Introduction to Data Inventories for GDPR – how to document your Pardot data.

It’s not news that GDPR comes into effect next month (25th May 2018), and surprisingly, many organisations confess to not being as prepared as they had hoped. The new regulation requires a data management review across all corners of the business that has sent people into a flurry – Where to start? What to prioritise?!

Although marketers are not the only ones that are affected, we are finding ourselves in the spotlight when it comes to data capture, privacy permissions and communication preferences. When it comes to technology, GDPR compliance requires customisations on the Salesforce side to do the ‘heavy lifting’ with personal data processing at scale. However, there is one key piece of the data management tech stack that marketers should be aware of: the Data Inventory.

This post will cover:

  • What is a Data Inventory?
  • Why businesses need a Data Inventory
  • Generating a Data Inventory for your Pardot Data

This post is an extension from the ‘Salesforce GDPR Sprint’ series by GDPR guru Ian Gotts to include what Pardot users should know – including the content of this post. If you would like to read the full rundown on Data Inventories, you can find more here: Salesforce GDPR Sprint (Part 2): How to manage GDPR Data Requests.

What is a Data Inventory?

A Data Inventory is a copy of your Salesforce metadata. Metadata is ‘data about data’ – contextual information about the data’s purpose, reason for storing it, when it was last updated, and its type/category.

Why you need a Data Inventory

As GDPR requires that you can justify why you are holding specific personal data, and only for the required length of time (plus some other information). A data inventory documents this nicely with extra “fields about fields’.

So, for every field in your database you need to store if it holds Personal Data or Special Personal Data, and if so the legal basis, the purpose, the retention period, and the source and recipient of the data.

I’m guessing marketers are familiar with the 6 Subject Access Requests (Articles 15–21) at this stage, granting people additional rights to their data, such as Right to Subject Access Request, Right to Rectification, and Right to Erasure (the most dreaded of them all). When the business receives one of these requests, how can this be actioned efficiently?

Although GDPR allows an organisation 30 days to action one of these Requests, you cannot sit back and let the requests flood in. Not only will these requests come in unpredictable volumes, but it will be highly inefficient to address each request, field-by-field. If it’s exceptionally busy, you don’t want to get snowed under.

In comes the Data Inventory, where you can pinpoint where personal data is being stored, and further pull the information quickly for processing, eg. using an installed 3rd party app to delete data at scale – a far more accurate and sustainable process.

Generating a Data Inventory for your Pardot Data

So far, I’ve referred to Salesforce metadata, but if you are holding personal data in Pardot, you need a data inventory of your Pardot account too. You can create a one manually in a database such as Excel, but this is clearly not a solution for the long-term. Consider how often fields are added, removed or modified in Pardot (both Prospects and Prospect Accounts), and how tedious this would make the admin to keep a standalone data inventory up-to-date.

To save this hassle, look to the Salesforce Ecosystem for solutions. One Data Inventory provider that I am familiar with is Elements.cloud; their integration for Salesforce does a metadata sync nightly, meaning new and modified fields are ready for the Admin to categorize, using a dropdown menu (seen in below image). While the image shows a Salesforce data inventory, there is also a utility to generate a data inventory of Pardot metadata, giving more visibility and control for organisations with frequently changing fields and/or many Pardot users.Above: an example of a Data Inventory, this one is developed by Elements.cloud.

Summary

This post has covered Data Inventories and how they are essential for GDPR compliant data processing. It’s essential that marketers are aware of what data inventories are, why their businesses need them, and options for creating your own Pardot data inventory – even though we are in the spotlight, we need to know how the back-office can support our responsibilities. The impact of responding to the GDPR Requests should not be underestimated – you never know who will come knocking with what request.

As I mentioned, this post has been extended from the ‘Salesforce GDPR Sprint’ series by GDPR guru Ian Gotts – you can find the full story here:Salesforce GDPR Sprint (Part 2): How to manage GDPR Data Requests, and all the live posts here.

BONUS: access Ian’s documented the processes to respond to the GDPR Requests: elements.cloud/gdpr