General Data Protection Regulation (GDPR)
The future of data privacy is now, and it’s going global
The General Data Protection Regulation (GDPR), is an updated European privacy and data protection law, that came into force on May 25, 2018. GDPR re-emphasizes and reinforces existing data protection principles in the European Union (EU). GDPR also adds new rules that are designed to expand legal and privacy rights protections for EU citizens.
As a leader in the application performance monitoring and business intelligence space, AppDynamics understands the value and importance of effectively leveraging data to solve modern business problems. AppDynamics also respects the need to protect data and to comply with data protection rules, especially when it comes to personal data and the rights of individual data subjects.
AppDynamics has welcomed GDPR as an important update to the global view on privacy, data protection, and cybersecurity.
In addition, AppDynamics partners with its parent company, Cisco Systems, Inc. (“Cisco”) to ensure AppDynamics’ privacy program is aligned with Cisco’s Data Protection and Privacy program.
Key features of GDPR
Enhanced data subject rights
Consent - Consent must be specific, informed, freely given, and an unambiguous indication of the data subject’s consent to the processing. Data subjects can withdraw consent at any time and must be able to do this as easily as it was to give consent.
Right to erasure - Data subjects have the right to require a data controller to delete personal data where the data controller does not have a legitimate ground to retain the data.
Privacy and data impact assessments
Privacy by design and by default
Privacy issues must be considered and addressed at the design phase of products, websites, and other systems that process personal data, and specific privacy-minded functionality must be designed into offerings. Products must be provided to data subjects with the most privacy-favored functionality turned on by default.
Incident response and breach notification
GDPR requires data controllers to notify the relevant Data Protection Authority/ies within 72 hours of a breach affecting personal data, unless the breach is unlikely to result in a risk to the rights and freedoms of the natural persons; and any impacted data subjects without undue delay when a high risk to rights and freedoms is likely. Data processors must notify data controllers of a data security breach without undue delay.
Data processor’s liability
Appointment of Data Protection Officer (DPO)
AppDynamics is committed to GDPR and to its customers’ privacy
AppDynamics and Cisco are acutely aware of GDPR and its implications both for AppDynamics and for its customers. During the lead up to May 25, 2018, AppDynamics established an internal, cross-functional team to manage this important project, with executive sponsorship from both AppDynamics’ Chief Information Security Officer and AppDynamics’ General Counsel.
Here are some highlights of the key GDPR readiness work that AppDynamics’ cross-functional Privacy team tracked and continue to closely monitor for ongoing compliance:
AppDynamics continues to maintain a comprehensive security program and organization that is supported by leadership who are committed to proactively managing privacy and cybersecurity risk.
Product Management, Security, and Legal team leadership have launched a cross-functional privacy team charged with reviewing and optimizing processes around the business to ensure AppDynamics is always ready to comply as well as developing a privacy by design infused engineering road map to support product development.
AppDynamics teams partner with their Cisco counterparts on information security and privacy initiatives. AppDynamics leverages Cisco’s industry leadership and Cisco provides an additional governance layer for AppDynamics.
AppDynamics demonstrates its focus on protecting customer information by maintaining SOC 2 certification.
Data review and risk assessment
AppDynamics’ Privacy team continues to perform privacy impact assessments on all customer-facing products, as well as refreshing its understanding of data flows within its products and in its internal business.
AppDynamics’ Privacy team created and maintains Product Information Data Sheets that detail the data collected and processed by each AppDynamics product.
Ensuring appropriate data transfer mechanisms
The AppDynamics Legal team launched a set of updated data transfer agreements to support new and existing customers and is working hard to update data transfer agreements where appropriate.
AppDynamics’ Privacy and Legal teams continue to monitor possible implementation of legally-recognized alternatives to EU Model Clauses and data transfer agreements.
Accounting for and managing third-party risk
Privacy and security by design/default
AppDynamics regularly reviews, updates and tests its incident response policy, operational program, and relevant training materials with the new GDPR overlay in mind.
Additional information on AppDynamics’ privacy practices and program
AppDynamics engages third-party service providers to support the availability and data processing activities of its products and related services.
International data transfers
AppDynamics complies with applicable law with respect to international transfers of personal data. Where a customer’s use of AppDynamics products and services requires the transfer of personal data to a location outside the European Economic Area, AppDynamics employs the following legally-recognized data transfer mechanisms: the EU-US Privacy Shield, the Swiss-US Privacy Shield, and Standard Contractual Clauses (also commonly referred to as EU Model Clauses).
AppDynamics Privacy Shield certification
Cisco participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. AppDynamics is committed to subjecting all personal data received from European Union (“EU”) member countries and Switzerland, respectively, in reliance on each Privacy Shield Framework, to the Framework’s applicable Principles. To learn more about the Privacy Shield Frameworks, and to view AppDynamics' certification, visit the U.S. Department of Commerce’s Privacy Shield List at https://www.privacyshield.gov.
Security program and certification
AppDynamics is committed to providing strong levels of security assurance for its customers, partners, and community. Through the development of its cross-functional security program, AppDynamics employees are working hard to ensure the security of its software products and services and systems that AppDynamics leverage to operate its company.
Performing a privacy or data impact review of AppDynamics’ products? AppDynamics provides product data sheets to enable customers to learn more about what data may be collected and processed by AppDynamics products.