The GDPR Countdown: Employers Are You Ready? – Consent

As mentioned in our previous GDPR update, the fourth update in this series will deal with employee consent in the employment relationship post 25 May next.

Under the GDPR, consent remains a legitimate processing ground for processing of both sensitive and non-sensitive data. However, the GDPR, unlike existing rules, sets out clearly defined requirements around consent, and mandates that consent may only be obtained for one or more specific purposes, with multiple consents required where the employer intends using data for multiple purposes.

For consent to be valid, the GDPR requires an employer to demonstrate amongst other things that consent is:

• freely given;
• specific and informed (clear language);