Loading...
Loading...
Loading...
Read this article to learn how Genesys Cloud addresses the GDPR and what your organization needs to know about Genesys Cloud’s GDPR implementation. For a general overview of the GDPR, see GDPR overview.
The General Data Protection Regulation (GDPR) is an important change in data privacy regulation. Genesys Cloud invested a significant amount of time in GDPR training for the Security and Compliance team. Training and certification from the International Association of Privacy Professionals (IAPP) began in early 2017. For more information about the GDPR, see GDPR compliance.
Genesys Cloud commissioned a GDPR project to:
Genesys Cloud legal and technical professionals have reviewed the GDPR and completed training and certification provided by the International Association of Privacy Professionals (IAPP). In Genesys Cloud’s role as a data processor, Genesys Cloud has taken measures to meet the requirements of the regulations.
The GDPR requires in Article 28 that data controllers “shall use only processors providing sufficient guarantees to implement appropriate technical and organizational measures.” Genesys Cloud has implemented these measures. Our subject matter experts can discuss them with you. For more information, contact dataprivacy@genesys.com.
No GDPR certification exists for a cloud services provider such as Genesys Cloud. However, Genesys Cloud has undergone multiple independent reviews of our administrative, physical, and technical controls for other data protection regulations, such as HIPAA.
As a data processor, Genesys Cloud implements appropriate technical and organizational measures. For details, see About security and compliance.
Genesys Cloud supports GDPR compliance for all Genesys Cloud deployed Amazon Web Services (AWS) regions.
You do not have to enable or configure anything within Genesys Cloud for GDPR compliance. The GDPR API is available to all customers. However, the GDPR may require a Data Processing Agreement (DPA) between you and Genesys Cloud. The DPA covers personal data processing.
If your organization plans to use Predictive Engagement to collect data about visitors’ activities on your website, you must follow steps for GDPR compliance. For more information, see Predictive Engagement and GDPR.
The GDPR requires in Article 28 that “Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.”
If you believe that you are subject to the GDPR, Genesys Cloud is ready to discuss a DPA that meets these requirements. To receive a Genesys Cloud DPA, contact dataprivacy@genesys.com.
Genesys Cloud provides a GDPR API as the preferred self-service solution for Genesys Cloud customers to respond to GDPR requests. The GDPR API enables responses to data subject requests to access, rectify, or delete their personal data in Genesys Cloud.
The GDPR API is designed for customers that need to respond to individual data subject requests. The GDPR API is not designed for responding to bulk requests such as bulk data deletion. The GDPR API is subject to rate limits described in the API documentation. These rate limits may restrict attempted bulk operations in order to maintain platform availability.
What you need to know about the Genesys Cloud GDPR API.
The GDPR service exposes two endpoints- a first endpoint for identifying the subjects that a given search term matches, and a second endpoint for actually initiating GDPR requests. The subjects endpoint accepts a single search term of a name, address, phone number, or email address, or social media handle, and returns a list of 0 or more matching subjects that consists of a userId, externalContactId, or dialerContactId. The requests endpoint accepts a single search term and a request type of Get, Export, Update, or Delete for responding to Article 15 (access), Article 16 (rectification), and Article 17 (erasure) requests. The requests endpoint accepts a single search term of a name, address, phone number, email address, social media handle, user ID, external contact ID, or dialer contact ID for initiating the specified GDPR request type. If the term is an ID, then the service first resolves it into the corresponding resource (user, external contact, dialer contact) and includes the known fields in the GDPR request.
The subjects endpoint accepts a single search term of four types: name, address, phone, or email and returns a list of all the subjects that match the search term. A subject may be a userId, externalContactId, or dialerContactId. The returned list could contain zero subjects, a single subject, or many subjects.
Genesys Cloud recommends using the subjects endpoint for every potential GDPR request to identify which individual(s) a subsequent request endpoint affects. By finding any subjects matching a search term, Genesys Cloud customers can reduce the risk of unforeseen effects of a given GDPR request. The subjects endpoint can also be used to disambiguate results when a given search term matches multiple subjects. Specifically, since the subjects endpoint returns all matching subjects for a given search term, an API user may discover a more accurate search criteria for a subsequent GDPR request.
Subject searches using Social search types are intended to match on the following fields for each channel:
For data stored by some Genesys Cloud features and services you must use the GDPR API with a subject. These services that require a subject to be included in the GDPR API request are:
The requests endpoint accepts a single search term of any type (name, address, phone, email, user ID, external contact ID, dialer contact ID ) and a single request type of Get, Export, Update, or Delete and returns a GDPR request which has been created and initiated. Export corresponds to an Article 15 (access) request, Update corresponds to an Article 16 (rectification) request, and Delete corresponds to an Article 17 (erasure) request. When the request type is Delete some services may anonymize personal data rather than delete. The actual processing of that request happens asynchronously. If the given term is a user ID or an external contact ID then the GDPR service first resolves that ID into the corresponding user, external contact, or dialer contact respectively, and includes all known fields from the user, external contact, or dialer contact on the request, in addition to the provided ID.
Customers use the requests endpoint to create an actual GDPR request. They should use the subjects endpoint first, to ensure the search term they use only affects the intended data subject. In the case where multiple criteria are known, they must submit multiple requests, one per term. It is strongly recommended that customers submit requests for every identifier known for an individual. For example, when an individual, or data subject, submits a request to the customer, the customer should collect the individual’s name, phone number, and email address, and submit GDPR requests to Genesys Cloud for each.
