---
title: Country compliance and privacy consent statements (DPCS)
description: Find the compliance settings of each country where you have contracts, and write, publish and track the privacy statements shown to employees.
url: "https://illizeo.com/en/centre-aide/security-compliance-and-privacy-statements/"
updated: "2026-11-05"
category: "Platform / Security & compliance"
---

# Country compliance and privacy consent statements (DPCS)

The Compliance menu brings together the settings specific to each country where you have contracts, and the privacy consent statements (DPCS) shown to employees. This article explains how to read the country cards, set how medical visits and headcount are calculated, and write, publish, send and track a statement. It is for administrators, HR and the data protection officer.

## Before you start

- The menu opens with one of the permissions of its screens: "Platform settings" (Platform administration, Global settings section), "Regulatory file" (Training), "Benefits compliance controls" (Benefits) or "Consent statement (DPCS) — Create/Edit/View" (Data privacy (GDPR)). Each tab only appears with its permission and, for Training and Benefits, its module.
- Medical visits and headcount: "Platform settings", **Access** level to read, **Execute** to change.
- Statements: "Consent statement (DPCS) — Create/Edit/View" (Access to view; Execute to create, edit, duplicate, send and manage contacts), "DPCS — Publish", "DPCS — Archive", "DPCS — Delete" (at the Execute level) and "DPCS — Audit log" (logs tab).
- By default, only the Administrator role holds these permissions (see [Permissions & roles](https://illizeo.com/en/docs-category/platform-en/platform-roles-permissions/)).

## Country cards

Open **Settings › Manage Illizeo › Compliance**. A card appears by itself for each country with an attached contract: current, upcoming or ended less than 5 years ago, drafts excluded. The country is that of the contract's office, failing that the office on the profile, failing that the company's. A contract whose office has no recognised country is counted in no card; the page introduction says so.

Each card gives the number of contracts and its tabs:

- **Medical visits and headcount**: France and Morocco;
- **Training**: the French regulatory framework (see [Agreements, invoices, certificates and regulatory filings](https://illizeo.com/en/centre-aide/training-paperwork-and-regulatory/));
- **Benefits**: the country's benefits compliance controls, with the Benefits module.

The **Data protection (DPCS)** card, common to all countries, leads to the privacy statements.

![The Compliance menu: one card per country where the workspace has contracts, with the number of contracts and the available tabs, and the Data protection (DPCS) card](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-compliance-and-privacy-statements-01.en_.png?resize=800%2C291&quality=80&ssl=1)
Settings › Manage Illizeo › Compliance: the country cards.

## Medical visits and headcount in France

The tab offers three choices. Click an option, then **Save** in the bar that appears.

- **Medical visits**: **Statutory deadlines** (default) calculates the information visit, the periodic visit, enhanced follow-up, the return after maternity leave or long sick leave, and the mid-career visit. **Hiring and entered date** only keeps the information visit, then the "next visit" entered on the profile.
- **Headcount scope**: **Per sub-company** (default) or **Whole workspace**.
- **Headcount calculation**: **Annual average** (default), following the French Social Security Code rules, or **Active employees today**.

![The Medical visits and headcount tab of the France card: Medical visits, Headcount scope and Headcount calculation choices, with their options and descriptions](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-compliance-and-privacy-statements-02.en_.png?resize=800%2C500&quality=80&ssl=1)
Compliance › France › Medical visits and headcount.

The visits setting feeds the "Next medical visit due (France)" card on the profile, the "Medical visits" system report, the "Medical visit due (France)" reminder sent to HR managers 30 days ahead (by email and in notifications), managers' deadline list and the return-to-work visit alerts after long sick leave. With **Hiring and entered date**, periodic, return and mid-career visits, and their alerts, are no longer calculated. The two headcount settings feed the "Headcount thresholds (France)" report and the BDESE entities; they trigger no alert. See the [system reports catalogue](https://illizeo.com/en/centre-aide/people-analytics-system-reports-catalogue/).

