contact, the created contact will be updated with the consent status. If the primary email address is changed, you will need to get consent again.

• Pending - The request for consent is not yet sent to the data subjects.

• Waiting - The consent form has been sent, and you are waiting for a reply.

• Obtained - You have received consent from the data subject.

• Not Responded - You have not received consent from the data subject within the waiting period defined in the Consent Settings.
  

Set up consent form
  

The consent form can be customized, and it allows controllers to state the explicit details for which they are obtaining consent. The following can be added in the form:

• The purpose of data collection

• A preferred communication channel
  

To set up the consent form:  

1. Click Setup > Compliance > GDPR.

2. On the GDPR page, enable the option using the toggle button.

3. Select the Language that you want your data subjects to view the form in.

4. Under the Consent Portal, do the following to customize the form:

• Add relevant text to state the purpose of using the personal data and why you are getting consent.

• For Communication Preferences, add a short description. For example: Allow us to contact you through:

• Click the Show/Hide links for the corresponding options (Email, Phone) to make them visible or hidden in the form.

• Based on the selection, the option to send emails or make calls will be disabled for the corresponding records.

• For the Consent Statement, add a message that asks the data subjects to provide remarks, if any.

• Add your Privacy Statement in the text box.

• Specify any additional text before clicking the Submit button in the form.

5. Click Preview to check the form, and then click Save.

Getting consent from temps
  

1. Open a data subject's record in your Zoho Workerly account.
The record could be in the Temps or Contacts module for which GDPR Compliance is enabled.

2. Click Data Privacy.

3. Mark the Data Processing Basis as Applicable, and select Consent from the drop-down list.

4. Under the Pending status, click the Send consent form link.

5. The Send Email page opens from where you can request consent. Attach files if there are any, and click Send.

6. Once sent, the status will change from Pending to Waiting.

You can even update the status manually. 
  

1. Under the Pending or Waiting status, click the Update consent details link.

2. In the Update Consent Details popup, do the following:

• Select Email or Call to maintain a record of how you received the consent.

• In the Consent Date field, specify the date that you received consent.

• Add Consent Remarks, if any.

• Select from the list of Communication Preferences mentioned by the data subject.

• Click Save.