When a user submits a GDPR API update request using a social media type such as Twitter, Genesys Cloud searches all fields for matches against the existingValue field and updates with the new value if there are any matches. For example, a GDPR API update request with type=TWITTER and existingValue=123 replaces the id field on a target contact with a matching id. A GDPR API update request with type=TWITTER and existingValue=CompanyCEO replaces the screenName field on the target contact with a matching screenName. In the unlikely event that the existingValue field matches multiple target contact fields id and screenName both of these target contact fields are updated. The same applies for Instagram scopedId and handle fields.
While the GDPR applies to data subjects in the European Union, the Genesys Cloud GDPR API is available to customers in all Genesys Cloud regions. However, the GDPR API has strict rate-limiting to maintain performance of the solution.
If your organization uses the single customer view, two or more external contacts can be merged when they represent the same person. This has two implications for the GDPR API.
First, the subjects endpoint could surface multiple external contact IDs that correspond to the same person (in other words, belong to the same merge set). When examining the response from the subjects endpoint, the caller should use the External Contacts API to determine which of the external contact IDs belong to the same merge set. To do this, fetch each contact and determine which ones share the same canonicalContact.
Second, when making a request to the requests endpoint, make only a single request per merge set for the canonical contact id in that merge set. The GDPR API will transparently duplicate the request for each external contact ID in that contact’s merge set and return the related requests in the relatedRequests field in the response body.
The related requests are independent, full-fledged requests. Each related request will succeed or fail independently from the others, and the result of each related request must be inspected individually. If one of the related requests fails, wait until all the related requests finish before retrying the request. This keeps the set of in-flight requests easy to understand. If you retry before all the related requests finish, duplicate checking should prevent the system from generating duplicate requests, if requests for other contacts in the merge set are still in flight.
For more information on the contacts data model, canonical contacts and merge sets, see Contact Merging in the Developer Center.
No. Customers may use an externalContactId as a subject. A contact with a matching externalContactID may include one or more additional types of Personal Data such as a work phone number, Cell phone number, or social media channel information. When responding to a GDPR API request with an externalContactID subject, Genesys Cloud does not automatically search the platform for Personal Data associated with that contact that is found in those fields. In this scenario, Genesys Cloud recommends that customers review a matching contact and any Personal Data included with the contact and submit any additional GDPR API requests with those subjects. As mentioned above, Genesys Cloud recommends using the subjects endpoint for every potential GDPR request to identify which individual(s) a subsequent request endpoint affects. By finding any subjects matching a search term, Genesys Cloud customers can reduce the risk of unforeseen effects of a given GDPR request.
ACD interactions, such as email interactions and message interactions (third-party message platforms, such as Facebook Messenger, WhatsApp, and Twitter Direct Message, Genesys Cloud web messaging, and open messaging) may receive personal data in the form of file attachments. Genesys Cloud does not search the contents of such attachments for personal data. Instead, a GDPR request will work with an External ID, and if that specific ID is used in the request, find the conversation and any associated file attachment. Later, the associated file attachments are included and/or removed in a GDPR API response to a subsequent data subject request.
As an example, when a data subject uploads an image through Facebook Messenger, Genesys Cloud uses the External ID to find the conversation and any associated file attachments and uploads it. Later, if the data subject makes an Article 17 erasure request to delete their information, the Genesys Cloud API will remove all files uploaded by that data subject regardless of content. In the example, Genesys Cloud would respond to the GDPR API request and remove the image uploaded by the data subject through Facebook Messenger, regardless of the actual contents of the image.
All ACD interactions containing personal data in the form of file attachments must be associated with a contact profile stored in External Contacts. There is no method to search for personal data stored in ACD interactions independent of External Contacts. If personal data is stored in an ACD interaction through a custom variable, it cannot be found through the GDPR API unless the interaction is associated with a contact profile.
This example illustrates an effective response to a GDPR data subject request using the Genesys Cloud GDPR API.
You receive a valid request from a data subject to delete their data. The data subject provided their name and email address.
Genesys Cloud recommends using the GDPR API as a self-service option for responding to GDPR requests. If you experience an error using the GDPR API, please submit a case through Our Product Support Communications Portal. If you cannot use the GDPR API and need to respond to a GDPR request, our Professional Services team can assist. Contact your Customer Success Manager to create a statement of work for this effort.
The typical response time for Genesys Cloud to retrieve all personal data in response to an access or portability request is 1-2 days. Regarding a removal or forget me request under the GDPR, Genesys Cloud will need no longer than 14 days to remove personal data or make it anonymous upon request.
Usage of Genesys products requires processing of employees’ personal data (user’s name, work phone number, and work email) for proper functioning of the Genesys solution. Without storing this personal data associated with an employee, Genesys Cloud could stop performing its function. Thus, for current employees, the processing of their personal data is necessary for the purposes of the legitimate interests pursued by the customer. Further, the customer may be required to keep employee interaction records in order to meet other regulatory requirements. Based on the lawfulness of this processing and the design of Genesys products, Genesys does not recommend erasing personal data associated with an ongoing user.
No. Some Genesys Cloud services delete personal data upon request. Other services make personal data anonymous upon request.
Yes. You can incorrectly configure certain services that store personal data. This prevents Genesys Cloud from searching, accessing, or removing that data.
Genesys employees with roles related to GDPR:
Get user feedback about articles.