The collection and processing of personal data requires great care. It is important to note that personal data may only be processed in the following cases:
- If the processing of personal data and the personal data to be processed is mandated by law or if the processing of certain personal data is subject to the personal consent of the data subject.
- Notwithstanding the previous paragraph, personal data of individuals who have concluded a contract with the private sector or are in the process of negotiating a contract with the private sector, at the initiative of the individual, may be processed if the processing of the personal data is necessary and appropriate for the purpose of carrying out the negotiations for the conclusion of the contract.
- Notwithstanding the first paragraph, personal data may be processed in the private sector where this is necessary for the pursuit of legitimate interests of the private sector and those interests manifestly override those of the data subject.
Before consent to the processing of personal data is collected, individuals must be adequately informed, i.e. provided with certain information regarding the processing of their personal data, namely:
- which of their personal data you are processing;
- for what purpose you are processing it;
- who is processing their data (details of the data controller and their representative, if any (personal name, if a private person, title or business name and address or registered office));
- other information, if necessary, to ensure lawful and fair processing.
It is best to include the above in the introduction to the questionnaire or form.
Related content
