Guidelines 01/2019 on Codes of Conduct and Monitoring Bodies under the GDPR

Section 5.8  Consultation

28. A draft code must contain information as to the extent of consultation carried out. Recital 99 ofthe GDPR indicates when drafting a code (or amending/extending) a consultation should take place with the relevant stakeholders including data subjects, where feasible. As such, code owners should confirm and demonstrate that an appropriate level of consultation has taken place with the relevant stakeholders when submitting the code for approval. Where relevant, this will include information about other codes of conduct that potential code members may be subject to and reflect how their code complements other codes. This should also outline the level and nature of consultation which took place with their members, other stakeholders and data subjects or associations/bodies representing them. In practice, a consultation is highly recommended with the members forming part of the organisation or body acting as the code owner and also taking into account the processing activity with the clients of such members. Where no consultation has been carried out with regard to relevant and specific stakeholders due to the lack of feasibility, it will be a matter for the code owner to explain this position.