- Original Poster
- #1
Hi,
My company works with a number of trade based sub contractors, i.e. plumbing, electricians etc., who basically work only for us. They are paid by the Construction Industry scheme (CIS), which means we do hold a certain amount of personal data of theirs, not dissimilar to what we'd have of employees. They would also spend time working on our behalf in company premises which may give them access to personal data of others, all of which makes me think they should be signing something under GDPR - but I'm not sure what!
For instance, they could be seen as data subjects of ours, and therefore need to see a data privacy notice acknowledging the data we hold of theirs (and I'd want them to sign to say they'd read it). But also, given they are working in our buildings, they could be seen as data processors in a professional capacity even though they don't work with data as such, and therefore we should be asking them to sign up to take sufficient precautions with the personal data of others etc.
Can anyone help? We don't have a legal department, so I'm not quite sure what we should be drawing up to cover these bases.
Thanks for any help!
My company works with a number of trade based sub contractors, i.e. plumbing, electricians etc., who basically work only for us. They are paid by the Construction Industry scheme (CIS), which means we do hold a certain amount of personal data of theirs, not dissimilar to what we'd have of employees. They would also spend time working on our behalf in company premises which may give them access to personal data of others, all of which makes me think they should be signing something under GDPR - but I'm not sure what!
For instance, they could be seen as data subjects of ours, and therefore need to see a data privacy notice acknowledging the data we hold of theirs (and I'd want them to sign to say they'd read it). But also, given they are working in our buildings, they could be seen as data processors in a professional capacity even though they don't work with data as such, and therefore we should be asking them to sign up to take sufficient precautions with the personal data of others etc.
Can anyone help? We don't have a legal department, so I'm not quite sure what we should be drawing up to cover these bases.
Thanks for any help!
