Campaign Studio enables users to be GDPR compliant.

Consent to data collection

Contacts that fall under GDPR requirements must consent to having their personal data collected and used for communication. Acquia recommends adding a checkbox on your Campaign Studio forms to allow contacts to opt-in. Use the following instructions to create an opt-in checkbox.

• Create a new Custom Field.
  • Can be a Boolean Field or a Select Field.
  • Label the field to internally mark a contact as opting in to receiving communication from you. For example: GDPR acceptance or GDPR opt-in.
• Edit an existing form or create a new form.
• On the Fields tab, add a Checkbox Group field.
• Add a Label to the field. The label displays on the contact record.
• On the Contact Field tab, map it to your newly created custom field.
• On the Validation tab, select Yes to require the field.

• On the Properties tab, add a label and value that are displayed next to the checkbox. For example, I agree to opt-in or I accept terms of communication.

  To add a link to a privacy statement, include it in the form label using an <a> tag. For example:

  

• Click Save & close.

By default, the checkbox is cleared. The contact must select it and submit the form to opt in. If this is a new form, add it to your Campaign Studio landing page or website. Acquia recommends updating existing forms with the new checkbox, to remain compliant.

Example screenshot of form field:

Contacts requesting information

Contacts have the right to see what data has been collected about them over time. Acquia recommends creating a standalone form on your website or at the footer of your emails that contacts can fill out to request their information. This form should at least include the following fields:

• Email address
• Request to view data collected (Add as a custom Boolean field)
• Request to be forgotten (Add as a custom Boolean field)

To build a form, follow the instructions at Forms. Acquia recommends setting up the following actions on the Standalone form:

• Send form results or Send Email to User to inform team members of the requests
• Modify Contact’s Segment to push these contacts in a specific GDPR segment

The benefit of adding the contacts into a GDPR segment means they can be reviewed or even communicated with at a later time.

The right to view data collected

To give the data to the contact, use the following steps:

• Search for the contact record by name or email address in the Contacts section.
• Stay on the Contacts page where the contact’s information is returned in the search results.
• In the upper right corner, select the down arrow and then click Export.

All data collected in Campaign Studio exports to a CSV file to your computer.

The right to be forgotten

Contacts have the right to request their data to be deleted. Campaign Studio allows users to delete contact records manually or through an automated process.

To delete a particular contact record from Campaign Studio and the database, perform the following steps:

Manual deletion

• Search for the contact record by name or email address in the Contacts section.
• Click the contact record who requested the data deletion.
• In the upper right corner, select the down arrow and then click Delete.

All data will be deleted about this contact record.

Automated deletion

• Create a segment using a filter with the Request to be deleted custom field. For more information, revisit Consent to data collection.
• Create a campaign using the segment as the campaign source.
• Create an action in the campaign of Delete Contact.

The campaign detects contacts who have requested deletion of their data (since they’ve been added to the Request to be deleted segment) and then deletes them in bulk.