Comply with GDPR requirements

The General Data Protection Regulation (GDPR) is the European Union’s new privacy law that harmonizes and modernizes data protection requirements. While there are many new or enhanced requirements, the core underlying principles remain the same. The new rules have a broad definition of personal data and a wide reach, affecting any company that collects personal information of individuals in the EU. Part of the regulation requires that individuals have the right to understand what personal data has been collected, and to have that data deleted upon request, when appropriate.

For the purpose of this article, the term User refers to a member of a company that sends agreements for Signature.  The term Signer refers to an individual that receives and either signs or rejects the agreement.  A privacy administrator is an Acrobat Sign account administrator with special controls for removing personal information from the service upon request of a Sender or signer.

User uniqueness is predicated on the email address used to identify the individual. A person that has multiple email addresses could have multiple discrete user IDs in the system. All GDPR controls in Acrobat Sign use email address to find and manage personal information.  There is no connection between the unique email addresses and an Administrator will only find data on the email address provided.

Features that support GDPR

Acrobat Sign offers features to help customers comply with GDPR. For more information on how Adobe protects your privacy, visit www.adobe.com/privacy.

Under GDPR, individuals have enhanced rights to request access, correction, and deletion of their personal information.

• Access – Most personal information about a User or a Signer can be accessed directly by that individual through Acrobat Sign UI.  There is a small amount of activity information that is not currently available directly.  An individual account holder will need to contact the Adobe Privacy office at Adobe.com/privacy to request access to this information.  An example of the report is included later in this article.
• Correction – All of the personal information that is collected on users or signers is available through the user interface.  If changes are required, the User or Signer can make the changes directly without contacting Adobe or their administrator.
• Deletion – There are different actions depending on the role played in the signing ceremony.  A User sending agreements must make the request to the company they are employed by.  Adobe cannot participate in this interaction and does not control the data the employer has collected in the course of doing business.  The signing process collects a minimal amount of information about a signer during the ceremony.  This includes Name, email address, IP address and, optionally, phone number and OTP code.  This information is stored with the agreement with their signature and is controlled by the company that sent the agreement.  If a Signer needs information concerning the personal information collected with that agreement, they need to contact the Sender of the agreement.  Adobe, as a data processor, cannot provide any information to the Signer about the agreement or the company that sent them the agreement. Since the only information saved about the Signer is in the Agreement, deleting the Agreement deletes the Signer’s personal information.  If the Sender agrees to delete the Signer’s information, they use the privacy menu to find and delete the agreements where the Signer was a participant.

In terms of the Acrobat Sign toolset, there are three features in place:

• User level logs - A log of the various events (that include personal information) triggered in the Acrobat Sign environment
• Agreement Deletion - Privacy Administrators have authority to view and delete any agreement created by any user within their account.
• User Deletion - Privacy Administrators have the authority to delete any user within their account.

User level logs

Any user can make a request to the Adobe Privacy Center to provide the log of their activities in the Acrobat Sign system that include private information.

That information is returned in the form of a CSV containing:

• The date of the event
• The event type
• The IP address from which the event was triggered

Agreement Deletion

Applicable only to agreements sent by users under the authority of the Privacy Admin.

When a Signer makes a request to have their information removed from the Acrobat Sign system, the account Privacy Admin can search against the user's email address, and return all the agreements that email address participated in and that were created in the Admin’s account.

If the Privacy Admin determines that the agreement is no longer needed, he can delete it, wholly and irrevocably, from the service.

Recipients that contact Acrobat Sign will be directed to review their Manage tab, and contact the company that originally created the transaction for the purpose of deleting the agreement.

Acrobat Sign, as a data processor of the Customer, will never delete an agreement at the request of a recipient.

User Deletion

Applicable only to users under the authority of the Privacy Admin

When an employee requests their information to be deleted from your systems, this tool completely deletes all the user's Information from the Acrobat Sign servers. 

Users must make this request to the account Privacy Admin directly. Only the Privacy Admin has the authority to delete users.

Acrobat Sign support cannot delete users from an account, and if requested to do so, will refer the user to the account admin.

How users can request that their data be removed from Acrobat Sign

Having personal information deleted from the Acrobat Sign system requires that the assets of the user be properly resolved.  This process varies depending on the type of user/account involved, which can be grouped into four categories:

Delete a user's information

Deleting a user from the Acrobat Sign server requires that you first have system authority over that userID. If the user is not in your account, you do not have any authority to delete them.

To determine if the user is under your authority:

Delete a user's agreements

Verify the email address is correct, and that you are about to delete the correct userID. 

Once the userID is deleted, it is irrevocably gone.

Delete a user's agreements

GDPR asserts that users (signers typically) have the right to have all records containing their personal information deleted from systems that no longer have a business need to retain it.

Within the context of Acrobat Sign, this means that the user must contact the company they have signed documents with to evaluate the documents in the system and delete them if appropriate.

A privacy admin must be nominated from the Account admins in the account, granting them the authority to view all agreements and delete them as needed.

The process to comply with GDPR is straightforward, and the decision to delete or retain the agreements rests solely with the privacy admin for the account.

To review and delete a users content:

Enable an admin as a privacy administrator

Access to the Privacy page is limited to Privacy Admins. 

Only when the user is flagged as a Privacy Admin will they have access.

To enable Privacy admin:

Adobe Privacy Center

Any request for action that is not supported by the tools within the user interface, or questions regarding GDPR compliance, must be submitted to the Adobe Privacy Center.

Support and Success agents do not have access to the tools that delete content from the servers.