Using Compliance Records

When creating a new Compliance Record, the Person or Lead field will automatically be populated, along with their Email address from the Person or Lead record.

Legal Grounds

When creating a Compliance Record, you will need to select what you believe is the most appropriate reason for processing their personal data.

We’ve added the six legal grounds that can be used;

• Consent
• Legal Obligation
• Legitimate Interest
• Performance of Contract
• Public Interest
• Vital Interest

Only a single reason can be selected, so if you have multiple reasons that you can create separate Compliance Records for each. This way if one is revoked, the other may still be valid.

Purpose

The Purpose field is an unrestricted picklist and can be used to further specify what you are going to be using the personal data for. You can add to the default values in this list via Start > Configuration > Customisation > Picklists > Compliance Purpose. You can also choose to make this restricted to define particular values by unticking the Unrestricted checkbox.

Valid From / Valid Until

These two dates are used to work out whether there is a valid Compliance record in place. It will automatically populate the Valid From date to be the date you create the record, and the Valid Until will be left blank unless you specify otherwise or use the Revoke button.

Using Consent as Legal Grounds

If you select Consent as the Legal Grounds for processing the data, you will also see three additional fields:

• Method
• Statement
• Form Data

These fields should be used to record further information that support using Consent as the Legal Grounds.

Attachments and Related Items

You can attach any further information to support your Compliance by using Notes, Activities and Files. For example, you may wish to attach a scanned copy of a letter, or may have a process which automatically takes a screenshot of the completed web form submission.

Revoking a Compliance Record

You can use the Revoke button to make that Compliance record no longer valid. This will insert a date into the Valid Until field.

Revoking a Compliance Record may not mean that the Person & Lead is no longer compliant, if a Person has given Consent and Legitimate Interest to store their details, then later on were to revoke their Consent, providing that the Legitimate Interest compliance had not expired, the Record would still register as GDPR Compliant.