Hello folks,
GDPR has been the talk of the hour and we would like to ensure that this GDPR fever does not come in the way of your business and selling. There are several GDPR centric enhancements in Zoho CRM that will be released in a phased manner to all our users in the following weeks.
Designed to help you meet the privacy standards set by the European Union, these enhancements will provide a streamlined mechanism for you to collect, process and store your customer data in conformation with the GDPR.
So what is GDPR and how will it affect your business?
GDPR or General Data Protection Regulation is a landmark policy aimed at empowering citizens of the European Union regarding their personal data. With increasingly complex flow of information across the world, GDPR aims to give EU citizens more direct control on how their personal information is being processed in addition to improved data privacy.
GDPR not only applies to companies in the EU region but to any organization that collects or processes the data of EU citizens. If you are one of those organizations who collect or process data of EU citizens, the following enhancements in Zoho CRM are for you.
GDPR centric enhancements in Zoho CRM:
We have split GDPR requirements into Data collection, Data processing and Data Subject Rights. In the sections below, we state the GDPR requirements along with the respective enhancements in Zoho CRM that meet them.
Note: The Organization collecting customer data is referred to as "Data Controller"/"Controller", your customers are referred to as "Data Subjects" and Zoho CRM will be the "Data Processor".
1. Data Collection
GDPR demands that personal information collected from Data Subjects should be limited to what the Data Controller needs in order to deliver its services, and a legitimate need in case of requesting additional information must be demonstrated. It is also mandatory that you state the purpose and get clear consent when collecting personal information.
Consent must be explicit, where Data Subjects take an affirmative action (clicking on the checkbox, so no pre-ticked check boxes). Controllers are also expected to be transparent about the duration for which the data will be processed.
Consent Form: Consent is one of the cornerstones of GDPR, as the execution of any processing activity now depends on the consent provided by the Data Subject. So in-order to demonstrate compliance, it is mandatory that a Data Controller identifies Data Subjects who require consent and those who do not require it under criteria such as Legitimate interest, Vital interest, Public interest, Contract, Freely given consent and other basis. After identifying this, the Data Controller should get consent from Data Subjects who require consent and be able to provide proof of consent if needed.
The fully customizable consent form in Zoho CRM allows Controllers to get explicit consent in regards to:
- The purpose of data collection.
- Preferred communication channel.
- Duration for which the data can be processed or consent duration.
- Sharing information with connected services.
Consent from Data Subjects, in written declaration or orally obtained consent (through email or telephone) can be attached to the form using the Attachment option.
Once the Data Subject has submitted their consent, it's stored under the Data Subject's record details page for the purpose of official record and for the Controller to know their actionable items from the data provided. For example, if a Data Subject has explicitly stated that their preferred channel of communication is email, then they are not to be contacted through any other means.
Double Opt-in Mechanism: This is one more compliance feature which you can use when setting up webforms. Anytime a Data Subject submits their information through a webform, a double Opt-in email is sent to them to confirm their registration/sign-up.
Data source tracking: Data Subjects' information can be pushed into Zoho CRM from multiple sources which include direct sources like web-forms, and indirect sources such as imports, manual entries, APIs, and third-party integrations.
The source and additional details if any (like the URL, IP address and geo-location) will be documented in the record details page. The screenshot below shows a new section called Data Privacy, under which Data source and the respective consent details are populated.
2. Data Processing
Information provided by a Data Subject can only be processed in a lawful basis. There is significant emphasis on the fact that all processing activities must be carried out securely to ensure that personal information is not exposed.
Marking Personal fields - fields containing PII (Personally Identifiable Information): Data Controllers can mark fields containing personal information as Personal fields and set a sensitivity level (High and Low). Based on the privacy preference, the Controller can choose to restrict these fields from certain processing activities such as exports, APIs and connected services.
There are two cases when data is being processed via connected services:
Case 1 - Data Subject has not consented to their data being shared with any connected services. In such a case no information of theirs will be shared with any of the integrated services of Zoho CRM.
Case 2 - Data Subject has consented to their data being shared with connected services but there is an organizational restriction in sharing PIIs. In such a case the fields with PIIs will be not be processed in APIs and connected services.
With regards to Zoho connected services (Zoho products like Books, Desk, Campaigns, etc.) consent provided in one product will apply across all integrated Zoho products.
Encryption At Rest (EAR): Enterprise users have the option of Encryption At Rest for Personal fields.
Audit log and timeline for customer records: The Data Controller can monitor the processing activities done on a Data Subject's personal information.
Consent Management: The consent management system helps the Controller to keep track on the consent status of their Data Subjects. The system helps users identify Data Subjects who are yet to provide consent and immediately allows for sending an email with the consent form link. Consent can be obtained through webforms, consent form, portals and offline consent (Email or phone call).
The screenshot below is a consent dashboard showing the various consent statuses. Clicking on them will get you a list of all Data Subjects with their particular consent status.
3. Data Subject Rights
GDPR comes with a slew of rights which EU Data Subjects can exercise at any time which must be addressed in a month's time. The data request management in Zoho CRM lets the Controller keep track of all data requests to address them in a timely manner. The data requests raised is also maintained under each Data Subject's record details page so that the Controller is informed on any pending requests.
The Data Subject can exercise their rights through the consent form, portal, or offline through email and phone calls.
Zoho CRM helps Controllers address these data requests through the following options:
Access (Right to View): Using Zoho CRM's email feature, a template consisting of all customer information fields can be quickly created, which can then be sent to your customer upon request.
Rectify (Right to Rectify): Customer specific information can be exported and sent to the customer for rectification and the same can be updated.
Export (Right to Portability): Customer specific information can be exported, attached to an email and sent to a customer in a machine readable format, all without being downloaded on to your device.
Stop Process (Right to Stop Processing): Once a customer exercises this right, the corresponding record will be locked preventing further processing.
Erase (Right to be forgotten): Once exercised, the customer's record will be locked for the duration of the retention period defined in the Data controller's terms of service, after which the controller has the option to delete the customer information. Once deleted, the record will be moved to a blocklist and the re-entry of the same data will be prevented.
All of these enhancements will be made available for you in Zoho CRM in a phased manner. So watch this space for more updates!