Blogs
Analysis of Apple’s iOS 14.5 Consent Prompt for Tracking
Published on October 18, 2021 AUTHOR - Privacy Research Team
This year in April, Apple released iOS 14.5 making major privacy updates within the operating system. The new operating system now requires all apps that collect data from end-users for the purposes of tracking across apps and websites to use the AppTracking Transparency Framework and ask users via Apple’s built-in consent prompt to opt-in to tracking. This means all Apple users will now be presented with a prompt with two equally prominent options of “Allow Tracking” and “Ask Apps Not to Track” while using apps that collect their data and share it with third parties for advertising purposes.
When a user selects “Ask Apps Not to Track”, Apple will block that particular app developer from accessing the user’s IDFA (identifiers for advertisers). App developers are expected to honor the user's choice and prevent any tracking. Users are also able to change their preferences on an app-by-app basis by going to the settings of the particular app.
In today’s privacy-conscious world, this new mandatory consent prompt is being seen as a welcome initiative. The fact that mobile users would not be tracked by default unless they affirmatively select “Allow Tracking” appears to be consistent with privacy-by-default as well as privacy-by-design principles. While privacy-by-default requires apps to ensure that by default, the user has been provided the strictest privacy measure available, privacy-by-design refers to having in-built abilities that ensure data privacy. The new consent prompt is also consistent with the GDPR and the European Data Protection Board’s Updated Guidelines on Consent that prohibit the use of pre-selected checkboxes while obtaining consent from a data subject.
Asking Permission to Track:
In its User Privacy and Data Use Policy, Apple defines tracking as, “the act of linking user or device data collected from your app with user or device data collected from other companies’ apps, websites, or offline properties for targeted advertising or advertising measurement purposes. Tracking also refers to sharing user or device data with data brokers. Examples of tracking include, but are not limited to:
- Displaying targeted advertisements based on user data collected from apps and websites owned by other companies.
- Sharing device location data or email lists with a data broker.
- Sharing a list of emails, advertising IDs, or other IDs with a third-party advertising network that uses that information to retarget those users in other developers’ apps or to find similar users.
- Placing a third-party SDK in your app that combines user data from your app with user data from other developers’ apps to target advertising or measure advertising efficiency, even if you don’t use the SDK for these purposes.”
Is Apple’s built-in consent prompt good enough?
From a legal perspective, the responsibility to obtain the end user’s consent seems to primarily lie with the app developer as it is the data controller - the entity that determines the purposes and means of the processing of personal data. The operating systems and device manufacturers may also be considered data controllers (and where relevant joint data controllers) for any personal data which is processed for their own purposes.
Apps must ensure that they obtain separate and specific consent for separate and specific data processing operations as well as consent obtained for one purpose must not be used for any other purpose. One opt-in prompt may cover different processing operations as long as these operations serve the same purpose. However, there must be separate opt-in prompts to allow users to give separate consent for separate data processing purposes. For example, specific consent must be obtained for accessing geolocation data and separate for accessing browsing history as both can have different processing purposes.
Apple’s built-in consent prompt certainly helps apps in fulfilling some part of their privacy obligations, however, it does not seem to ensure granularity as indicated from Apple’s broad interpretation of “tracking”. It appears that in one consent prompt, several consent prompts are tied together since by selecting “Allow Tracking”, users are not only consenting to be receiving targeted advertisements on apps but also to be sharing their location data with data brokers and sharing IDs for retargeting purposes. It is not clear if such consent meets the global data protection legal requirements that require separate consent for separate data processing purposes.
What other privacy considerations apps must be mindful of?
Rather than merely relying on Apple’s built-in consent prompt, apps also need to be mindful of their specific consent-related privacy obligations.
Firstly, apps need to ensure data minimisation and purpose limitation. So, even if a mobile user allows apps to collect their data and track them via choosing “Allow Tracking”, this does not provide apps an uncontrolled power to collect as much data as they want to - they should be collecting only the limited amount of data that is required for the purposes for which it is processed. Moreover, data collected for one purpose may not be used for any other purpose.
Secondly, apps are required to provide their users easy-to-understand and accessible information about the data they collect and the purposes for which they are collecting while obtaining consent from users. At a minimum, users should be made aware of the purpose of each of the processing operations for which consent is sought, what type or category of data will be collected and used, and their rights connected with their personal data such as their right to withdraw consent at any time. One simple prompt with two options on “Allow Tracking” and “Ask Apps Not to Track” does not provide users enough clarity as to whether a particular app will be collecting their location data, email lists, phone contact lists, or any other identification data. Therefore, app developers must make such information available on their privacy notices which should be easily accessible to users.
