Table of Contents


Defining client-based access controls to support the EU GDPR

You can define client-based access controls (CBAC) to comply with the data privacy requirements of the European Union (EU) General Data Protection Regulation (GDPR) and similar regulations in your application, if required. This configuration allows you to protect customer data by tracking and processing requests to view, change, remove, and restrict the use of personal data.

Pega Customer Service provides an Exercise Customer Data Rights service case to support the General Data Protection Regulation and similar regulations. You can access this service case after defining the client-based access controls in your application. These controls are part of the supporting infrastructure that helps customer service representatives to manage Customer data rights requests and allows customers to directly manage their data through the self-service web application. For more information about how Pega applications are supporting GDPR, see Supporting EU GDPR data privacy rights in Pega Infinity with client-based access control.

To access the Exercise Customer Data Rights service case, complete the following steps.

  1. Create an operator specific to the GDPRCSAdmin access group that is responsible for defining CBAC rules. This operator is used for GDPR processing and is not related to a CSR operator.
    The GDPRCSAdmin access group is created automatically when you create your Customer Service application.
  2. To authenticate the operator, configure the GDPR-specific operator with the GDPRBasicAuth rule. For more information on authentication scheme planning, see Authentication in Pega Platform.
  3. Define client-based access controls (CBAC) for the Pega database. For example, Contact, Account, Address data, and Address change. Default CBAC rules are provided with Pega CRM.
    1. Contact your legal counsel to determine the client-based access controls for making revisions, based on the interpretation of the regulation, assessment of the valid business purposes for storing and using client data, and assessment of competing legal requirements in your industry and country or jurisdiction.
    2. Identify the personal data that your application stores in the Pega database that is not known to the default Pega CRM applications.
    3. Create client-based access controls for each property. For more information on defining CBAC rules, see Defining client-based access control rules.

The customer service representative who is part of the GDPRCSAdmin access group is now able to help your customers to control their personal data.

Published August 8, 2018 — Updated October 11, 2018

Related Content

Have a question? Get answers now.

Visit the Pega Support Community to ask questions, engage in discussions, and help others.