When extending an employment contract with an employee, is it necessary to grant a new authorisation to process personal data?

ANSWER

When an employment contract is extended, whether it is necessary to grant a new authorisation or extend the existing one will depend on how the authorisation itself was constructed, i.e. whether it contains a reference to the contract that is ending or specifies a period of validity, or whether, in connection with the extension, the scope of personal data processed will change (e.g. a change of job position). In such a situation it will be appropriate to grant a new authorisation or supplement the existing one.

If, however, the content of the authorisation granted does not specify a period of validity or refer to a specific contract, it is assumed that it remains valid until it is revoked by the data controller. As regards the information obligation, there is no need to provide it again unless the individual items of information that the controller is obliged to provide under Article 13(1) and (2) GDPR change. The above follows from Article 13(4) GDPR.