Guest user Created: Jun 19, 2018 Last commented: Jun 19, 2018

Retention period and Data processor agreement

1. Retention period – we are looking into the data retention period and would like to know if it is a must to define maximum retention period. We mainly process the job application data. Will it be a violation if we get consent from candidates that “we will keep the data for as long as the candidate wants us to source for employment opportunities”?

0 0

Assign topic to the user

Select user

Expert

Andrei Hanganu Jun 19, 2018

2. Data processor agreement – Our client requested us to sign a Data Processing Agreement, which defines our client as data controller and us as the data processor. However, under certain situation, in delivering the service to clients, we play the data controller role and our client is the data processor. Does this means we need another Data Processing Agreement for these exchanged roles?

Answer:

1. I strongly advise you to define a maximum retention policy for candidates CV considering that anyway the data in the CV would be most likely outdated in a few years.
2. Not necessarily. When you are acting as an independent controller it is not necessary to have a DPA with another controller.

To learn more about the EU GDPR check out our “EU GDPR Foundations Course” (https://advisera.com/training/eu-gdpr-foundations-course//)

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Jun 19, 2018

Expert Advice Community