GDPR & CCPA considerations

for Salesforce

Regulation GDPR (General Data Protection Regulation) CCPA (California Consumer Privacy Act)

Applicability Criteria European union residents California residents (CPRA refer here)

Exempt Categories - Non Profit

Clauses Function Clauses Function

Sandbox
Article 32
Pseudonymize or Anonymize Personal Data Pseudonymize or Anonymize Personal Data
D
DMM CCPA Governance
DataMasker Recitals 76, 77, 83 to prevent Sandbox induced Data Breach to prevent Sandbox induced Data Breach

Article 5, 25, 32

Data Retention - Automated anonymize and Data Retention - Automated anonymize and
DR Data Retention Recitals 28, 39, 50, 76, 77, CCPA Governance
delete delete
83

Right of Access, Rectification, Erasure (Right

Privacy Rights
Article 12, 15-21
1798.130, 1798.120 (a), Data Access requests, ‘Do not sell’, Self-serve
PR
D M To Be Forgotten), Restriction, Portability,
Automation Recitals 58, 59, 63-70 1798.135 (a) Privacy center
Right to Object, Self-serve Privacy center

Article 6-8, 22
Manage Consent, Communication
Consent
Manage Opt-in/Outs, Consent and
Recitals 28, 29, 40-50, 32, Preferences, Automated Decision making 1798.135. (1) (2)
Management Communication Preferences
33, 38, 42, 43, 71, 72 including Profiling

Article 6, 9, 10, 30, 32, 35

Data Inventory, Record of Processing Activity
Personal Data

Recitals 13, 28, 29, 40, 41, (ROPA), Data Privacy Impact Assessment CCPA Governance Data Inventory and Classification
Discovery 44-50, 76, 77, 82-84, 90-93 (DPIA)

Policy Notice
Article 12-14
Data Processing Transparency - Disclosures,
1798.135 (1) (2) Data Processing Notices, ‘Do not sell’ link
Management Recitals 58-62 Notices

© All Rights Reserved by Cloud Compliance. Not legal advise, for informational purpose only. https://cloudcompliance.app/
LGPD & PDPB considerations
for Salesforce

Regulation LGPD (Lei Geral de Proteção de Dados) PDPB (Personal Data Protection Bill 2019)

Applicability Criteria Brazilian residents Indian residents

Exempt Categories - Government

Clauses Function Clauses Function

Sandbox
Pseudonymize or Anonymize Personal Data Pseudonymize or Anonymize Personal Data
D
DMM Article 12, 15 Clauses 24, 40
DataMasker to prevent Sandbox induced Data Breach to prevent Sandbox induced Data Breach

Data Retention - Automated anonymize and Data Retention - Automated anonymize and
DR Data Retention Article 12, 15 Clauses 4-6, 9
delete delete

Data Subject rights for Access, Correct, Data Subject rights for Access, Correct,
Privacy Rights
Article 5, 6, 9, 10, 14, 17, 18,
PR
D M Anonymize, Portability, Deletion and others, Clauses 9, 17-20, 23, 33 Anonymize, Portability, Deletion and others,
Automation 19, 20
Self-serve Privacy center Self-serve Privacy center

Consent
Manage Opt-in/Outs, Consent and Manage Opt-in/Outs, Consent and
Article 8-10, 15, 18 Clauses 5, 7, 11-14, 16, 19
Management Communication Preferences Communication Preferences

Data Inventory, Record of Processing Activity

Personal Data
Clauses 4-6, 11-14, 24, 27-
Article 5, 37-40, 42, 43 (ROPA), Data Privacy Impact Assessment Data Inventory and Classification
Discovery 29
(DPIA)

Policy Notice
Data Processing Transparency - Disclosures,
Article 8, 9 Clauses 7, 22-25 Data Processing Notices, ‘Do not sell’ link
Management Notices

© All Rights Reserved by Cloud Compliance. Not legal advise, for informational purpose only. https: //cloudcompliance.app/