How can consent opt-in rates be increased?
With big corporations such as Apple and Google taking privacy-friendly initiatives and global data protection requirements becoming stricter with time, the ad-tech industry has started reinvestigating its marketing strategies. Various statistics show that more and more Apple end-users end up choosing not to track, eventually leading to extremely low data collection rates.
App developers are encouraged to be more transparent with their users as far as their data collecting and processing activities are concerned. Increased transparency will not only assist apps fulfill their legal requirements but also achieve consumer awareness and trust. This is because in today’s privacy-aware yet digital world, users may still want to keep receiving personalised advertisements - they just need more information on how businesses collect and manage their data. Transparency may be achieved by using a combination of layered privacy notices, contextual pop-up notices, privacy dashboards, and visualisation tools such as icons - all of that will ultimately help users make an informed choice.
What’s next?
Businesses are increasingly investing their time and efforts in coming up with privacy-compliant alternatives to the use of third-party cookies and other tracking means for advertising purposes. A few proposed options include, although not limited to Google Privacy Sandbox, first-party data stack, identity solutions, and contextual advertising. At this point in time though, it is difficult to comment with certainty as to which or a combination of these alternative options is the best approach that protects end users’ privacy, fulfills legal consent requirements, and helps businesses in their marketing activities. In the meantime, mobile apps and other data controllers are advised to ensure consent granularity, data minimisation, and purpose limitation as well as provide adequate information to users while obtaining consent from them.
How Securiti can help?
Securiti’s Universal Consent Management Solution enables marketers to adequately advertise and market their products in a compliant manner by capturing consent and automating revocation. Securiti’s Cookie Consent Banner Solution enables companies to build cookie consent banners in accordance with the applicable legal requirements when collecting personal data for non-essential purposes on digital properties.
Ask for a DEMO today to understand how Securiti can help you comply with the applicable legal requirements of global data privacy laws and regulations with ease.
Related Content
September 7, 2020
Why you need to adopt Securiti’s Consent Management Platform
Since the European Data Protection Board (EDPB) has released updated Guidelines on Consent, Consent Management Platforms (CMPs) have been reevaluating their practices in relation to governance, collection and management of users’ consent. Gone are the days of Cookie...
October 2, 2020
IAB EU Solution: We are proud to announce that SECURITI.ai’s Consent Management Platform is officially TCF v2.0 approved by the IAB
Securiti has been working closely with IAB EU to align our solution with their TCF v2.0 framework, and we’re proud to announce that Securiti’s Consent Management Platform is officially TCF v2.0 approved by the IAB. IAB EU TCF v2.0...
October 1, 2020
Irish Guidance on Consent & Cookies – Grace Period ends on 5 October
On 6 April, the Data Protection Commission of Ireland (DPC) released a substantive Guidance Note on cookies (Guidance) and provided organizations a grace period of six months to ensure compliance. After the end of the six-month window, which is 5...
Take a
Product Tour
See how easy it is to manage privacy compliance with robotic automation.
Products
Newsletter
Get in touch
info@securiti.ai
PO Box 13039,
Coyote CA 95013
- Products
- Data IntelligenceBack
Break Silos of Sensitive Data & Risk Understanding across Multicloud and self managed systems. Common grammar, policies and reporting
Key Features
- Detect shadow & native data assets across major cloud service providers (AWS, Azure, GCP, OCI) & extract them into an asset catalog.
- Discover, classify and label hundreds of sensitive data elements in multicloud and self-managed structured and unstructured data systems at petabyte scale.
- Search and visualize distribution of sensitive data elements in your structured & unstructured data systems. Synchronize with any third-party data catalogs to populate metadata associated with tables or columns.
- Build a relationship map between discovered personal data and its owners. Enable timely and accurate fulfillment of DSRs, breach notifications and consent reports.
- Detect security posture and misconfigurations associated with your multicloud & SaaS data assets. Assess data security risks and enforce appropriate remediation.
- Identify data risk hotspots in your environment with a clear breakdown of risk drivers such as specific data elements, data locations, user residencies and more.
Find data assets, and discover personal and sensitive data in structured and unstructured data systems, across on-premises and multi-cloud.
