we protect it. We have your data. We protect it. But you hold the - PowerPoint PPT Presentation

We have your data, and we protect it.

We have your data. We protect it. But you hold the key.

COMPANY CONSUMER PORTAL DATA SOURCES DATA SUBJECT TOUCH POINTS INGEST SHOW ME MULTI-POS ALL DATA MY DATA CENTRALIZED DATA ECOMMERCE CHANGE API SERVICES ✓ Transf ransfer ✓ View CRM/ERP FULFILL MY DATA PHYSICAL & DIGITAL ✓ Fo Forge rget ✓ Co Cons nsent TOUCH POINTS REQUESTS ANALYTICS ✓ Co Conte ntest ANYTHING… AUDITABLE SECURE LEDGER

Regardless of where they come from, all Data Subjects are directed to your dedicated, branded portal: e.g. CONSUMER privacy.YourCompany.com TOUCHPOINTS PHYSICAL POS ECOMMERCE CALL CENTERS MOBILE APPS KIOSKS ANYWHERE…

Canada Australia US / California Japan

• Country-specific changes (e.g. Ireland’s 7 day response) • Clarifications and Rulings (e.g. Reporting Requirements, Data Portability)

GDPR CCPA Privacy Policy Updates Breach Notifications There is an existing breach notification law in CA Right to be Forgotten Delete my personal data Right to Restriction of Processing Global opt-out AND Do Not Sell My Information Right to Object Automated Decision Making At or before the At or before the Notification of Collection point of point of collection collection Download my Data Not specified Does not require Does not require account to make a request Account Only privacy policy Clear requirements Website language requirements on language for home page

✓ These are not built for the changing landscape of privacy: New legislation. Country-specific differences (e.g. Ireland) and clarifications in law, implementation or precedent. ✓ ▪ ▪ ▪ ▪ ▪

✓ ✓ https://privacy.apple.com ✓ ✓ ✓ ✓

[Link] May 25, 2018

Email/ LDAP/AD/ 3rd Party CAPTCHA ID Upload SMS SAML / Services OAUTH Verification

✓ ✓ ✓ ✓

Support deletion of specific ✓ data elements or groupings (Primary Action). “Delete All Data” is a ✓ Secondary Action Remind users of ✓ Services they may lose Value they may lose (loyalty points) Encourage Anonymize ✓ over Delete

✓ The API/routine should tie back to ✓ Realize conflict between absolute your Privacy Tasks to auto-alert deletion of user data and data source owners to delete ensuring they stay deleted records ✓ Consider creating an API and/or ✓ Maintain deletion requests via automated routine to help catch 3 rd parties to legitimately claim “forgotten” data elements before deletion of data you accidentally use them

✓ Report: Request types , results , and response timeframes ✓ Lots of “gray area”: Remember to budget IT hours to scope and maintain adherence to changes in requirements

✓ ✓

Data Subject TO: privacy@brand.com DATE: 5/25/18 SUBJECT: Request for data Hello, Please tell me the information you have on me as I would like the right to modify or delete some or all of it. Under the GDPR, you have one month to comply. Thanks, Nancy Melbourn

DPO Data Subject How do I handle this in way that I can prove if we get sued or fined? TO: privacy@brand.com What kind of request is this exactly? How do I process it? Do I need to process it? DATE: 5/25/18 SUBJECT: Request for data I have 80 backend systems. How do I find her data in each? Hello, How do I deliver her data to her in a way she can understand it? Please tell me the information you have on me as I would like the right to modify or delete How would I delete her data across all of those systems? some or all of it. Under the GDPR, you have one month to comply. How will I respond to this in time? Thanks, Is this really Nancy? Is it SPAM? Is it a fraud attempt? Nancy Melbourn I just got 1,000 requests just like this. How do I manage all of those?

3 General Strategies ✓ ✓ ✓

3 General Strategies x {# of SARs} ≤ 50 ✓ {# of systems} ✓ /month ✓

3 General Strategies PROS: Does not require copying data ✓ CONS: Processor-heavy: Puts on-demand, computational stress on all data sources ✓ Rigid: Schema embedded in multiple APIs Unpredictable. You never know what the API is going to return ✓ Difficult to Sell Internally: Level of difficulty to add a system is relatively high

3 General Strategies Pros: ✓ Enables BI, AI and other “layers” to the Analysis stack (Similar to Blockchain) ✓ Eliminates stress on day-to-day business ✓ Data Lake Vs. Data Warehouse Capturing “rogue” data

Phase 1: AUTOMATE SARS Working with an API lets you render • any data element in an understandable format. Virtually eliminates ops overhead for • data ingestion and rendering Consider grouping data into • “functional areas” and data groupings. Maintain ability to supplement with • manual processes and CSV/file upload

Phase 2: Automate “Denies”

Phase 2: Automate “Denies”

Phase 3: Automate “Changes” Costly, but worth it Will your tools support it? (e.g. Wordpress) Pre-built Integrations and “Connectors”

Email: hello@Truyo.com Subject: Roadshow offer ✓ ✓ ✓ ✓ ✓ ✓ ✓

For more info: hello@truyo.com