View Personal Fields under Data Privacy Section

The Data Privacy section for a record also contains details about the personal fields. It lists the number of fields that are marked as Sensitive and the ones as Normal.

To view personal fields

1. Click open the data subjects record in your CRM account.
   The record could be in the Leads, Contacts, Vendors or any other custom module for which GDPR Compliance is enabled.
2. Click Data Privacy.
   Under the Personal Data section, the number of Sensitive and Normal fields details are available.
3. Hover your cursor on the number to view the fields with the values for the selected record.
   

Personal Data Handling

You may have marked some personal data as normal and others as sensitive. Zoho CRM gives you the option to decide which type of personal data you want to restrict from being accessed through APIs or other applications that are integrated with Zoho CRM. The following options are available to protect data subject's personal data being shared across other sub processors.

Restrict Data Transfer to Zoho Apps and Third-Party Apps

To run your business, you may use multiple tools from email service providers, customer relationship management systems to collaboration platforms. Many a times, these applications are tightly integrated and your customers' data is shared among these platforms. It is essential that these third-party processors you use are also directly and legally obligated to be in compliance with GDPR. To protect your customers' data, Zoho CRM has the option to restrict sharing of personal data to Zoho apps and third party applications integrated with your CRM account.

The following table will give you the details of the various integrations and the implications when personal data is restricted. There are certain fields that are mandatory for an integration. For example, for the Zoho Project integration, Email is a mandatory field. If you mark email as a personal field, the data will not be sent from CRM to Projects. You can find more such details in the tables below.

*Please note that First and Last Name cannot be marked as personal fields.

Integrations with Zoho Apps

Integrations with Third-party Apps

To restrict data transfer to Zoho applications

1. Click Setup > Security Control > Compliance Settings > Preferences.
   
2. In the Personal Data Handling section, toggle on Restrict Data Transfer to Zoho Apps to enable it.
   
3. Review the implications and click Restrict Personal Data to proceed.
   
4. Select one of the following from the Data Type drop-down:
   • Only Sensitive data - Values from all the sensitive personal fields will not be transferred through third-party integrations.
     
   • Normal and Sensitive data - Values from both the normal and sensitive personal fields will not be transferred through third-party integrations.
     
5. Click Save.
   

To restrict data transfer to third-party applications

1. Click Setup > Security Control > Compliance Settings > Preferences.
   
2. In the Personal Data Handling section, toggle on Restrict Data Transfer to Third-party Apps to enable it.
   
3. Select one of the following from the Data Type drop-down:
   • Only Sensitive data - Values from all the sensitive personal fields will not be transferred through third-party integrations.
     
   • Normal and Sensitive data - Values from both the normal and sensitive personal fields will not be transferred through third-party integrations.
     
4. Select the integrations from the Apps drop-down list for which you want to restrict data transfer.
   
5. Click Save.
   

Restrict Data access through API

Using API, other applications can connect to your CRM account and data can be transferred. When data is transferred via API, you need to ensure that the personal data of your customers are not shared without a purpose. For data security, Zoho CRM has the option to restrict the sharing of personal data through API.

When data is restricted, you can not share the data outside the system via APIs.

To restrict data access through API

1. Click Setup > Security Control > Compliance Settings > Preferences.
   
2. In the Personal Data Handling section, toggle on Restrict Data access through API to enable it.
   
3. Select one of the following from the Data Type drop-down:
   • Only Sensitive data - Values from all the sensitive personal fields will not be accessed through APIs.
     
   • Normal and Sensitive data - Values from both the normal and sensitive personal fields will not be accessed through APIs.
     
4. Click Save.
   

Restrict Data in Export

There may be instances when you have the requirement to export data and for security reasons, you would not want the personal data to be exported. For such cases, you can restrict the personal data (normal and sensitive) from being exported. This includes exporting reports and updating data using Zoho Sheet view. Please note the following when you restrict personal data for the export action.

• In the Zoho Sheet view, personal fields will not be available.
  
• When you export a report, all the fields' data will be exported except the ones in personal fields. The same is the case for scheduled reports.
  
• Matrix reports require fields for rows and columns. If any one of the field is a personal field (which cannot be exported) then the matrix report will not give accurate data. Hence, matrix reports with personal fields can be created but will not be exported. Same is the case for matrix scheduled reports.
  
• When will a report not get exported:
  • If a personal field is used for the Columns to Total option.
    
  • In a Summary report, if personal fields are used in grouping columns.
    
  • In a Matrix report, if personal fields are used to Subtotal By column or row.
    

To restrict data in export

1. Click Setup > Security control > Compliance Settings > Preferences.
   
2. In the Personal Data Handling section, toggle on Restrict Data in Export to enable it.
   
3. Review the implications and click Restrict Personal data to proceed.
   
4. Select one of the following from the Data Type drop-down:
   • Only Sensitive data - Values from all the sensitive personal fields cannot be accessed in the exported data.
     
   • Normal and Sensitive data - Values from both the normal sand sensitive personal fields cannot be accessed in the exported data.
     
5. Click Save.