Key Features
- Catalog all data assets
- Support for 200+ apps and data asset types
- 100s of out-of-box detectors
- Out-of-the-box detection of data attributes specific to 20+ categories across industries
- Extensive localization support including N.America, EU, LATAM and Asia
- Identify regulated attributes
Classify & label data to ensure appropriate security controls are enabled on most sensitive data in your organization
Key Features
- Automatic data classification to detect sensitive data such as medical/financial documents and more
- Auto data labelling
- Purpose based labeling
- Metadata tags
Collect, organize, enrich and build a data catalog to address privacy, security and governance solutions
Key Features
- Discover Data Assets
- Searchable data catalog
- Discover privacy and security metadata
Connect to structured and unstructured data sources and automatically discover and build a relationship map between personal data and its owner.
Key Features
- Secure creation of PI graph while preventing PI sprawl
- Derive insights about identities, PI data, residencies and data location
- Gain valuable insights about compliance risk for PI data across systems
- Enable swift and accurate DSR fulfillment
- Enable swift and accurate breach notification
- Gain insights about PI data using natural language conversational interface
Assess risk scores for every data asset, asset location, or personal data category
Key Features
- Identify data risk hotspots
- Customize and tune risk scores
- Eliminate blind spots for data risk
-
AWS S3 -
Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) -
Amazon Redshift -
Amazon Athena -
Amazon Aurora Postgres -
Amazon DynamoDB -
Amazon EMR Hive -
Amazon Elasticsearch - And More
-
Google Cloud Storage -
Google BigQuery -
Google Cloud Spanner -
Google Cloud SQL -
Google Cloud Datastore -
Google Cloud Firestore - And More
-
Azure Files -
Azure Blobs -
Azure Cosmos DB -
Azure Data Warehouse -
Azure SQL Database -
Azure Table Storage - And More
-
OCI Object Storage -
OCI Autonomous Data Warehouse Cloud -
OCI Database Cloud Service -
OCI DB - Bare metal -
OCI DB - VMs -
OCI MySQL -
OCI NoSQL - And More
Auto discover personal data in Snowflake and enforce access governance
Key Features
- Deep data discovery - auto detect all personal and sensitive data in Snowflake
- Detect 120+ personal data attributes across various industries, regions and regulations
- Reveal all personal data records in schemas, tables and columns
- Assess data risk in Snowflake based on personal data attributes, data residencies, & Snowflake instance location
- Enhanced data protection and handling
- Automated data subject rights fulfillment
- Visibility and enforcement of access governance
Auto discover personal data in Snowflake and enforce access governance
Key Features
- Deep data discovery - auto detect all personal and sensitive data in Databricks
- Detect 120+ personal data attributes across various industries, regions and regulations
- Reveal all personal data records in delta lake
- Assess data risk in Databricks based on personal data attributes, data residencies, & databricks instance location
- Enhanced data protection and handling
- Automated data subject rights fulfillment
- Visibility and enforcement of access governance
Discover, classify, manage and protect sensitive data in Workday. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in Box. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in Slack. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in Github. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights
Discover, classify, manage and protect sensitive data in Jira. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in Dropbox. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in SAP Successfactors. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in Servicenow. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in Zendesk. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in Apache Hive. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in Apache Spark SQL. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in Cassandra. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
Discover, classify, manage and protect sensitive data in Couchbase. Automate data subject rights fulfillment and maintain compliance with regulations such as GDPR, CCPA, LGPD, PCI and more.
Key Features
- Deep data discovery
- Auto classification of PII and PHI
- Enhanced data protection and handling
- Automated data subject rights fulfillment
- PrivacyBack
Enable privacy by design through the AI driven PrivacyOps platform
Key Features
- Continuously scan and monitor data against non-compliance to subject rights, legal basis for data processing, data residency or security controls - make privacy proactive not reactive
- PIA framework, Data subject rights management, consent management framework and privacy notices ensure that privacy is enabled default
- Privacy portals, data mapping automation and PIA framework ensure that privacy is embedded into design
- PIA framework, privacy notices and consent and subject rights management helps make any program a positive sum initiative
- Classification, risk monitoring and policy based alerts and remediation offer end-to-end security while processing personal data
- Privacy notices and consent management framework offer visibility and transparency to users and respect users rights and preferences
Maintain your Data Catalog with continuous automated updates
Key Features
- Maintain a central repository for all data assets, data processing and vendor records
- Initiate PIAs and DPIAs, and dynamically update them based on changes to your data
- Automatically discover new data and dynamically update your data catalog, trigger new assessments and update your risk register
- Easily monitor cross border traffic and other key data patterns and exchanges with dynamic visual data maps
- Generate Records of Processing Activities, such as Article 30 reports
- Gain real-time insights into risks associated with your data and processing activities
Automate data subject rights request fulfillment and maintain proof of compliance
Key Features
- Customizable DSR intake forms
- Identity verification to protect against identity fraud and PI theft
- Robotic automation for timely and efficient fulfillment of data subject requests
- Automated linking of identity to personal data using AI
- Built-in collaboration to prevent data sprawl
- Comprehensive audit records to meet regulatory requirements
Connect to structured and unstructured data sources and automatically discover and build a relationship map between personal data and its owner.
