Configure regulation (by country/region)
Access Type: Regulations Manager - Editor
A regulation is a configuration of data collection practices by your organization which includes aspects such as vendors and purposes used, applicable regions, industry and legislative frameworks, etc... The regulation is used in conjunction with a widget when publishing a privacy flow to your website or application.
In this article, we provide an overview of the configuration steps available when setting up a regulation that uses the country or region as the data collection scope.
To start, click Regulations Manager on the left-hand panel.
Select Create regulation.
Data collection scope by country/region overview
The data collection scope refers to the entity that determines the entity that is determining the processing rules for the collection of end-user data. By selecting country/region as the data collection scope, your organization is setting the processing rule for a purpose within the regulation based on the end-user's location using a country/region x purpose matrix.
This option gives your organization the ability to control the processing rule for a purpose based on the legal jurisdiction of the end-user (e.g. the same purpose can require a different processing rule if the end-user is in Colorado vs if the end-user is in California) and is tailored for U.S. privacy laws and other markets where the law sets the processing rule and not the individual vendor.
Note: By default, the regulation will have the Google Consent Mode v2 framework enabled.
On the subsequent page, select the radio button within the By country or regions card and click Create regulation.
A new regulation will be generated using a data collection scope by country/region. Use the provided field to edit the name of the regulation.
Global settings
The global settings of the regulation manager enables your organization to set applicable regions, consent settings, and frameworks for the regulation.
Regions
The regions section of the global settings page allows your organization to set the country/region/state where the regulation is applicable. By including a country/region/state in this section your organization will show end-user's in these locations a widget and collect their consent for data processing.
Manage the countries/regions/states for a regulation by clicking Select Countries/Regions.
Expand the accordions and select the country/region/states that should be included in the regulation. Selected regions will be highlighted.
Click Add Selection when finished.
Consent settings
The consent settings section of the global settings page is where your organization configures the duration and frequency in which end-user consent is stored and collected. Use the provided fields for each setting to configure the duration or frequency.
Generic Duration
Length of the time your organization will store an end-user's consent
Denied Consent Duration
Length of time your organization will wait to re-collect end-user consent when they deny all purposes and vendors that utilize consent as a processing rule
Recollect After a Date
Specify a date after which the widget will be re-displayed to the end-user and their consent re-collected
Window for Re-collecting
Number of days after a vendor or purpose is added to the regulation and the flow republished that the widget will be re-displayed to the end-user again and their consent re-collected
Legitimate interest (opt-out)
The legitimate interest (opt-out) section of the global settings page is where you organization configures how it handles purposes and/or vendors that utilize legitimate interest/opt-out as a processing rule when the end-user performs various disagree actions.
Keep legitimate interest (opt-out) enabled when the user disagrees in the notice
Purposes and vendors that utilize legitimate interest/opt-out as a processing rule will remain enabled when the end-user selects a Disagree and close button or Continue without agreeing link.
Keep legitimate interest (opt-out) enabled when the user clicks on "disagree to all" in the preferences
Purposes and vendors that utilize legitimate interest/opt-out as a processing rule will remain enabled when the end-user selects the Disagree to all button on the second layer of the widget.
Note: Vendors who utilize a combination of consent and legitimate interest/opt-out as processing rules for purposes will not be enabled/allowed unless all purposes are enabled either via consent or legitimate interest.
Frameworks
Use the frameworks section of the global settings page to select all the industry frameworks that will be included in the regulation. Depending on the frameworks added to the regulation, Didomi will add the required vendors and/or make available settings that are included in the framework. Please see the table below for more information.
Note: By default, a regulation with a data collection scope by country/region will have the Google Consent Mode v2 framework enabled.
Enables the IAB Global Privacy Protocol for the regulation.
Enables Google Consent Mode v2 for the regulation. The vendors Google Advertising Products (API ID: google) and Google Analytics Products (API ID: googleana-4TXnJigR) will be added automatically to your vendor list.
Enables the Global Privacy Control for the regulation. Global Privacy Control (GPC) is a technical specification for transmitting universal opt-out signals. When enabled on a regulation, Didomi will detect whether the end-user's browser has the GPC signal and apply it to the end-user's consent record accordingly.
Vendors & Purposes
The vendors and purposes page of the regulation manager provides your organization with a matrix to add purposes and assign processing process rules on a per country/region basis. In this section, we will cover how to:
Add purpose to region mapping
Navigate to the Region mapping card and click Manage Purposes & Categories.
Select Manage purposes on the subsequent page.
Use the subsequent modal to select purposes that should be added to the regulation and click Save selection when finished.
The purposes will be added to the regulation. Click Save to confirm the additions.
Remove purpose from region mapping
Navigate to the Region mapping card and click Manage Purposes & Categories.
Purposes added to the regulation (whether grouped into categories or not) will populate on the subsequent page. Click Manage purposes.
Use the subsequent modal to deselect any purpose that should be removed from the regulation and click Save selection when finished.
The purposes will be removed from the regulation. Click Save to confirm the removal.
Configure purpose processing rule
The Region mapping card is a matrix that includes all countries/regions and purposes that have been added to the regulation. Using the matrix, your organization will set the processing rule for each purpose on a country/region basis.
Refer to the table below for the available processing rules
Opt-in
For the region, the end-user is opted out of the purpose by default and requires end-users to provide explicit consent in order to agree to the data processing related tot he purpose
Opt-out
For the region, the end-user is opted into the purpose by default and will need to explicitly opt-out of the purpose if they wish to reject data processing related to the purpose
Not applicable
The purpose is not applicable to the region
To configure a processing rule for a purpose, navigate to the cell at the intersection of a purpose and a specific region and use the provided drop-down menu to select the
Repeat as necessary for other purposes and/or other countries and regions.
Add vendor to vendor list
By adding vendors to your regulation, your organization can explicitly define the purposes for which they are allowed to process end-user personal data. To add a vendor to the regulation, navigate to the Vendors card and click Manage Vendors.
Use the provided filter and search bar in the subsequent modal to locate your vendor(s) and select them by clicking the checkbox to the left of the vendor name.
Click Save selection when finished.
The vendor will be added to the regulation. All purposes will be associated with the vendor by default unless otherwise configured.
Remove vendor from vendor list
The Vendors card lists all vendors that have been added to the regulation and the purposes for which they are allowed to process end-user personal data. To remove a vendor from the regulation, navigate to the vendor and click the Delete icon inline with the vendor name
The vendor will be removed from the regulation.
Configure purposes per vendor
When a vendor is added to a regulation, your organization can explicitly define the purposes for which they are allowed to process end-user personal data. Once a vendor is added to the regulation, navigate to the Vendors card and use the drop-down menu inline with the vendor name to select/deselect purposes.
Frameworks
The frameworks page of the regulation manager is where your organization can configure any optional or required settings for frameworks enabled for the regulation. For your convenience, Didomi has dedicated resources for implementing frameworks.
Tag managers
The tag manager page of the regulation manager is where your organization can enable any tag management platform you may use for the regulation. When enabled for a regulation, the Didomi SDK will push the end-user's consent status to the tag management platform.
Last updated