Per­so­nal data may only ever be stored and pro­ces­sed for a per­mis­si­ble pur­po­se, about which the per­sons con­cer­ned must always be infor­med. Data may only be pas­sed on to third par­ties for a spe­ci­fic pur­po­se, e.g. pas­sing on address data to the par­cel shipper.

Examp­les of the trans­fer of data that must be docu­men­ted in the list of pro­ces­sing acti­vi­ties and about which the data sub­jects must always be informed:

  • Dis­clo­sure of employee data to exter­nal accoun­ting / pay­roll department.
  • For­war­ding of data sub­ject names and deli­very addres­ses to logi­stics companies
  • Pas­sing on of cus­to­mer data for cre­dit­wort­hi­ness checks
  • Coll­ec­tion of cus­to­mer data in a hos­ted e‑shop of a cloud provider
  • Sha­ring of bil­ling data with cloud soft­ware for elec­tro­nic invoicing
  • Pas­sing on online pay­ment data to a pay­ment service
  • Sha­ring web traf­fic meta­da­ta with a cloud ana­ly­tics service
  • Sha­ring data sub­ject names and email addres­ses with a cloud news­let­ter tool

Edu­ca­te your employees about the major con­se­quen­ces of pro­ces­sing data out­side of the agreed pur­po­se or sha­ring it with third par­ties not pre­vious­ly defi­ned. Be sure to con­sult data pro­tec­tion experts when trans­fer­ring data to a non-EU country.

Pre­vious artic­le: Employee Data Pro­tec­tion Awa­re­ness: #3 Trans­pa­rent Processing

Next artic­le: Employee Data Pri­va­cy Awa­re­ness: #5 Data Minimization