Key Features
- Secure creation of PI graph while preventing PI sprawl
- Derive insights about identities, PI data, residencies and data location
- Gain valuable insights about compliance risk for PI data across systems
- Enable swift and accurate DSR fulfillment
- Enable swift and accurate breach notification
- Gain insights about PI data using natural language conversational interface
Audit once and comply with many regulations. Collaborate and track all internal assessments in one place.
Key Features
- Comprehensive knowledgebase of global regulatory requirements
- Single repository for all internal responses and documents
- Easy sharing of completed assessments with customers and partners
- Audit once and comply with many regulatory requirements
- Collaborate with subject matter experts across functions on one privacy platform
- Gain compliance insights, recommendations and automate follow-ups with internal parties.
Automation of privacy assessment collection from third parties, collaboration among stakeholders, follow-ups and compliance analytics.
Key Features
- Comprehensive knowledgebase of global regulatory requirements
- Single repository for all 3rd party responses and documents
- Independent, privacy risk ratings of 3rd parties
- Audit once and comply with many regulatory requirements
- Collaborate with subject matter experts across functions on one privacy platform
- Gain compliance insights, recommendations and automate follow-ups with 3rd parties.
Automate global cookie consent compliance.
Key Features
- Track 1st and 3rd party code that runs on websites through continuous website scanning
- Automatically classify cookies for accurate consent notification
- Comply with global regulatory and compliance requirements such as GDPR, CCPA, ePrivacy Directive, IAB TCF 2.0 and more
- Maintain comprehensive records of consent for audit and reporting
- Customize the style, look and feel to align with your brand
- Honor opt-out requests by automatically blocking non-essential cookies without any additional code
Simplify and automate universal consent management.
Key Features
- Customizable endpoints based on branding, functionality and regulatory requirements
- Consent orchestration across an extensive array of applications
- Easily honor consent revocations from offline or non-primary channels
- Deploy a configurable consumer preference center
- Build configurable workflows to dynamically sync consent status across systems
- Maintain comprehensive consent records for audit and reporting
Automate the incident response process by gathering incident details, identifying the scope and optimizing notifications to comply with global privacy regulations.
Key Features
- Easy and intuitive portal to report and collaborate on incidents
- Breach management workbench to automate incident management and data breach notifications
- Automatically discover insights about impacted users & their data
- Use jurisdiction research data to make notification decisions
- Track remediation activities and maintain detailed audit trails
- Make timely notifications using pre-built templates to reduce risk
Keeping privacy notices up-to-date made easy
Key Features
- Publish privacy notices in minutes using pre-built templates
- Centralize management by tracking and monitoring privacy notices for all your environments
- Reduce risk of privacy violations
- Accelerate periodic review process
- Native integration with privacy-ops platform keeps notices up-to-date
Operationalize GDPR compliance with the most comprehensive PrivacyOps platform
Key Features
- Build customized, branded web forms to accept verified data subject rights requests
- Automate secure data subject request handling
- Continuously scan and monitor data against non-compliance to subject rights, legal basis for data processing, data residency or security controls
- Surface new PD types, categories and data flow risks on an ongoing basis
- Maintain an accurate data catalog, map data flows and generate article 30 reports
- Meet cookie compliance requirements
- Monitor and track consent to ensure data is processed legally
- Assess GDPR readiness using a collaborative, multi-regulation assessment system
- Track, monitor and manage privacy and security readiness for all vendors from a single interface
Operationalize CCPA compliance with the most comprehensive PrivacyOps platform
Key Features
- Build customized, branded web forms to accept verified data subject rights requests
- Automate secure data subject request handling
- Continuously scan and monitor data against non-compliance to subject rights, legal basis for data processing, data residency or security controls
- Surface new PD types, categories and data flow risks on an ongoing basis
- Maintain an accurate data catalog, map data flows and generate article 30 reports
- Meet cookie compliance requirements
- Monitor and track consent to ensure data is processed legally
- Assess GDPR readiness using a collaborative, multi-regulation assessment system
- Track, monitor and manage privacy and security readiness for all vendors from a single interface
Revolutionize LGPD compliance through PrivacyOps
Key Features
- Build customized, branded web forms to accept verified data subject rights requests
- Automate secure data subject request handling
- Continuously scan and monitor data against non-compliance to subject rights, legal basis for data processing, data residency or security controls
- Surface new PD types, categories and data flow risks on an ongoing basis
- Maintain an accurate data catalog, map data flows and generate article 30 reports
- Meet cookie compliance requirements
- Monitor and track consent to ensure data is processed legally
- Assess GDPR readiness using a collaborative, multi-regulation assessment system
- Track, monitor and manage privacy and security readiness for all vendors from a single interface
- Security
- FeaturesView
BackIdentify data risk & enable protection and control
Key Features
- Uncover data risk - Identify data risk hotspots in your environment with a clear breakdown of risk drivers such as specific data elements, data locations, user residencies and more.
