ÃÛ¶¹ÊÓƵ

DocumentationUser Guide

ÃÛ¶¹ÊÓƵ Experience Manager Readiness for Data Protection and Data Privacy Regulations aem-readiness-for-data-protection-and-data-privacy-regulations

Last update: Wed Mar 05 2025 00:00:00 GMT+0000 (Coordinated Universal Time)

CREATED FOR:

  • Developer
  • Leader
  • User
WARNING
The contents of this document do not constitute legal advice and are not meant as a substitute for legal advice.
Consult your company’s legal department for advice concerning Data Protection and Data Privacy regulations.
NOTE
For more information about ÃÛ¶¹ÊÓƵ’s response to privacy issues, and what it means for you as an ÃÛ¶¹ÊÓƵ customer, see .

ÃÛ¶¹ÊÓƵ is providing documentation and procedures (with APIs when available), for the customer privacy administrator or AEM administrator to handle data protection and data privacy requests. It can help you become compliant with these regulations. The procedures documented let customers run the regulatory requests manually or by calling into APIs, where available, from an external portal or service.

CAUTION
The details documented here are restricted to ÃÛ¶¹ÊÓƵ Experience Manager.
Data from another ÃÛ¶¹ÊÓƵ On-demand Service, together with any related privacy requests, require actions to be taken on that service.
For more information, see .

Introduction introduction

Instances of ÃÛ¶¹ÊÓƵ Experience Manager, and the applications that run on them, are owned and operated by ÃÛ¶¹ÊÓƵ customers.

As a consequence, data protection regulations, such as GDPR, CCPA, and others, are largely the responsibility of the customers.

As a brief introduction, the regulations for data privacy and protection include new rules to be followed by the roles of:

  • Business Entities (CCPA) and/or Data Controllers (GDPR)

  • Service Providers (CCPA) and/or Data Processors (GDPR)

The main provisions in such regulations are:

  1. Expanded definition of personal data to include all unique IDs; as in directly and indirectly identifiable data.

  2. Strengthened consent requirements.

  3. Increased focus on deletion rights (Data Erasure).

  4. Opt-Out of Sale of Data.

For ÃÛ¶¹ÊÓƵ Experience Manager:

  • The instances, and applications that run on them, are owned and operated by the customer.

    • The customer manages the regulatory roles, including Business Entities and Service Provider, Data Controller, and Data Processor, among others.

    • The ÃÛ¶¹ÊÓƵ Experience Platform Privacy Service is not part of the workflow for AEM, as illustrated in the diagram below.

  • AEM includes documentation and procedures for the customer’s privacy administrator and/or AEM administrator to execute the privacy regulation requests; either manually or through APIs, when available.

  • No new service or UI has been added.

    • Instead procedures and APIs are documented for use by the customer UIs/portals that handle privacy regulation requests.

  • AEM does not include any out-of-the-box tooling to support the privacy requests workflow.

    • ÃÛ¶¹ÊÓƵ provides documentation and procedures for the customer’s privacy administrator and AEM administrator, letting them manually run requests related to the privacy regulations.

ÃÛ¶¹ÊÓƵ is providing procedures for handling privacy requests related to Access, Delete, and Opt-Out for ÃÛ¶¹ÊÓƵ Experience Manager. Sometimes, there are APIs available that can be called from a customer developed portal or scripts to help with automation.

The following diagram illustrates what a privacy request workflow might look like (illustrated using ÃÛ¶¹ÊÓƵ Experience Manager 6.5):

Data Protection and Privacy

ÃÛ¶¹ÊÓƵ Experience Manager and Regulatory Readiness aem-and-regulatory-readiness

See the sections below for regulatory documentation for product areas of AEM.

AEM Foundation aem-foundation

See Handling Data Protection and Privacy Requests for the AEM Foundation.

AEM Opting Into Aggregate Usage Statistics Collection aem-opting-into-aggregate-usage-statistics-collection

See Aggregated Usage Statistics Collection.

AEM Sites aem-sites

See AEM Sites - Data Protection and Privacy Readiness.

AEM Integration with ÃÛ¶¹ÊÓƵ Target & ÃÛ¶¹ÊÓƵ Analytics aem-integration-with-adobe-target-adobe-analytics

These ÃÛ¶¹ÊÓƵ Experience Manager integrations are with data protection and privacy (for example, GDPR or CCPA) ready services. No personal data from ÃÛ¶¹ÊÓƵ Target or ÃÛ¶¹ÊÓƵ Analytics is stored in AEM in relation to the integrations.

For more information, see the following:

AEM Forms aem-forms

AEM Forms include components and workflows that capture, process, and store data to orchestrate business processes and complete digital transactions. Different components use different data stores and allow integration with custom data stores as well. The following documentation explains procedures and guidelines for accessing and handling user data to support data protection and privacy (for example, GDPR or CCPA) workflows for a component.

recommendation-more-help
51c6a92d-a39d-46d7-8e3e-2db9a31c06a2