Assign topic to the user
Answer:
In the situation described by you the psychologist would act as a processor and would process the personal data you've mentioned on your behalf in order to provide the assessment. There are two things to be considered in this situation:
1. There needs to be a legally binding document between the school acting as a data controller and the psychologist acting as a data processor. These documents must comply with the requirements of EU GDPR art 28 – Processor (https://advisera.com/eugdpracademy/gdpr/processor/). You can find such template in your EU GDPR Documentation Toolkit (https://advisera.com/eugdpracademy/documentation/supplier-data-processing-agreement/).
2. The second thing is that you need to ment ion in your Privacy Notice(s) that personal data would be processed by third parties. You can find such template in your EU GDPR Documentation Toolkit (https://advisera.com/eugdpracademy/documentation/privacy-notice/)
Comment as guest or Sign in
Aug 22, 2018