- Discover & remediate security misconfigurations - Monitor security posture associated with your cloud assets & enable policies to resolve security risks. Prioritize & remediate risk in assets with specific sensitive data elements
- Mitigate sensitive data exposure - Prevent unauthorized users from accessing sensitive data in data warehouses and databases through static and dynamic masking.
- Track high severity alerts - Review security alerts on a dashboard and prioritize them by severity. Track open alerts to ensure they are remediated.
Discover data assets, detect & catalog sensitive data in it
Key Features
- 100s of out-of-box detectors
- Support for 200+ apps and data asset types
- Regional data type coverage
- Searchable sensitive data catalog
- Industry specific coverage
- Regulation specific coverage
Classify and label data to ensure appropriate security controls
Key Features
- Auto data classification
- Auto data labeling
- Purpose based labeling
- Metadata tags
Monitor data security posture and identify external and internals risks to data security
Key Features
- Detect data exposure risks
- Identify high risk data assets
- Customizable risk score calculation
- Data risk visualization & attribution
Policy based alerts and remediations to protect data from external and internal threats
Key Features
- Policy driven proactive alerts and remediation of data exposures
- Policy driven access controls
- Easily configure policies using rules
Investigate data security issues and take remediation actions
Key Features
- Investigate root cause of data security issues
- Policy creation from incidents
- Assign and track incident closures
-
-
- Solutions
- Discover personal data
- Reveal all personal data records
- Identify Data Risk
- Find data owners & fulfill DSRs in a timely manner
- Protect PII and PHI
- Visibility and enforcement of access governance
- Discover personal data
- Auto detect sensitive files and classify them
- Catalog & search unstructured data
- Identify Data Risk
- Find data owners & fulfill DSRs in a timely manner
- Discover personal data
- Catalog structured and unstructured data
- Classify and label data
- Protect PII and PHI
- Update Data Maps & Article 30 reports
- Discover all your sensitive data
- Auto detect & classify sensitive content
- Prevent data leaks and reduce accidental breaches
- Monitor data risk
- Comply with GDPR/CCPA by fulfilling DSRs in a timely manner
- Discover sensitive data
- Reveal all sensitive data records
- Identify Data Risk
- Find data owners & fulfill DSRs in a timely manner
- Protect PII and PHI
- Automate consumer data access request handling
- Secure fulfillment of data access requests
- Fulfill CCPA 'do not sell' requests
- Continuous monitoring and tracking
- Automate PI data linking
- Enable opt-out mechanisms
- Monitor and track consent
- Assess CCPA readiness
- Assess third parties
- Map data flows
- Assess CPRA readiness
- Map data to discover sensitive personal information and catalog it
- Automate data classification & labeling
- Automate data subject rights requests for a seamless customer experience
- Monitor and track consent
- Enable Opt-out Mechanisms
- Continuous monitoring and tracking
- Automate People Data Graph
- Manage vendor risk
- Privacy Policy & Notice Management
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access and port requests
- Automate objection and processing restriction requests
- Automate erasure requests
- Automate object and restriction of processing requests
- Continuous monitoring and tracking
- Automate PI data linking
- Meet cookie compliance
- Monitor and track consent
- Assess GDPR readiness
- Map data flows and generate article 30 reports
- Manage vendor risk
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access and port requests
- Automate processing of rectification requests
- Automate erasure requests
- Automate object and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess LGPD readiness
- Map data flows and generate reports
- Manage vendor risk
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access and port requests
- Automate the processing of rectification requests
- Automate erasure requests
- Automate object and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess NZPA readiness
- Breach Response Notification
- Manage vendor risk
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access and port requests
- Automate the processing of rectification requests
- Automate erasure requests
- Automate object and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess PDPA readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access and port requests
- Automate the processing of rectification requests
- Automate erasure requests
- Automate object and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess POPIA readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access and port requests
- Automate the processing of rectification requests
- Automate erasure requests
- Automate object and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess DIFC readiness
- Manage vendor risk
- Breach Response Notification
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate the processing of rectification requests
- Automate erasure requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess Australia PA readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access and port requests
- Automate the processing of rectification requests
- Automate objection and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess PDPA readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate the processing of rectification requests
