Hello folks,
Continuing from our previous GDPR post, we bring to you the first cut of GDPR centric enhancements that are released for handling lawful bases for your customers in Zoho CRM. For your understanding we have split the entire process into three sections: - Identifying Data Processing Basis
- Updating the Data Processing Basis in Zoho CRM
- Consent Management in Zoho CRM
1. Identifying Data Processing Basis
The fundamental principle to handle the personal data of your data subjects is to process the data lawfully and fairly, in a transparent manner. As a data controller, based on your business requirements and the purpose of data processing, you can choose and update the Data Processing Basis from the following options :
- Legitimate interest
- Vital interest
- Public interest
- Contract
- Legal Obligation
- Consent
You can choose 'Not applicable' for the records if GDPR does not apply.
2. Updating the Data Processing Basis in Zoho CRM
The first thing you need to do is enable GDPR in your Zoho CRM account. You can do this by going to Setup > Users and Control > Compliance Settings. In the Compliance Settings page, toggle on the button for GDPR Compliance and select the modules that contain information of your data subjects.
The Data Processing Basis for all data subjects in your CRM account will be marked as 'Not Applicable' by default. After identifying the appropriate data processing basis, you can update the same in Zoho CRM in the following ways:
Update individual records manually. Once you enable GDPR in your Zoho CRM account, a new tab called "Data Privacy" will appear in the Record details page where you can manually update the Data Processing Basis.
- Mass update the records from custom list views.
Go to Setup > Users and Control > Compliance Settings > Overview. Under the section Not applicable (since all your records are marked as not applicable), click View and you can mass update the records.
As a data controller, you can define under what Data Processing Basis you want the new records to be marked going forward. A new field called 'Source' in the record details page which will store your data sources such as Web forms, APIs, Integrations, etc. By default all records will fall under the 'Not Applicable' basis. Using this and other attributes of the record, you can write workflow rules to update corresponding Data Processing Basis before the data moves further in CRM.
Please ensure the utmost care while editing the Data Processing Basis of a record. Changing from one lawful basis to another holds its own set of rules and requirements under the GDPR.
3. Consent Management in Zoho CRM
One of the six lawful bases to process the personal data of your customers is 'Consent'. You can opt for Consent, when none of the other five lawful bases are appropriate. Once you have chosen the data processing basis as Consent, you need to get a proper consent from your subjects to process their data lawfully.
Please take legal precautions before getting consent from your subjects. Because, if you have obtained personal data unlawfully, it could be unlawful for you to even send an email requesting consent. You must ensure that requesting consent by email is lawful.
A new section called Consent Details appears under the Data Privacy tab for records that are marked as 'Consent'. The status of these data subjects will be updated as 'Pending' by default.
You can obtain consent from your data subjects in the following ways:
- Update Manually: When you get a consent from your subject through a call or personal email, you can update the consent status manually.
- Update Automatically using Consent Form: You can obtain consent from your subjects using a consent form that you can customize inside Zoho CRM. The fully customizable consent form allows you to get consent for:
- The purpose of data collection and processing
- Preferred communication channel
You can set up the consent form by going to Setup > Users and Control > Compliance Settings > Consent Form.
Once you have customized the consent form, you can add the form's link in an email template and send it individually or mass email it to data subjects whom you require consent.
You can also go to Setup > Users and Control > Compliance settings > Overview. You can view the records that fall under each consent status. Click Show Records under Pending, select the records and click Send Consent Form button.
You can update the consent status for new data subjects either manually or you can set up a workflow rule to send the consent email, which can be triggered based on the source, country and other attributes of a lead or a contact.
You can track the status of the Data Processing Basis and Consent for your Data Subjects from the Overview dashboard in Compliance settings.
We hope that you find these timely enhancements very useful. Feel free to share your feedback or queries by commenting below. And do watch this space for more GDPR centric enhancements in Zoho CRM.
For more reference:
The content presented herein is not to be construed as legal advise.
Please contact your legal advisor to know how GDPR impacts your
organisation and what you need to do to comply with the GDPR.