When collecting personal data, as a minimum, data subjects should be told:
A contact name, job position and telephone number should also be provided.
Prior consent should be obtained from data subjects to hold and process ("handle") their personal data and it is essential that such consent is obtained if the personal data is to be sent outside the European Economic Area and/or is sensitive data. Consent must be meaningful and freely given so it is important that individuals understand what will happen to their data.
Individuals should be given a plain language description of what will be done with their personal data and, where appropriate, a reassurance that individuals will not be disadvantaged if they choose to withdraw their personal data (for example, tell patients that if they withdraw from a clinical trial their medical data will be unaffected).
