Country compliance and privacy consent statements (DPCS)

The Compliance menu brings together the settings specific to each country where you have contracts, and the privacy consent statements (DPCS) shown to employees. This article explains how to read the country cards, set how medical visits and headcount are calculated, and write, publish, send and track a statement. It is for administrators, HR and the data protection officer.

Before you start #

• The menu opens with one of the permissions of its screens: “Platform settings” (Platform administration, Global settings section), “Regulatory file” (Training), “Benefits compliance controls” (Benefits) or “Consent statement (DPCS) — Create/Edit/View” (Data privacy (GDPR)). Each tab only appears with its permission and, for Training and Benefits, its module.
• Medical visits and headcount: “Platform settings”, Access level to read, Execute to change.
• Statements: “Consent statement (DPCS) — Create/Edit/View” (Access to view; Execute to create, edit, duplicate, send and manage contacts), “DPCS — Publish”, “DPCS — Archive”, “DPCS — Delete” (at the Execute level) and “DPCS — Audit log” (logs tab).
• By default, only the Administrator role holds these permissions (see Permissions & roles).

Country cards #

Open Settings › Manage Illizeo › Compliance. A card appears by itself for each country with an attached contract: current, upcoming or ended less than 5 years ago, drafts excluded. The country is that of the contract’s office, failing that the office on the profile, failing that the company’s. A contract whose office has no recognised country is counted in no card; the page introduction says so.

Each card gives the number of contracts and its tabs:

• Medical visits and headcount: France and Morocco;
• Training: the French regulatory framework (see Agreements, invoices, certificates and regulatory filings);
• Benefits: the country’s benefits compliance controls, with the Benefits module.

The Data protection (DPCS) card, common to all countries, leads to the privacy statements.

Medical visits and headcount in France #

The tab offers three choices. Click an option, then Save in the bar that appears.

• Medical visits: Statutory deadlines (default) calculates the information visit, the periodic visit, enhanced follow-up, the return after maternity leave or long sick leave, and the mid-career visit. Hiring and entered date only keeps the information visit, then the “next visit” entered on the profile.
• Headcount scope: Per sub-company (default) or Whole workspace.
• Headcount calculation: Annual average (default), following the French Social Security Code rules, or Active employees today.

The visits setting feeds the “Next medical visit due (France)” card on the profile, the “Medical visits” system report, the “Medical visit due (France)” reminder sent to HR managers 30 days ahead (by email and in notifications), managers’ deadline list and the return-to-work visit alerts after long sick leave. With Hiring and entered date, periodic, return and mid-career visits, and their alerts, are no longer calculated. The two headcount settings feed the “Headcount thresholds (France)” report and the BDESE entities; they trigger no alert. See the system reports catalogue.

Medical visits and headcount in Morocco #

Four choices: Medical visits (Statutory deadlines or Hiring and entered date), Exposed work (No or Yes), Headcount scope and Headcount calculation (Usual headcount or Active employees today). The Headcount and thresholds block shows, per company, the calculated headcount and the 10, 50 and 100-employee thresholds, with the obligations attached. These obligations are shown for information.

An occupational health service is required if Exposed work is Yes or if the headcount reaches 50. In that case, visits feed the profile, the report, the 30-day reminder and the deadline list; otherwise, the profile shows them as “For information”.

Writing and publishing a statement #

1. Open the Data protection (DPCS) card. The Data Privacy Consent Statements page shows its indicators and three tabs: Declarations, Consent logs and Compliance contacts.
2. Click New Statement, or Create from the Canadian template to start from a federal, Quebec, Alberta or British Columbia draft to complete.
3. Fill in the Title (required) and the Content, in French and English.
4. Choose the Type, which cannot be changed later: Login (shown at sign-in) or Registration (given automatically to employees created with the add-employee wizard, according to their office).
5. Choose the Legal basis: Consent (the employee accepts, declines or withdraws), Contract or Legal obligation (they take note of it), Legitimate interest (they may object). A Not yet qualified statement can be neither published nor sent.
6. Complete Countries, Office (all by default), Version (at creation, for example 1.0), Effective Date (today or later), Redirect URL on decline, Show at every login, the Presentation panel (left side), the Key points shown to the employee and Allow PDF download, then Save.
7. To publish, open the statement with View and click Publish, or click its status badge.

Each change increases the version. If the title or content changes, the statement is shown again, at their next sign-in, to everyone who had received it, including those who had accepted it. The Version notes of the last save make up the “What changed” box.

Sending a statement to employees #

An active Login statement with a legal basis is sent from View, Employee Preview tab, Send to employees block: tick the recipients, then click Send to, followed by the number of people. Each receives the “Action required: Data Privacy Consent Statement” email, whose buttons stay valid for 7 days, and a notification; a reminder goes out after 7 working days, two at most, as long as they have not answered. Only recipients see the statement in Illizeo, including with Show at every login.

What the employee sees #

At sign-in, a window shows the statement, its key points, its contacts and, if you allowed it, its PDF, in French or English. With the Consent basis, they tick “I have read, understood and accept this privacy policy.” then click I accept, or Decline: the refusal is recorded, the employee is signed out (or sent to the URL provided) and the statement is shown again at the next sign-in. With the other bases, they tick “I have read and taken note of this statement.” then click I acknowledge.

Consent is withdrawn in Personal Settings, Privacy Consent tab, Withdraw my consent button (see Employee self-service). The designated data protection officer is told by email.

Logs, contacts and archiving #

• Consent logs: one line per sending and per answer, filterable by statement, language, status and dates. The Date column gives the sending date. Export produces a CSV file.
• Compliance contacts: data protection officer, representatives in the Union, in Switzerland and in the UK, Encarregado (Brazil) and person in charge of the protection of personal information (Québec). Designate, Edit or Withdraw designation: these contacts are published on every statement and in its PDF; a role left empty publishes nothing.
• An active or already accepted statement cannot be deleted: it is archived. Deleting any other statement is permanent and also erases its answers.
• Duplicate copies the title and content; the legal basis, presentation and key points must be set again.

Good to know #

• The sending list shows the first 25 active employees of the workspace; the others are not in it.
• A Registration statement is given without an email, and only to employees created with the add-employee wizard who have an office.
• Content is written and shown in French and English only.