This article covers what EU's GDPR is about, as well as the features and capabilities of Zoho Creator that can help you build GDPR compliant custom apps.
Note: The content presented in this page is not to be construed as legal advice. Please contact your legal counsel to learn how GDPR impacts your organization and what you need to do to comply with GDPR.
What is GDPR?
The European Union (EU)'s General Data Protection Regulation (GDPR) is a new regulation that comes into effect on the 25th of May, 2018. It aims to harmonize the data privacy laws across the EU, and (in particular) protect the rights of residents of the EU with regard to the processing of their personal data. It recognizes the data privacy rights of EU residents, and lays down rules relating to the processing of their personal data.
At its core, the GDPR aims to give EU residents full control over their personal data.
What is personal data?
In the context of GDPR, personal data is any data that can directly or indirectly help identify a natural person. This includes, but is not limited to: name, address, phone number, email address, IP address, traveling habits, and photos.
When and where does GDPR come into play?
GDPR applies for any activity that collects or processes the personal data of EU residents. It does not matter if the said activity takes place inside the EU or not. GDPR has a global reach.
Why be GDPR compliant?
EU's GDPR comes into effect on the 25th of May, 2018. It is legally binding. The concerned Supervisory Authority (as defined by GDPR), may fine the non-compliant person or organization up to 20 million Euros or 4% of their annual worldwide turnover from the preceding year, whichever is higher. Levying a fine is in place for two reasons:
- A deterrent, so that Data Controllers and Data Processors act responsibly, and adhere to GDPR's guidelines
- A compensation for the persons who have suffered material or non-material damage as a result of an infringement of GDPR
Key roles that GDPR identifies
- Data Subject: A resident of the EU from whom, or about whom, data is collected and/or processed
- Data Controller: The person or organization that defines the purpose and means of collecting and processing data
- Data Processor: The person or organization that processes the collected data on behalf of the Data Controller
In this context, the following two scenarios come into play:
Zoho Creator's GDPR readiness
Addressing rights of Data Subjects
The following are the Data Subject Rights that GDPR identifies, and how Zoho Creator helps you address them in your apps:
Implement some best practices
You can leverage the features and capabilities of Zoho Creator to implement the following in your apps:
Denote fields that contain personal data: The Contains personal data field property helps you define if the concerned field is one in which your users will be entering some personal data.
Encrypt data: Upon enabling this field property, the data your users enter in that field will be stored in an encrypted format. Lean more Capture location: Forms in your Zoho Creator app can, with your user's consent, capture the geographical location from where they submit their entries. Learn more Capture IP address: Forms in your Zoho Creator app can capture the public IP address using which your users submit their entries. Learn more
Getting consent: Data Subjects have a right to be informed on why your app, or a form in your app, is collecting data, and how it will be processed. Also, as a Data Controller, you may need to show if your users gave their consent for this. Here's how you do it:
If consent is required along with the data a form is already collecting, then add an add notes field (which will display information on why you need to collect certain data points, and how you will process them), and a decision box field (marked mandatory) that lets your users give their consent If consent is required on the app level, add a new form and use the combination of add notes and decision box fields as given above To let your users know what they consented to, you can send them an email saying they've given their consent (and copy-paste the add notes field's content in the email's message)
Provision a double opt-in mechanism for your form or app: Double opt-in is a widely used mechanism to get the intended audience to confirm before proceeding. You can put in place a double opt-in before you let your users access any form in your app. Here's how you do it: