Get Started
Get Started
Get Started
Get Started
Get Started

General Data Protection Regulation (GDPR)

Salesforce solutions for GDPR implementation

Download GDPR Matrix >

Key Considerations

If you have EU resident’s data in your Org, these General Data Protection Regulation articles may apply.

A snapshot of Cloud Compliance's Enterprise Data Inventory showing a list of DI Systems including Salesforce, NetSuite, and others

Discover Personal Data

Article 6, 30, 32, 35

Data Inventory, Record of Processing Activity (ROPA), Data Privacy Impact Assessment (DPIA)

Track and inventorize Personal Data across your enterprise. Document data collection and movement both for internal and to 3rd parties.

 

Assess your organization’s posture for GDPR compliance, identify gaps, and mitigate risks. Use our pre-built templates or create custom assessments for your unique requirements.

Check out Personal Data Discovery>

Automate Privacy Rights

Article 12, 15, 16, 17, 18, 19, 20, 21

Right of Access, Rectification, Erasure (Right To Be Forgotten), Restriction, Portability, Right to Object, Self-serve Privacy center

Enable branded self-service request portal for common Subject Access Requests (SAR) for seamless customer care.


Simplify the logging of SARs, verification process, generation, and delivery. Support multiple regulatory requirements such as offering different Portability documents for GDPR vs CCPA.

Check out Privacy Right Automation >

Screenshot of a privacy portal setup tool interface from Cloud Compliance
Consent Management interface showing customer support, product recall

Manage Consent​

Article 6, 7, 8, 22

Manage Consent, Communication Preferences, Automated Decision making including Profiling

Obtain and track Consent to ensure data processing is in compliance with privacy laws. Cloud Compliance offers a full lifecycle including a self-service capability.


Manage Communication Preferences and consent in a centralized repository to avoid Consent fragmentation. Integrate consent and communication preferences with Salesforce, Marketing, and other systems.

Check out Consent Management >

Minimize Personal Data

Article 5, 32

Data Retention - Automated anonymize and delete

Minimize data for GDPR compliance and limit breach exposure by reducing your data footprint.

Automate retention policy enforcement in Salesforce with precise control on the removal of personal information. 


Free up Salesforce storage or preserve reporting and others with the flexibility to Delete or Anonymize records.

Check out Data Retention >

Screenshot of a data selection interface with a 'Welcome' banner and 'Step 1' indicating the process stage
GDPR Privacy Terms Content Management Interface

Manage Policy and Notices

Article 12, 13, 14

Data Processing Transparency - Disclosures, Notices, etc.

Manage and update policies in Salesforce for multiple regulations, countries, and languages.


Disclose privacy notices across websites, mobile apps, and others. Securely collect audit-ready proof of acceptance during customer onboarding and other business processes.

Check out Policy and Notice Management >

Mask Sandbox Data

Article 32

Pseudonymize or Anonymize Personal Data to prevent Sandbox induced Data Breach

Protect your organization by masking or erasing sensitive data in your sandboxes.


Automate common tasks and sandbox readiness to ensure data hygiene and business usability of data while staying compliant with GDPR security measures for data processing.

Check out Sandbox DataMasker>

Workflow diagram for data preparation with stages: Sandbox Refresh, Data Masking, Post-refresh Automation, and Ready for use.

Why Compliance Matters

Ethics

Your customer’s privacy is more than a compliance initiative. Privacy is a basic human right that your organizational ethos should align with.

Embarrassment

Privacy violations are magnified disproportionately in social media. Bad publicity impacts your company’s leadership, stock price, and financials.

Fines

Many organizations have been penalized for their privacy oversights. Regulatory authorities are scaling up faster than the time you may need to design compliance policies.

Trust

Building trust in a digital world is difficult enough. Erosion of trust due to unsavoury privacy incidents can permanently damage your business.

Frequently asked questions

What is GDPR?

The General Data Protection Regulation (GDPR) is the European privacy and security law with the goal of safeguarding and protecting the personal data privacy of EU residents.

It was approved by the European Union (EU) and put into effect on May 25th, 2018. GDPR imposes Data privacy & security obligations on Organizations that process the personal data of EU residents. 


The GDPR has cross-border enforcement with harsh penalties that can reach up to 4% of a company’s annual revenues. Companies that have failed to comply with the GDPR have paid fines of millions of euros.

Does GDPR apply to my organization?

If your Organization collects data related to people in the EU, then you will be required to comply with GDPR, irrespective of where your organization is physically located or registered.

 

Does GDPR apply to Non-profits?

Yes. GDPR applies to For-profit & Non-profits entities.

 

How can I make sure that my Salesforce is GDPR compliant?

CRM systems such as your Salesforce Org may contain the personal data of your prospects, customers, employees, and partners. To ensure GDPR compliance, you can standardize, automate and enforce GDPR-specific requirements with Cloud Compliance’s Apps available from AppExchange.


Some common use cases where Salesforce customers use our Apps include:

  • Generate a personal data inventory and conduct Data Protection Impact Assessments (DPIA) (Use our Personal Data Discovery),
  • Automate Data Portability, Right To Be Forgotten (RTBF), and other Subject Access Requests (SAR) (Use our Privacy Rights Automation)
  • Mask Sandbox Data to Enforce Data Security (Use our Sandbox DataMasker)
  • Drive transparency and audit-readiness in your privacy disclosures (Use our Policy & Notice Management)
  • Solve consent fragmentation with an enterprise-wide consent and communication preference repository in your Salesforce org (Use our Consent Management)
  • Orchestrate processing of RTBF & portability DSARs across all Salesforce Orgs (Use MOPS Hub).
What’s the difference between GDPR and CPRA/CCPA?

GDPR is the framework legislation of Europe while CCPA & CPRA are the framework legislations of California.

The essence of both these laws is the same – to protect the data privacy of their respective constituents.

GDPR applies to EU residents while CPRA/CCPA applies to Californian residents. They do differ in terms of their requirements also. Please refer to this short video for additional information.

Checkout: Data Privacy and Regulation matrix – GDPR CCPA LGPD PDPB.pdf