It's been a little over a year since the GDPR (General Data Protection Regulation) was enforced across the European Union.
It aimed to give more control to the residents of the EU over their personal data and hold companies accountable over how their customers' data is being used. The numbers don't lie, it has been effective in increasing awareness amongst customers as well as making companies more conscious about respecting their customers' privacy.
Over the duration of the year the regulation has been in effect, there are a couple of important takeaways.
- The breach notification clause has been very effective. The notifications have doubled from around 18,000-20,000 to over 36,000 in the United Kingdom alone and over 65,000 breaches were reported across the EU in the last nine months.
- The regulatory bodies ability to fine hasn't been very effective. The total fines amount to around €55 million but most of it stems from the €50 million fine that was levied on Google.
We designed multiple features to help our customers stay compliant with the European regulation. These were designed to make your data collection and processing in line with the regulation as well help you address the various rights that a EU resident has under the GDPR.
Data Collection
When your prospects share their personal information with you, it's important to document the source through which you obtain the information as well as ensure that the information shared is genuine.
Data Source Tracking
With multiple sources for customer data (webforms, imports, manual creation, APIs, or third-party integrations), keep track of it all under the customer's record details. In the case of webforms, additional details like form name and IP address will be captured.
Double Opt-in
Enable the double opt-in mechanism for webforms so customers who submit their information will have to confirm their submission before their data is pushed into Zoho CRM. Double opt-in helps you get quality leads, and lets you dedicate time and resources on people who want to hear from you.
Data Processing
Once you have their data inside Zoho CRM, make sure all of your activities on a prospect's data is completely in line with the regulation. Stay accountable by tracking and documenting all actions taken on a prospect's data.
Data Processing Basis
Identify, categorize, and mark customers based on one of the six lawful bases for data processing: Legitimate Interest, Consent, Performance of a Contract, Legal Obligations, Vital Interest, or Public Interests.
Consent Form
Based on the type of customer and the personal information being processed, you must ask for their consent. Easily obtain consent through a customizable form, which you can email to your customers
Marking Personal Fields
Mark fields that contain personal information and decide if the information is sensitive or not. Based on the preferences under the Compliance Settings, you can restrict information in these fields from being processed during exports, APIs, and connected services.
Encryption At Rest (EAR)
Zoho CRM uses one of the strongest and most robust ciphers - AES (Advanced Encryption Standard) - to encrypt your sensitive data. In addition to protecting data during transit, Zoho CRM secures data stored in servers using AES-256 encryption standard to ensure anonymity of customer information, in case of a leak or a breach.
Audit Log
Monitor your team's activities with audit logs, so you can track who did what and when. For example, all actions done by your users with respect to record deletion and modifications will be audited.
Data Subject Rights
Every resident in the European Union has a set of rights when it comes to their personal data under the GDPR. They are free to exercise these rights at any time they wish and the organizations handling their data are required to address these requests in a set time. We've made it effortless for organizations to allow their customers to raise, track and quickly address these requests inside Zoho CRM.
Access (Right to Access)
Let your customers access their data through the Customer Portal. Or let them know they can access it by sending them an email, which you can create by inserting the required merge fields in a template.
Rectify (Right to Rectify)
Export customer information with ease, send to them for rectification, and update it in CRM. If customers have access to the Customer Portal, they can view their information there and update it themselves, when necessary.
Export (Right to Data Portability)
Export customer information as a CSV file, which is directly attached to an email, and then sent to the customer. This export ensures that no information is stored on external devices.
Stop Process (Right to Restrict Processing)
When this right is exercised, the customer's record gets locked automatically to prevent any further processing of the information.
Erase (Right to be Forgotten)
You can easily delete a customer's information from Zoho CRM when a "Right to be Forgotten" is requested. Once deleted, the record will be moved to a blocklist to warn users when the same record is being pushed into the system again.
We'd love to hear your from you about how you've used these features over the past year, how effective they've been and the enhancements you'd like to see in them. Share your thoughts in the comments!