- Automate erasure requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess PIPEDA readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Conduct EU-US Data Transfer Risk Assessments based on Schrems II decision
- Identify and review data transfers from the European Union
- Manage and remediate discovered vendor risks
- Automate health professionals’ data access request handling
- Automated discovery, mapping, cataloging and labeling of data assets
- Secure fulfillment of data access requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Assess ADHICS readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Automate processing of rectification requests
- Automate erasure requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Monitor and track consent
- Assess ECL readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate the processing of rectification requests
- Automate erasure requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess LPPD readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate the processing of rectification requests
- Automate erasure requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess PDPB readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate the processing of rectification requests
- Automate object and restriction of processing requests
- Automate erasure requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess DPA readiness
- Map data flows
- Manage vendor risk
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate the processing of rectification requests
- Automate erasure requests
- Automate object and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess PDPO readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate the processing of rectification requests
- Automate erasure requests
- Automate object and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess DPA readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Continuous monitoring and tracking
- Automate People Data Graph
- Monitor and track consent
- Assess TRA CPR readiness
- Map data flows
- Manage vendor risk
- Customize DSR Request Portal
- Automate Data Subject Access Request Handling
- Secure Fulfillment of Data Access
- Automate Processing of Rectification Requests
- Automate Erasure Requests
- Automate Objection & Restriction of Processing Requests
- Continuous Monitoring & Tracking
- Automate People Data Graph
- Meet Cookie Compliance
- Monitor & Track Consent
- Assess PIPA Readiness
- Map Data Flows
- Manage Vendor Risk
- Breach Response Notification
- Customize DSR Request Portal
- Automate Data Subject Access Request Handling
- Secure Fulfillment of Data Access
- Automate Processing of Rectification Requests
- Automate Erasure Requests
- Automate Objection & Restriction of Processing Requests
- Continuous Monitoring & Tracking
- Automate People Data Graph
- Meet Cookie Compliance
- Monitor & Track Consent
- Assess Japan APPI readiness
- Map Data Flows
- Manage Vendor Risk
- Breach Response Notification
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate processing of rectification requests
- Automate erasure requests
- Automate objection and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess Qatar DPL readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate processing of rectification requests
- Automate erasure requests
- Automate objection and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess Bahrain PDPL readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Privacy Policy & Notice Management
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate processing of rectification requests
- Automate erasure requests
- Automate objection and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess Bahrain PDPL readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Privacy Policy & Notice Management
- Customize a data subject rights request portal for seamless customer care
- Automate data subject access request handling
- Secure fulfillment of data access
- Automate processing of rectification requests
- Automate erasure requests
- Automate objection and restriction of processing requests
- Continuous monitoring and tracking
- Automate People Data Graph
- Meet cookie compliance
- Monitor and track consent
- Assess Bahrain PDPL readiness
- Map data flows
- Manage vendor risk
- Breach Response Notification
- Privacy Policy & Notice Management
BackSnowflake is a cloud based data warehouse that allows organizations to run large scale data analytics projects to uncover business insights, run or train machine learning models, and modernize their data infrastructure.
Key Features
Microsoft O365 is the ubiquitous productivity suite for every business worker. Users rely on Office products such as OneDrive and SharePoint to collaborate with their co-workers.
Key Features
Organizations want to migrate their on-premises data to cloud data stores to take advantage of scale and flexibility while reducing operational cost of managing on-premises infrastructure. However, due to privacy regulations such as GDPR, CCPA administrators have to ensure that data is migrated in compliance with these laws.
Key Features
Protecting sensitive content is a priority for all organizations, however, due to volume of sensitive content and
Key Features
While data aids in business decision making, global privacy regulations such as GDPR, CPRA require organization to identify personal & sensitive data & use only for its intended purpose and implement adequate protection.
