GDPR Compliance User Guide
SuiteCRM GDPR user guide:
Navigate to Admin -> GDPR : Data Privacy Configuration to make the initial setup.
There are 4 setting which needs to be done
- Data Privacy Manager (DPM)
- Personally Identifiable Information (PII)
- Download Data Privacy Request Form
- Create Scheduler
Data Privacy Manager (DPM):
An admin user can create a Data Privacy Role and assign a user to that role, then select a Data Privacy Manager from the configuration screen. The person who decides why and how personal data will be processed. If you’re an owner or employee in your organization who handles data, this is you.
Create a role from Admin -> Role Management for the Data Privacy manager. Give the role proper access to the modules and actions as per your needs, Do give that role the access to the module "GDPR Data Privacy" and "Data Privacy Request". Assign your Data privacy user to this role. And choose the Role as Data Privacy Manager.
DPM user will be responsible for processing all the request of Data privacy weather it is received via the Request form or Call or Email.
Personally Identifiable Information (PII):
Personal data is any information that relates to an individual who can be directly or indirectly identified. Names, email addresses, gender, location information, etc. are personal data. Each business has different means of data as personal. So we have given the option to select fields that will be now known as PII data.
Choose the fields, which will be used to audit and anonymize for the Data privacy requests like Request for data access, Request for portability, Request for erase data.
Download Data Privacy Request Form:
Download the GDPR-Ready form for the Data privacy requests, Host it on your server/website from where your customer would ask for the Data privacy requests. The Request coming from the forms creates a Data Privacy Request record in CRM and relates the request to a matching Contact/Leads/Prospects based on email.
This module will serve as a request received from the Data Privacy Request Webform. The information provides over web form will be processed solely for the purpose of verifying the identity and residency, identifying the information the person is requesting. The personal information will be accessed by the Data Privacy Manager only. Your proof of ID and residency will be deleted once your request has been answered.
As per the GDPR regulation, the requests need to be preserved, with the proof of identity as the requester could be making a request on behalf of the person.
Upon receiving the request, the system will automatically create a Data Privacy(DP) module record. And based on the email address provided will relate the matching contact/lead/prospect to the DP record.
Note: By default, the form is created as per the general need. But If you wish to edit any information into the form. You can edit into the code at your SuiteCRM file system. The file path is modules/ut_DP_Request/dataprivacy_requestform.html
Create Scheduler
Create a scheduler called "Update consent status if response not received". Set a frequency to execute once a day. This scheduler will check for the consent that is sent but yet not received after the waiting period(30 days) is over. if any records found that are in the waiting stage and 30 days passed. It will automatically update status to "Not Responded"
CONSENT MANAGEMENT
There are many ways that you can get consent from the data subjects. One of the simplest ways of getting consent is through a data capture form, on which customer can simply select the consent options like, Marketing Email, Call, SMS, Postal Marketing or Business processing.
- Consent form - We have created an action in Listview from where He/She can send an email with a link of the Consent Form. so, customer, themselves can select the opt-in option as per their choice. and the choice of the customer will be automatically captured once the form is submitted. You can send a mass email to a list of records.
- Create Data Privacy record manually - When you get consent during a call or in person, you can create the data privacy record and relate the data subject(Contact/Lead/Prospect) to it, choose the Request type and set the consent. Upon completing the DP request, the data subject(Contact/Lead/Prospect) will be updated automatically with the consent chosen. It will also capture the date Consent Last updated
- Update Data subject manually - When you get consent during a call or in person, you can update the data subject(Contact/Lead/Prospect) record manually. By default, the user cannot have this option in edit view. But if your organization wants to update it manually. You just need to put those fields in Editview from studio.
Stages in Consent Management
- Pending - When the request for consent is not sent to the data subjects.
- Waiting - When the consent form has been sent and you are waiting for a reply. This options will be automatically updated to the Not Responded,If the waiting period(30 days) is over and we haven't received the decision.
- Obtained - When you have received consent from the data subject.
- Not Responded - When you have not received consent from the data subject within the waiting period defined in the Consent Settings.
Consent fields available for the Data Subject (Contact / Lead / Prospect)
- Consent Obtained: Dropdown that shows the consent received (Email Marketing/Call/SMS/Postal Marketing/Business Processing)
- Consent Last updated: Date of last consent received
- Consent Status: Dropdown that shows the current status (Pending/Waiting/Obtained/Not responded)
- GDPR Request: A Dropdown field (In progress/Complete). This field can be viewed as an color indicator to know if the person is having any open DP request
- Restrict Processing?: A Yes/No field. If is set to Yes, the person should not be contacted or processed. The person have asked to Restrict his data to be processed further.