## Medical visits and headcount in Morocco

Four choices: **Medical visits** (**Statutory deadlines** or **Hiring and entered date**), **Exposed work** (**No** or **Yes**), **Headcount scope** and **Headcount calculation** (**Usual headcount** or **Active employees today**). The **Headcount and thresholds** block shows, per company, the calculated headcount and the 10, 50 and 100-employee thresholds, with the obligations attached. These obligations are shown for information.

An occupational health service is required if **Exposed work** is **Yes** or if the headcount reaches 50. In that case, visits feed the profile, the report, the 30-day reminder and the deadline list; otherwise, the profile shows them as "For information".

## Writing and publishing a statement

1. Open the **Data protection (DPCS)** card. The **Data Privacy Consent Statements** page shows its indicators and three tabs: **Declarations**, **Consent logs** and **Compliance contacts**.
2. Click **New Statement**, or **Create from the Canadian template** to start from a federal, Quebec, Alberta or British Columbia draft to complete.
3. Fill in the **Title** (required) and the **Content**, in French and English.
4. Choose the **Type**, which cannot be changed later: **Login** (shown at sign-in) or **Registration** (given automatically to employees created with the add-employee wizard, according to their office).
5. Choose the **Legal basis**: **Consent** (the employee accepts, declines or withdraws), **Contract** or **Legal obligation** (they take note of it), **Legitimate interest** (they may object). A **Not yet qualified** statement can be neither published nor sent.
6. Complete **Countries**, **Office** (all by default), **Version** (at creation, for example 1.0), **Effective Date** (today or later), **Redirect URL on decline**, **Show at every login**, the **Presentation panel (left side)**, the **Key points shown to the employee** and **Allow PDF download**, then **Save**.
7. To publish, open the statement with **View** and click **Publish**, or click its status badge.

![The Data Privacy Consent Statements page with the New Statement panel open: title, content, type, legal basis and countries, then the Cancel and Save buttons](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/security-compliance-and-privacy-statements-03.en_.png?resize=800%2C500&quality=80&ssl=1)
Data protection (DPCS) › New Statement.

Each change increases the version. If the title or content changes, the statement is shown again, at their next sign-in, to everyone who had received it, including those who had accepted it. The **Version notes** of the last save make up the "What changed" box.

## Sending a statement to employees

An active Login statement with a legal basis is sent from **View**, **Employee Preview** tab, **Send to employees** block: tick the recipients, then click **Send to**, followed by the number of people. Each receives the "Action required: Data Privacy Consent Statement" email, whose buttons stay valid for 7 days, and a notification; a reminder goes out after 7 working days, two at most, as long as they have not answered. Only recipients see the statement in Illizeo, including with **Show at every login**.

## What the employee sees

At sign-in, a window shows the statement, its key points, its contacts and, if you allowed it, its PDF, in French or English. With the Consent basis, they tick "I have read, understood and accept this privacy policy." then click **I accept**, or **Decline**: the refusal is recorded, the employee is signed out (or sent to the URL provided) and the statement is shown again at the next sign-in. With the other bases, they tick "I have read and taken note of this statement." then click **I acknowledge**.

Consent is withdrawn in **Personal Settings**, **Privacy Consent** tab, **Withdraw my consent** button (see [Employee self-service](https://illizeo.com/en/docs-category/platform-en/platform-self-service/)). The designated data protection officer is told by email.

## Logs, contacts and archiving

- **Consent logs**: one line per sending and per answer, filterable by statement, language, status and dates. The Date column gives the sending date. **Export** produces a CSV file.
- **Compliance contacts**: data protection officer, representatives in the Union, in Switzerland and in the UK, Encarregado (Brazil) and person in charge of the protection of personal information (Québec). **Designate**, **Edit** or **Withdraw designation**: these contacts are published on every statement and in its PDF; a role left empty publishes nothing.
- An active or already accepted statement cannot be deleted: it is archived. Deleting any other statement is permanent and also erases its answers.
- **Duplicate** copies the title and content; the legal basis, presentation and key points must be set again.

## Good to know

- The sending list shows the first 25 active employees of the workspace; the others are not in it.
- A Registration statement is given without an email, and only to employees created with the add-employee wizard who have an office.
- Content is written and shown in French and English only.

### *Similaire*