Share Data with Portability Policies

Data privacy laws, such as the General Data Protection Regulation (GDPR), give individuals the right to confirm whether their personal data is processed by a data controller, as well as how and why their data is processed. These rights are collectively referred to as the right to access. Similarly, with the right to portability, individuals can request that the data controller share the processed data in a structured, commonly used, and machine-readable format.

You can address data subject access requests by running a portability policy from Privacy Center, or you can execute a Portability API call. Both options return a link to a file with the customer’s PII compiled.

Alternatively, use the Privacy Request object to manage data requests. Build triggers and flows to receive and execute requests, and then share the results of the request response with the data subject. Incorporate the Privacy Request object into your reports and dashboards to gain insight into the data subject access requests that your org receives. For more information, see Salesforce Developers: PrivacyRequest.

• Portability Policy Considerations and Limitations
  When handling data subject access requests and creating and using portability policies, there are guidelines and limitations to consider.
• Create a Portability Policy
  Use Portability policies to compile data from both default and custom objects linked to the Individual, Account, Contact, Lead, or User objects. You can select individual fields on these objects that contain the data subject’s PII for inclusion in the policy. The fields are then compiled into a file.
• Use Portability Policies to Execute a Data Subject Access Request
  Execute data subject access requests from Privacy Center. Run portability policies to identify and compile relevant customer data.
• Monitor Data Subject Access Requests in the Portability Log
  After you run a portability policy to address a data subject access request, monitor the status and results of your request.
• Use the Portability API to Execute a Data Subject Access Request
  Instead of using Privacy Center to run a portability policy, you can collect PII for a data subject access request with the Portability API.