Key Features
Securiti enables organizations to meet multiple regulations around the world and helps with compliance requirements through AI-driven PI data discovery, DSR automation, documented accountability, enhanced visibility into data processing activities and AI-driven process automation.
Securiti is a complete PrivacyOps Solution.
View all solutionsThe California Consumer Privacy Act (CCPA) was signed into law on June 28, 2018 and is scheduled to come into effect on January 01, 2020. Often compared to GDPR, CCPA protects consumers from mismanagement of their personal data and gives the consumer control over what data is collected, processed, shared or sold.
Key Features
The California Privacy Rights Act (CPRA) will take effect from January 1, 2023, and will apply to personal information collected on or after January 1, 2022. Enforcement of the CPRA will start six months later (July 1, 2023). The CPRA builds upon the CCPA, strengthening user privacy for California residents.
Key Features
The EU General Data Protection Regulation (GDPR) came into effect on May 25, 2018 and changed the global privacy landscape. It has broadened the definition of processing activities and personal data, impacting companies worldwide, and has tightened the rules to obtain consent before processing information.
Key Features
The Lei Geral de Proteção de Dados (LGPD) is modeled with similarities to the General European Data Protection Regulation (GDPR) and contains sixty-five articles. It was approved on August 14, 2018 and its validity has undergone several changes, the last relevant fact being MPV 959. LGPD is in effect since September 18, 2020. The sanctions by the ANPD (Brazilian Data Protection Authority) were postponed to August 2021. The LGPD allows people have more rights over their data and expects organizations to comply with their regulations or face heavy penalties or fines.
Key Features
China has complex data protection and data security regime, however, the following are three main laws that primarily cover China’s data protection and data security regulatory framework. These laws are:
Frameworks
The government of New Zealand has recently replaced its long-existing Privacy Act of 1993 with a modernized version, the Privacy Act 2020. The New Zealand Privacy Act 2020 (NZPA) will take effect from December 1, 2020.
Key Features
The Personal Data Protection Act, B.E. 2562 (2019) ('PDPA') is Thailand's first consolidated data protection law, which was published in the Thai Government Gazette on 27 May 2019. This law was said to go into effect on 27 May 2020. However, in May 2020, the Thai Cabinet through a Royal Decree has deferred the enforcement of certain data protection provisions of the PDPA until 31 May 2021.
Key Features
In order to protect the data of individuals in South Africa, Parliament assented to the Protection of Personal Information Act (POPIA) on 19th November 2013. The commencement date of section 1, Part A of Chapter 5, section 112 and section 113 was 11 April 2014. The commencement date of the remaining sections (excluding section 110 and 114(4)) was 1st July 2020. As per the Regulator’s Operational Readiness Plan the Regulator will be able to take enforcement actions for the violation of POPIA by July 1st 2021.
Key Features
The DIFC Data Protection Law, 2020 lays down regulations regarding the collection, disclosure and processing of personal data in the DIFC, a special economic zone in Dubai. It also gives rights to individuals whom the personal data relates to and provides power to the Commissioner of Data Protection to enforce the law, enact regulations and approve industry-wide Codes of Conduct.
Key Features
The Australia Privacy Act 1988 (Privacy Act) was enacted to protect the privacy of data subjects and regulate how Australian agencies and organizations with an annual turnover of more than $3 million handle their customers’ personal information.
Key Features
Singapore’s Personal Data Protection Act (PDPA) comprises various provisions governing the collection, disclosure, use, and care of personal data. It recognizes the rights of individuals to have more control over their personal data and the needs of organizations to collect, use, or disclose personal data for legitimate and reasonable purposes.
Key Features
On April 13, 2000, the Personal Information Protection and Electronic Documents Act (PIPEDA) received Royal Assent. It came into force in stages, beginning on January 1, 2001. PIPEDA came fully into effect on January 1, 2004. The legislation applies to organizations that collect, use or disclose personal information in the course of commercial activities.
Key Features
After the invalidation of Privacy Shield, many companies are relying on the SCCs in order to continue transferring data of EU citizens to companies based in countries who are not deemed adequate for data transfer.
After the CJEU judgement, it is clear that these companies have to conduct Risk Assessments with the data recipients in these countries in order to ensure they have enough controls to mitigate any potential data or regulatory risk.
Key Features
On 2nd March, 2019, the Department of Health—Abu Dhabi (DoH), launched the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Standard. This is the first standard that aims to provide healthcare professionals and entities a comprehensive guide to the regulation of healthcare data in Abu Dhabi. This law ensures the highest levels of privacy and security of patients’ data, in line with international standards, is maintained.
