GDPR Controls Setup

GDPR Controls Setup

This guide walks you through privacy controls that can support GDPR-oriented data handling in Mobyform forms. It is not legal advice and does not guarantee that your organization or a specific form is GDPR compliant.

Before You Begin

GDPR may apply if you collect personal data from individuals in the European Economic Area (EEA). Even if your organization is based outside the EU, GDPR can apply when you process data of EU residents.

Key GDPR principles that affect form design:

• Lawfulness — You must have a legal basis for collecting data
• Purpose limitation — Data must be collected for a specific, stated purpose
• Data minimization — Only collect data that is necessary
• Storage limitation — Do not retain data longer than needed
• Accountability - You must be able to demonstrate appropriate practices

Step 1: Enable Privacy Consent

Add a consent mechanism to your form so respondents explicitly agree to data processing.

1. Open your form in the editor
2. Go to "Form Settings" → "Privacy"
3. Enable "Privacy Consent"
4. Configure the consent options:

Example consent text:

I consent to the collection and processing of my personal data
as described in the Privacy Policy. I understand I can withdraw
my consent at any time.

Step 2: Mark Sensitive Fields

Identify and mark fields that collect sensitive personal information. Marked fields receive additional access controls and encryption.

1. In the form editor, click on a field that collects personal data
2. Open the field's "Advanced Settings"
3. Enable "Sensitive Field"
4. Select the sensitivity category:

Sensitive fields are:

• Encrypted at rest in the database
• Masked in the data management panel (e.g., john***@email.com)
• Excluded from data exports unless explicitly included by an admin
• Logged whenever accessed

Step 3: Set Data Retention Policy

Configure how long form submission data is retained.

1. Go to "Form Settings" → "Data Retention"
2. Choose a retention policy:

3. Set the retention period if using "Custom Period"
4. Enable "Notify Before Deletion" to receive a warning before data is purged

Data scheduled for deletion can be reviewed and extended if needed before the retention period expires.

Step 4: Configure Lawful Basis

Specify the legal basis under which you are collecting and processing data.

1. Go to "Form Settings" → "Privacy" → "Lawful Basis"
2. Select the applicable basis:

For most forms collecting voluntary responses, Consent is the appropriate basis.

Step 5: Set Up Data Subject Request Handling

GDPR grants individuals rights over their data. Configure how these requests are handled.

1. Go to "Settings" → "Privacy" → "Data Subject Requests"
2. Enable the request portal
3. Configure handling for each right:

When a data subject request is received:

1. The system logs the request with a timestamp
2. The assigned admin is notified
3. The admin reviews and processes the request
4. A confirmation is sent to the requester
5. The action is recorded in the audit log

Step 6: Run a DPIA Assessment

For forms that process high-risk data (large-scale processing, sensitive categories, systematic monitoring), a Data Protection Impact Assessment is recommended.

1. Go to "Settings" → "Privacy" → "DPIA"
2. Click "New Assessment"
3. Complete the assessment questionnaire:
   • Describe the data processing activity
   • Identify the necessity and proportionality of processing
   • Assess risks to individuals' rights and freedoms
   • Document mitigation measures
4. Save the assessment so it is stored with your privacy records

When DPIA Is Required

• Forms collecting health or biometric data
• Large-scale surveys targeting a broad population
• Forms that combine data from multiple sources
• Automated decision-making based on form responses

Step 7: Configure Breach Notification

Set up automated notifications for handling potential data breaches.

1. Go to "Settings" → "Privacy" → "Breach Notification"
2. Configure the notification settings:

When a breach is reported:

1. An internal alert is sent immediately to the privacy officer
2. The breach is logged with date, scope, and affected data types
3. If high risk, the authority notification template is prepared
4. Affected individuals are notified with clear language about the breach and recommended actions

Audit Logs

Privacy-related actions are automatically logged and cannot be modified or deleted:

• Consent collection and withdrawal events
• Data access, modification, and deletion actions
• Data subject requests and their resolution
• DPIA assessments and updates
• Breach notifications and responses
• Admin access to sensitive fields

Access the audit log from "Settings" → "Privacy" → "Audit Log".

Compliance Checklist

Use this checklist to verify that key privacy controls have been configured:

• Privacy consent enabled with clear consent text
• Privacy policy linked in the consent section
• Sensitive fields identified and marked
• Data retention policy configured
• Lawful basis selected and documented
• Data subject request handling configured
• DPIA completed for high-risk forms
• Breach notification set up
• Team members trained on GDPR procedures

Next Steps

• GDPR Controls Reference - Detailed reference for privacy controls
• Data Management — Manage, export, and delete form data
• Collaboration — Control team access to sensitive data