Compliance should not be remembered on inspection day.
Data protection and occupational health and safety are separate modules here. Consent, the processing inventory, the risk matrix and accident reporting each have their own screen.
Going back is hard once a fine is issued.
- Which consent was taken for which data is not tracked and the notice text is out of date.
- There are three working days to report an accident, and a missed window means a penalty.
- The risk assessment was done once, filed away, and never renewed for the hazard class.
- Nobody knows whose mandatory safety training is missing.
Two areas, two separate screens.
Consent management
Seven separate consent texts are defined, and which employee gave which and when stays on record. Withdrawing consent closes the related processing.
Processing inventory
Which data, for what purpose and for how long is listed. The breakdown needed for the registry filing comes from here.
Data subject requests
A request is logged and the thirty day response window is tracked. The responsible person is warned before it expires.
Retention and erasure
Each data type is bound to a retention period. Expired records fall into the erasure list; digital erasure is automatic, paper erasure needs human approval.
Accident reporting window
The three working day window starts the moment an accident record is opened, and warnings become more frequent as it closes.
Five by five risk matrix
Hazards are scored on likelihood and severity, and controls and owners are assigned by the resulting level. The reassessment date is tracked.
OHS committee
Members, the meeting calendar and decisions are recorded. A committee is mandatory in workplaces with fifty or more employees.
Training and medical checks
Mandatory safety training and periodic medical examinations are planned by hazard class, and anyone overdue appears on a list.
Consent matrix and request tracking.
Which consent came from which employee, and how long pending requests have been open, on one screen.
Two laws, direct liability
Both the data protection law and the occupational safety law impose administrative fines directly. The deadlines and thresholds are written into the program.
- DPL art.5Personal data may be processed only on one of the grounds listed in the law; otherwise explicit consent is required.
- DPL art.13The controller concludes a request within thirty days at the latest.
- DPL art.16The obligation to register with the controllers registry arises according to defined criteria.
- OHS art.10The employer carries out or commissions a risk assessment and renews it according to hazard class.
- OHS art.15The employer ensures employees undergo health surveillance.
- SSL art.13A work accident is reported to the authority within three working days of the incident.
Questions about Compliance and OHS.
Does Folkena make the registry filing?
The processing inventory and the required breakdown are prepared in the program; entering them into the official portal remains with you. Which data is processed for what purpose is read straight from the list.
What happens if an employee withdraws consent?
The withdrawal date is recorded and the processing bound to that consent stops. Processing based on a legal obligation is unaffected.
Does the system track the accident reporting window?
The three working day window starts when the accident record is opened and the responsible person is warned. The filing itself is made on the authority's portal.
How often should the risk assessment be renewed?
It depends on the hazard class. The program tracks the renewal date and warns as it approaches; an accident or a change also triggers a renewal.
Can the system destroy paper documents?
No. Digital retention and erasure run automatically, but paper destruction depends on human approval. We say so openly.
Let us review your compliance position together.
In the demo we go through your consent texts, your risk matrix and the headings still missing.