Build trust and transparency around your data with Marketing Cloud.
At Salesforce, we see the GDPR as a tremendous opportunity for marketers to deliver greater value, and a deeper, more trusted relationship with customers and consumers. To navigate the GDPR and continue to blaze a trail in marketing, you need to balance customer-centricity, governance, and compliance. Marketing Cloud can help businesses navigate the GDPR by balancing customer-centricity, governance, and compliance.
Marketing Cloud Accelerates GDPR Readiness
Right to Be Forgotten
The Right to Be Forgotten is managed primarily through Marketing Cloud’s contact delete framework. Marketing Cloud developed a robust data deletion framework that currently has the capability to delete individual's personal data following a data subject request, and will continue to improve functionality as more features are released. In May 2018, Marketing Cloud will address contact deletion across all channels and audiences.
While part of Marketing Cloud, we will call out some specifics to Salesforce DMP due to the nature of the product. Salesforce DMP enables customers to carry out a complete deletion of entire data records as well as a selective deletion of only certain datasets or data fields. After termination of services, it must be possible for a customer's records to be automatically deleted.
Data Portability
Marketing Cloud has functionality to support exporting and extracting data, as well as the option to port data in different ways, depending on your customer's needs. Data extension and individual contact data can be exported with current functionality using the UI or API. Salesforce is improving the user experience and providing new interface features around contact export. Our GDPR best practices documentation will outline the use of these existing features to enable you to extract the data needed.
The DMP will enable customers to export all data that exists in their DMP account. The data feed delivered to the customer comes in a machine-readable format using the existing data-feed transfer process. This can be managed using API or directly within the UI.
The DMP will enable customers to export all data that exists in their DMP account. The data feed delivered to the customer comes in a machine-readable format using the existing data-feed transfer process. This can be managed using API or directly within the UI.
Consent
Marketers can manage consent across all channels and ensure transparency. Each product within Marketing Cloud has functionality behind the scenes that may require consent. We advise you to work with your company’s legal counsel on drafting consents and listing types of information that require consent in the Privacy Notices as well. In our best practices documentation, we list by product the functionality within Marketing Cloud that may require consent to help you work with your legal counsel.
The Salesforce DMP provides multiple methods for you to manage and record the consent obtained from your consumer. Based on consent signals that you provide, DMP functionality only operates against a consented set of users. This can be managed using API or directly within the UI.
The Salesforce DMP provides multiple methods for you to manage and record the consent obtained from your consumer. Based on consent signals that you provide, DMP functionality only operates against a consented set of users. This can be managed using API or directly within the UI.
Restriction of Processing
In Marketing Cloud, individual contact records can be restricted upon request. By May 2018, API functionality will be incorporated as well. Using Marketing Cloud's restriction of processing functionality, unsubscribes will continue to be collected.
Salesforce DMP admins have the ability to stop processing data for a given user, meaning that data will not be used in any analytical jobs that run in the product until the restriction is lifted. This can be managed using API or directly within the UI.
Salesforce DMP admins have the ability to stop processing data for a given user, meaning that data will not be used in any analytical jobs that run in the product until the restriction is lifted. This can be managed using API or directly within the UI.
Accountability/Transparency
Salesforce offers customers a robust data processing addendum containing strong privacy commitments that few software companies can match. This addendum contains data transfer frameworks ensuring that our customers can lawfully transfer personal data to Salesforce outside of the European Economic Area by relying depending on the service on Binding Corporate Rules, our Privacy Shield certification, or the Standard Contractual Clauses. This addendum also contains specific provisions to assist customers in their compliance with the GDPR.
Security
Marketing Cloud provides our customers with a secure solution in accordance with our Trust and Compliance documentation.
“We are committed to our customers’ success, including compliance with the GDPR.”
What customers should do?
- Raise awareness of the importance of GDPR compliance with organisation leaders
- Obtain executive support for necessary staff resources and financial investments
- Choose someone to lead the effort in becoming GDPR-compliant
- Build a steering committee of key functional leaders
- Identify privacy champions throughout the organisation
- Obtain executive support for necessary staff resources and financial investments
- Choose someone to lead the effort in becoming GDPR-compliant
- Build a steering committee of key functional leaders
- Identify privacy champions throughout the organisation
- Review existing privacy and security efforts to identify strengths and weaknesses
- Identify all the systems where the organisation stores personal data, and create a data inventory
- Create a register of data processing activities and carry out a privacy impact assessment for each high-risk activity
- Document compliance
- Identify all the systems where the organisation stores personal data, and create a data inventory
- Create a register of data processing activities and carry out a privacy impact assessment for each high-risk activity
- Document compliance
- Ensure privacy notices are present wherever personal data is collected
- Implement controls to limit the organisation’s use of data to the purposes for which it collected the data
- Establish mechanisms to manage data subject consent preferences
- Implement appropriate administrative, physical, and technological security measures and processes to detect and respond to security breaches
- Establish procedures for responding to data subject requests for access, rectification, objection, restriction, portability, and deletion (right to be forgotten)
- Enter into contracts with affiliates and vendors that collect or receive personal data
- Establish a privacy impact assessments process
- Administer employee and vendor privacy and security awareness training
- Implement controls to limit the organisation’s use of data to the purposes for which it collected the data
- Establish mechanisms to manage data subject consent preferences
- Implement appropriate administrative, physical, and technological security measures and processes to detect and respond to security breaches
- Establish procedures for responding to data subject requests for access, rectification, objection, restriction, portability, and deletion (right to be forgotten)
- Enter into contracts with affiliates and vendors that collect or receive personal data
- Establish a privacy impact assessments process
- Administer employee and vendor privacy and security awareness training
- Compile copies of privacy notices and consent forms, the data inventory and register of data processing activities, written policies and procedures, training materials, intracompany data transfer agreements, and vendor contracts
- If required, appoint a data protection officer and identify the appropriate EU supervisory authority
- Conduct periodic risk assessments
- If required, appoint a data protection officer and identify the appropriate EU supervisory authority
- Conduct periodic risk assessments
GDPR Resources
TRAILHEAD
European Union Privacy Law Basics
WHITE PAPER
Your GDPR Compliance with Salesforce Shield