General Data Protection Regulation (GDPR) For the product ID: 5737-I37

Notice

This document is intended to help you in your preparations for GDPR readiness. It provides information about features of that you can configure, and aspects of the product's use, that you should consider to help your organization with GDPR readiness. This information is not an exhaustive list, due to the many ways that clients can choose and configure features, and the large variety of ways that the product can be used in itself and with third-party applications and systems.

Clients are responsible for ensuring their own compliance with various laws and regulations, including the European Union General Data Protection Regulation. Clients are solely responsible for obtaining advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulations that may affect the clients' business and any actions the clients may need to take to comply with such laws and regulations.

The products, services, and other capabilities described herein are not suitable for all client situations and may have restricted availability. HCL does not provide legal, accounting, or auditing advice or represent or warrant that its services or products will ensure that clients are in compliance with any law or regulation.

1. GDPR

General Data Protection Regulation (GDPR) has been adopted by the European Union ("EU") and applies from May 25, 2018.

Why is GDPR important?

GDPR establishes a stronger data protection regulatory framework for processing of personal data of individuals.

GDPR brings:
  • New and enhanced rights for individuals
  • Widened definition of personal data
  • New obligations for processors
  • Potential for significant financial penalties for non-compliance
  • Compulsory data breach notification

Read more about GDPR: EU GDPR Information Portal

2. Product Configuration for GDPR

The GDPR legislation requires that personal data is strictly controlled and that the integrity of the data is maintained. This requires the data to be secured against loss through systems failure and also loss through unauthorized access, or via theft of computer equipment or storage media.

The collects user ID & passwords locally on a user’s workspace to be used for future logins to connected services. These passwords are encrypted using Eclipse's Secure Storage mechanism. .

To ensure this data is strictly controlled and the integrity of the data is maintained the user can choose to “not save the password” which will result in no password metadata to be saved in the user’s workspace.

Users can also employ the use of smartcards and SSL certificates to control the location their credentials are stored.

3. Data Life Cycle

Only when a user has requested that their Personal ID & password is saved, is this personal data available to use when a user logs into a connected service that requires these credentials.

4. Data Storage

All fields are stored on the user’s computer using Field Level Encryption. This content is encrypted using Eclipse's Secure Storage mechanism. For more information, see Secure storage.

5. Data Access

Only the user/owner of the computer has access to the workspace where data is stored.

6. Data Processing

All personal data is encrypted as it is exchanged with other services. During a support call, an RSARTE user could choose to add an email to be informed of updates from support, these emails are not encrypted.

7. Data Deletion

A user can choose to “not save the password” which will result in no password metadata being saved in the user’s workspace, ultimately removing any metadata that might have been previously saved.

8. Data Monitoring

Logs are maintained on the user’s workspace. Optional email address to support may be available in dumps.

9. Responding to Data Subject Rights

The user has control of their environment and could choose to delete or move their environment which could include their stored encrypted password.