Knowledge · Data protection

GDPR in document management for contractors

Approving contractors and controlling access involves collecting and keeping workers’ personal data. Applying GDPR in document management therefore means processing this data lawfully, only for its purpose and with appropriate safeguards.

In brief

Good practice for GDPR in document management

Data flows between your organisation, its contractors and, sometimes, their subcontractors. You need to define who sees each piece of information and for how long.

Ask only for what you need

Each required document should have a clear purpose. Minimising data reduces both risk and validation work.

Access profiles

Each user sees only the information they need for their role.

Retention periods

Decide how long you keep each document. Delete what you no longer need.

Health: Only the outcome

For medical fitness, record the outcome, not the clinical content. Health data is a special category of personal data.

Knowledge

Articles on GDPR

From intention to operational proof: GDPR applied to document management platforms.

How AISP helps

Platforms configured to process only what is necessary

During implementation, AISP configures profiles, permissions and retention rules according to the rules your organisation sets. AISP does not store documentation: it only consults what it needs for its tasks.

Frequently asked questions

Does AISP keep our contractors' documents?

No. The documentation stays in the data centres where the technology partners run the platforms; AISP only consults what it needs for its tasks.

How should you assess the platform provider under GDPR?

Treat it as a processor: confirm where it hosts the data and which data protection safeguards the contract includes. Your data protection officer should then validate the overall approach.

Which authority supervises GDPR in Portugal?

The Comissão Nacional de Proteção de Dados (CNPD). It is the supervisory authority that you notify of personal data breaches, where applicable.

Do your document processes handle only the data you need?

Show us which documents you ask contractors for today. We will show you how to configure the platform to request, display and keep only what is necessary.