DiSC, GDPR and data protection
Before HR or procurement approves an assessment, they need to know where the data goes, who can see the reports and what the agreements say. Here is how it works with Everything DiSC® and IPB Partners.
Before anyone takes the assessment
Data Processing Agreement
Who sees the report
Wiley
EU-U.S. Data Privacy Framework, plus the UK and Swiss extensions
Who does what with the data
Under GDPR, every party has a defined role. Assessments run on Wiley’s platform, and the agreements between the three parties set out what each may do.
Your organisation
Data controller
Decides who takes the assessment and who sees the reports.
IPB Partners
Data processor
Sets up assessments and supports you, under the agreement we sign.
Wiley platform
Sub-processor
Hosts the assessment and reports, and takes part in the EU-U.S. Data Privacy Framework.
A checklist for HR and procurement
Use this when you review DiSC with your data protection officer or works council. We can send the supporting documents.
- A Data Processing AgreementWe sign one with every client organisation before assessments start.
- A lawful transfer mechanismWiley and its subsidiary Inscape Publishing take part in the EU-U.S. Data Privacy Framework, with the UK extension and the Swiss-U.S. framework.
- Clear access rulesEach participant receives their own report. Whether a manager or HR sees it is decided by you, before the assessment.
- Deletion on requestAsk us to delete participant data and we arrange it with the platform.
- A data protection contactWiley has a Data Protection Officer for its assessment business. At IPB, write to info@ipbpartners.eu.
- Purpose limitationDiSC is used for development, not for selection or evaluating performance.
Good practice
Agree who sees reports before the assessment
What we will never claim
There is no official “GDPR certificate” for software, so we don’t say DiSC is “GDPR-certified”. We describe the actual setup instead: the roles, the agreements and the transfer framework. If your data protection officer asks for something more specific, ask us and we will find the answer.
About DiSC and data protection
Is DiSC GDPR compliant?
Assessments run on Wiley’s platform. Wiley takes part in the EU-U.S. Data Privacy Framework, and IPB Partners signs a Data Processing Agreement with every client organisation. There is no general GDPR certificate, so we describe the setup rather than claim one.
Who can see a DiSC report?
Each participant receives their own report. Whether a manager or HR also sees it is up to your organisation, and we recommend agreeing on it and telling participants before the assessment.
Who is the data controller?
Your organisation is the data controller, IPB Partners is the processor, and Wiley is the sub-processor that hosts the assessment.
Can participants ask for their data to be deleted?
Yes. Send the request to us and we arrange the deletion with the platform.
Do you have a Data Processing Agreement we can review?
Yes. Ask us and we send it before any assessments start.
Ask for our Data Processing Agreement
Tell us what your data protection officer or procurement team needs. We send the agreement and answer the questions before anyone takes an assessment.