When changing the legal form of a business, must consent for personal data processing be obtained again?

ANSWER

A data controller that merely transforms its business form from a sole proprietorship to a limited liability company is not obliged to collect new consents from data subjects or even new personal data protection documentation. In such a situation, the controller's obligation will be to review existing documentation and, for example, amend it. Addenda should be concluded to processing agreements, and employee authorisations should be amended. A new privacy notice should also be prepared, effective from the date of transformation, or only the changed information should be communicated if the remainder stays the same. The controller may, however, continue to use existing patient documentation without hindrance, as in such a case it remains the same entity, only with a changed legal form.