Key Features
On January 31, 2020, the government of Saudi Arabia issued the Executive Regulations to the Saudi E-Commerce Law 2019 (“ECL”) that was in effect since October 2019. The Executive Regulations together with the ECL (“Law”) aim to protect consumers’ personal data by requiring organizations to take appropriate technical and administrative measures.
Key Features
Turkey was one of the first countries to start the trend of legislating data protection. Turkey published “Law on the Protection of Personal Data No. 6698 (LPPD) covering personal data protection on April 07, 2016.” The LPPD is based on the European Union Data Protection Directive 95/46/EC and has several similarities with the GDPR. It aims to give data subjects’ control over their personal data and outlines obligations that organizations and individuals dealing with personal data must comply with. The LPPD has also provided comprehensive guidelines for the transfer of personal data to the third parties.
Key Features
In December 2019, India, following several other countries' footsteps on the privacy laws' developments, introduced the Personal Data Protection Bill (PDPB) to regulate the processing, collection, and storage of personal data.
Key Features
The Irish Data Protection Act, 2018 (Irish DPA) implements the General Data Protection Regulation (GDPR) and transposes the European Union Law Enforcement Directive in Ireland. Since it incorporates most of the provisions from the GDPR and the Law Enforcement Directive with limited additions and deletions as per the national law, it is considered to be the principal data protection legislation in Ireland.
Key Features
The Personal Data (Privacy) Ordinance (Cap. 486) as amended in 2012 (the “PDPO) is the primary legislation in Hong Kong which was enacted to protect the privacy of individuals’ personal data, and regulate the collection, holding, processing, disclosure, or use of personal data by the organizations.. The Data Protection Principles ( the “DPPs or DPP ''), which are contained in Schedule 1 to the PDPO, outline how entities should collect, handle, disclose, and use personal data.
Key Features
In 2012, the Philippines passed the comprehensive privacy law, Data Privacy Act 2012 Republic Act. No, 10173 (the "DPA"). The DPA recognizes the rights of individuals to have more control over their personal data while ensuring a free flow of information to promote innovation and growth.
Key Features
The United Arab Emirates (UAE) has a Federal Telecommunication Law ( Federal Law) which requires that a company must hold a license in order to provide public communications services and operate public telecommunication networks. Under this Federal Law, a Telecommunication Regulatory Authority (TRA) was established which regulates the telecommunication sector in the UAE.
Key Features
South Korea has a general law and several special laws that cover data protection and individuals' privacy. South Korea's data protection regime is considered one of the strictest data protection regimes owing to its notification requirements, opt-in consent, extensive data subject rights, mandatory data breach notifications, and heavy sanctions in case of non-compliance.
Key Features
The Act on the Protection of Personal Information (the "APPI'') regulates personal related information and applies to any Personal Information Controller (the “PIC''), that is a person or entity providing personal related information for use in business in Japan. The APPI also applies to the foreign PICs which handle personal information of data subjects (“principals”) in Japan for the purpose of supplying goods or services to those persons.
Key Features
Qatar is the first gulf country that has passed a national data privacy law and has paved the way for all other gulf countries to follow suit. In 2016, Qatar enacted Law no. 13 Concerning Personal Data Protection (the “DPL”). Qatar became the first Gulf Cooperation Council (GCC) member state to issue an “European Style” applicable data protection law. The DPL establishes a certain degree of personal data protection, provides data subject rights, and prescribes the guidelines for organizations for the processing of personal data within Qatar.
Key Features
Bahrain has become a part of the countries that have enacted a data privacy regulation to protect the rights of their residents. On 12 July 2018, Bahrain drafted its law on data protection regulation, Law No. 30. This then went on to go into effect on the 1st of August 2019 as the Bahrain Personal Data Protection Law (PDPL) and supersedes all other laws. The PDPL recognizes the rights of individuals to have more control over their personal data and the needs of organizations to collect, use, or disclose personal data for legitimate purposes.
Key Features
After the Success of the California Consumer Privacy Act (CCPA) in California, Virginia is now following the same path. The Virginia Consumer Data Protection Act (VCDPA) has been passed and will go into effect on 1st of January 2023. This law is closely designed after the newer California Privacy Rights Act (CPRA) but with a few significant and important differences.
Key Features
After the VCDPA in Virginia, Colorado has closely followed suit and has passed their own comprehensive data privacy law to protect the personal data of the residents of Colorado.The Colorado Privacy Act (CPA) was signed into law on the 8th of July, 2021 and has been modelled closely after the VCDPA.
Key Features
