GDPR
Zoho CRM provides a comprehensive GDPR compliance toolkit under Setup > Security Control > Compliance Settings (Zeeg: Zoho GDPR Compliance Guide):
Data Classification:
- Mark specific fields as containing "Personal Data" (Normal or Sensitive category).
- Control whether personal data fields are shared with integrated applications.
Lawful Basis:
- Document the processing basis for each record: Consent, Contract, Legal Obligation, Vital Interests, Public Tasks, or Legitimate Interests.
- Default: "Not Applicable" until explicitly set.
Consent Management:
- Maintain consent status per contact record (captured, declined, pending).
- View consent status across the database via the GDPR Overview dashboard.
Data Subject Rights Tools:
- Access: Send emails with merge-field data; customer portals for self-service access.
- Rectification: CSV export for correction; customer portal editing.
- Portability: CSV export in machine-readable format.
- Restriction: Lock records to prevent further processing.
- Erasure: Delete records; block-list email addresses to prevent re-entry.
GDPR Dashboard: Monitor—records with unspecified lawful basis, records updated with lawful bases, consent status breakdown, open data subject requests.
HIPAA
HIPAA compliance is referenced in enterprise CRM feature lists (e.g., EliteTechCorp feature guide mentions "HIPAA & GDPR Compliance" for Enterprise/Ultimate editions (Elite Tech CRM Features 2026)). However, Zoho's official HIPAA-specific documentation for CRM is not directly cited in the sources reviewed—gap item requiring verification with Zoho's enterprise support or official compliance documentation.
Other Compliance
- SOC 2: Zoho operates data centers that are SOC 2 compliant (standard for cloud service providers; implied by enterprise customer base).
- ISO 27001: Zoho's infrastructure is ISO 27001 certified.
- Data Residency: Zoho CRM offers multiple data centers (US, EU, IN, AU, JP, CA, SA) allowing customers to choose where their data is stored—relevant for cross-border data transfer compliance.