The General Data Protection Regulation (GDPR) is an EU-wide privacy and data protection law that regulates how the personal data of EU residents is protected and gives individuals greater control over their personal data.
Although GDPR is an EU regulation, it is relevant to companies operating globally. Zoho considers customer data important regardless of where customers are located and has implemented GDPR controls as a baseline standard across its operations worldwide.
Under GDPR, personal data refers to information relating to an identified or identifiable individual.
Personal data is not limited to information such as a person's name or email address. It can include other information that, either by itself or when combined with other information, can identify an individual.
Examples provided by Zoho include:
When using Zoho Notebook, you should therefore consider whether the information you store or manage contains personal data and handle it in accordance with the privacy and data protection requirements applicable to you or your organization.
Zoho has taken measures across its organization and products to address GDPR requirements.
Zoho has assessed its products individually against GDPR requirements and implemented features intended to provide customers with greater control over their data and assist them with their GDPR compliance responsibilities.
The controls and provisions available can vary depending on the characteristics and domain of each Zoho product.
Zoho's application teams follow the concept of privacy by design and work to provide customers with greater control over the data stored in Zoho systems.
Zoho continues to enhance these provisions over time, and the specific capabilities may vary between products.
Zoho maintains an Information Asset Register (IAR) that documents the roles Zoho assumes, including its roles as a data controller and data processor.
The register covers categories of personal data processed by Zoho, the departments that have access to the data, and the purposes for which the data is accessed.
Zoho has assessed its sub-processors, including third-party service providers and partners, and has streamlined its contractual processes with them to address security and privacy requirements.
Zoho has appointed internal privacy champions across its teams and has also appointed a Data Protection Officer (DPO) as part of its privacy and data protection practices.
Zoho has conducted Data Protection Impact Assessments (DPIAs) and implemented appropriate controls for data processing and management based on the results.
Zoho has also conducted internal audits covering its products, processes, operations, and management. Findings from these audits are communicated to the relevant teams so that identified issues can be addressed.
Based on its DPIAs and internal audits, Zoho states that it has improved its data security methods and processes.
These measures include encrypting data at rest based on the sensitivity of the data and the likelihood of associated risks. Zoho has also developed in-house tools to support data governance and discovery.
Zoho states that it has cleaned up its databases to retain the latest and most accurate information.
This process includes removing terminated and dormant accounts in accordance with Zoho's Terms of Service.
Zoho has amended its Data Processing Addendum (DPA), based on Model Contractual Clauses, to comply with GDPR data-processing requirements.
If you are an organization administrator and would like to sign a DPA with Zoho, you can contact legal@zohocorp.com and mention the data center in which your Zoho account was created.
When required, breach notifications are handled according to Zoho's internal Privacy Incident Response policy.
Zoho states that customers will be notified of a breach within 72 hours after Zoho becomes aware of it.
For general incidents, notifications may be provided through Zoho's blogs, forums, and social media. For incidents affecting a specific user or organization, Zoho states that the concerned party will be notified through the primary email address associated with the account.
GDPR compliance is a shared responsibility. While Zoho has implemented organizational and technical measures to address GDPR requirements, customers should evaluate their own obligations when storing or processing personal data using Zoho products such as Notebook.
The requirements that apply to you can depend on factors such as the type of personal data you process, how you use it, and your organization's responsibilities under applicable data protection laws.
Zoho recommends seeking legal advice regarding the steps required for your organization to comply with GDPR.
Zoho has implemented measures across its organization and products to address GDPR requirements. These include product assessments, privacy-by-design practices, DPIAs, internal audits, sub-processor assessments, security improvements, and a GDPR-compliant Data Processing Addendum.
No, Zoho explains that GDPR is relevant to globally operating companies, not only businesses located in the EU. Zoho has implemented GDPR controls as a baseline standard for its operations worldwide.
Yes, Organization administrators can request a Data Processing Addendum by contacting legal@zohocorp.com and mentioning the data center in which their Zoho account was created.
When required, Zoho handles breach notifications according to its internal Privacy Incident Response policy and states that customers will be notified within 72 hours after Zoho becomes aware of a breach. Depending on whether the incident is general or specific to a user or organization, notifications may be provided through Zoho's public channels or directly through the primary email address associated with the account.
For the latest information about Zoho's approach to GDPR, refer to Zoho's official GDPR page. Questions or concerns regarding GDPR and privacy can also be directed to privacy@zohocorp.com.
The information provided here is intended to explain Zoho's approach to GDPR and should not be considered legal advice. Zoho recommends seeking appropriate legal advice to determine the steps you or your organization need to take to comply with GDPR.