It is the Organisations responsibility to implement the right approach in contacting and processing the customer's data. The above fields can be used in different ways to be a step closer to it. Those fields can be used to filter out the person when generating a target list for an email campaign or for calling, text messaging, etc.
Data Privacy Requests (DPR):
Data Privacy Request module will serve as a request received from the Data Privacy Request Webform. The information provides over web form will be processed solely for the purpose of verifying the identity and residency, identifying the information the person is requesting. The personal information will be accessed by the Data Privacy Manager only. Your proof of ID and residency will be deleted once your request has been answered.
As per the GDPR regulation, the requests need to be preserved, with the proof of identity as the requester could be making a request on behalf of the person.
Upon receiving the request, the system will automatically create a Data Privacy(DP) module record. And based on the email address provided will relate the matching contact/lead/prospect to the DP record.
The DPM will take the necessary actions on the DP record and once the DP request gets closed, the Uploaded Proof of Identification and proof of address will be removed from the system.
Data Privacy (DP):
Data Privacy module is the main module where DPM can manage or perform certain requests by customers related to data privacy. Based on the request made several actions have been made available to DPM to help him resolve the request.
The module holds important fields from GDPR request number, Type of request, Status, Related (Contact/Lead/Prospect), Date receive, Due Date, Date Closed, etc.
There are differnt Types of Data Privacy request
- Request for Data Access
- Rectify Information
- Request to Erase Data
- Request for Portability
- Restrict Data Processing
- Consent to Process
- Withdraw Consent
For each DP request, when viewed, have several actions for the DPM to perform
- Complete: This marks the request completed, and assumes the DPM would have taken the necessary actions to mark the request as Completed. This action is irreversible. And will log the Date Closed field to the current date.
- Reject: There are several reasons where the request made from the customer are improper or lacks authenticity. The DPM can perform the Reject action by marking the Reason for rejection.
Request for Data Access
Once customer request for the Data access either by feeling up the GDPR Request form or by email or phone. DPM will review the request and He/She can export the data that are in PII category into the WORD or PDF format as needed. Once the request is satisfied, DPM will close the Data Privacy Request by simply pressing the complete button on the detail view of the Data Privacy record. System by default set the Closed date as current date.
Rectify Information
The DPM upon this request will verify for the change of the information asked by the client. The DPM manually makes the appropriate changes to the personal information as asked by the client and marks its as completed.
Request to Erase Data
Once DPM gets the request for Erasure. DPM will review the request and verify with Proof of Identity and Proof of Address that are provided by the customer in GDPR Data Request form. DPM will have button Erase Info on the detail view of the Data Privacy record, This gives an option to the DPM to Anonymize or Delete the records from the system. Performed action will search for Firstname, Lastname or email address of the related entities and lists outs the record from the entire system which shares the same information. The DPM can choose the persons whom he wants to anonymize or delete the data.
Once they complete the erasure process, the personal fields will have their values replaced with ****. Personal information from the audit logs will also be removed.
Anonymize: Will make the selected record(s) field(s) value as unindentifiable(Anonymize) based on the configuration made in Personally Identifiable Information (PII). The fields will be replaced with value ****
Archive: Will mark the selected record(s) as deleted (soft delete). The record remains in the database but will not be visible in application.
Delete: Will delete (hard delete) the selected record(s) from the database such that it is not retrievable again.
Request for Portability
The DP record for this type of request will have an action available for the DPM to fetch the Personal Identifiable Information (PII) of the person and have it in a downloadable format like PDF or Word file. Then after DPM can send it those file in any form via email or printed copy as per company policy or as needed. The usage of this action will be similar to "Request for Data Access"
Restrict Data Processing
Once customer request for the restriction, DPM will review the request and based on it. DPM can complete the request or reject. If DPM clicks on the complete button, It will update related records with field "Restrict Processing?" checkbox for supported module. So in future, any users can filter the records based on the flag to create Target List for Marketing Campaign or any means of follow-up to that particular customer.
Consent to Process
We have created an action in Listview from where user can send an email with a link of the Consent Form. so, customer, themselves can select the opt-in option as per their choice. and the choice of the customer will be automatically captured once the form is submitted. besides that, it will update the consent data like Date of last consent updated, Consent status like Pending, Waiting, Obtained and Not responded . As a solution, we have also introduced the mechanism where if we haven't received the Consent in last 30 days after sending it, System will automatically find the records that are waiting since last 30 days and update it to Not responded.
Withdraw Consent
Similar way customer can withdraw the consent anytime by filling up the Request form with an option that he/she would like to opted-out for that status, like Marketing Email, Call, SMS, Postal Marketing or Business processing. As DPM receives the request, they can process to either Complete or Reject. If DPM goes with Complete. It will automatically update the related records as per the original request for withdraw consent option that selected by the customer.
