My company hosts an online database for organisations to manage training data for their people.

In most cases, administrator users (team leaders/line managers) manage data for their staff/teams. From an organisation of say, 500 people, usually only around 30 people might ever log in and view data for their teams.

I'm currently trying to understand how the new GDPR regulation regarding consent will be relevant/applied:

(32) Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject's acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them. If the data subject's consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.

How therefore can organisations like ours realistically provide this, when many people won't actually see/access their own data? Is consent still required here? Can that consent be managed by the central point of contact at the client (outside our software)?

I've looked at over a dozen sites providing "advice", but each re-hash the same generic information that doesn't provide enough clarity.

1 Answer 1


I believe in this case, your company (OrgX) is a data processor and your customer's organization (OrgY) is the data controller.

OrgY is responsible for establishing a lawful basis for sending you (OrgX) the personal data for their employees. Note that consent is just one of six lawful bases outlined in article 6(1). I'm no expert, but I believe OrgY's admin can claim they have a legitimate interest in sending their employee's personal data for training sake. In either case, the data processor is not responsible for establishing the lawful basis for processing.

Of course, data processors aren't completely off the hook. GDPR outlines specific requirements for data processors (see chapter 4, particularly article 28).

  • Thanks for this. My rant with the whole regulation is that its open to intepretation on such a grand scale. As with me, you have had to assume an outcome, but I'm sure the ICO (the organisation who manages compliance to this regulation in the UK) would still take pleasure in dishing out a fine if we're wrong. I've written to the ICO for clarity, and will update here if they respond.
    – EvilDr
    Commented Jan 18, 2018 at 14:24
  • 2
    Oh, and +1 for your belief in the answer, and not because you wrote "OrgY" (...chuckles)
    – EvilDr
    Commented Jan 18, 2018 at 14:25
  • lol. Didn't even notice that. Makes me think of all the times I've used OrgX and OrgY.
    – dejuknow
    Commented Jan 18, 2018 at 23:47
  • 2
    I think answer should be accepted. The regulation isn't that open to interpretation. The way it specifies the relationship between the controller and processor, and the obligation of the controller to establish the legal basis for processing, pretty much nails it. Commented May 13, 2018 at 14:27
  • @EvilDr: Did you receive a reply yet?
    – danuker
    Commented Apr 14, 2019 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .