Library · Travel & housing – master data in detail
DAT-080 · Collect and document consents, and process withdrawals
Creates and documents the legal basis for all processing not already covered by the contract, and turns withdrawal into a working process instead of…
Travel & housing · master data
Overview
Who it's for
Coordination, assistance, office
Trigger
Collection of special categories (DAT-050), use of a channel requiring separate consent (COM-060), ID data collection (DAT-030), or introduction of a new processing purpose.
You get
Creates and documents the legal basis for all processing not already covered by the contract, and turns withdrawal into a working process instead of a line in the privacy notice.
Creates and documents the legal basis for all processing not already covered by the contract, and turns withdrawal into a working process instead of a line in the privacy notice.
Rule (automatable) Judgment (human decides)
Decision rules
R1IF processing is required for contract fulfillment THEN don't obtain consent, but document Art. 6(1)(b) GDPR; an unnecessary consent creates a right of withdrawal that makes the process needlessly vulnerable.R2IF multiple purposes are affected THEN obtain separate consent per purpose; a bundled consent counts as not given.R3IF no consent exists for a purpose THEN the related processing is technically blocked and the person faces no disadvantages for travel or accommodation beyond the missing special service.R4IF a withdrawal is received THEN block immediately, delete within 72 h, review perR5; the lawfulness of processing up to the withdrawal remains unaffected.R5IF a data transfer already made toHOTorRDLis affected THEN request the recipient to delete it and log the request; if the booking cannot be carried out without the information, check an alternative according to CHG-020.R6IF{{EINWILLIGUNG_TEXTVERSION}}changes in substance (not just editorially) THEN obtain new consent for all affected persons.
Common pitfalls
1. A bundled consent covers diet, passport data, and messenger use in one sentence → it doesn't hold up for any of the purposes, and the first withdrawal cancels all three. 2. Withdrawal is sent via messenger to one individual and never entered into the system → processing continues even though the basis no longer applies. 3. Consent is obtained for processing already covered by the contract → unnecessary withdrawal risk for data that's mandatory. 4. Text version is changed without tracking → for existing records, it's no longer provable which text was agreed to.