Compliance

Consent, retention, residency, and audit — enforced by the platform rather than by convention.

Consent is stored per channel and per category, with evidence.

Boolean ok = RME_Consent.isGranted(contactId, 'SMS', 'Marketing');

RME_Consent.grant(contactId, 'SMS', 'Marketing', new Map<String, Object>{
    'source'   => 'WEB_FORM',
    'evidence' => 'form:preferences-v3 ip:203.0.113.9',
    'capturedAt' => System.now()
});

Enforcement is unconditional: no Flow, Apex, or API call can send a Marketing category message to an opted-out recipient.

Regulatory mapping

Regulation	Scope	RME support
GDPR / UK GDPR	EU/UK personal data	Lawful-basis field, EU data residency, erasure support, DPA with providers
CAN-SPAM	US commercial email	Physical address block, functional unsubscribe, honored within 10 days (RME is immediate)
CASL	Canada	Express vs implied consent tracking with expiry
TCPA	US SMS and voice	Express written consent, quiet hours, DNC suppression
HIPAA	US health data	Restrict PHI in message bodies; use secure-link templates; BAA with provider
PECR	UK electronic marketing	Consent evidence and unsubscribe honoring

Unsubscribe handling

Email templates in Marketing and Operational categories must include an unsubscribe link. The packaged preference center writes directly to Consent__c, so an opt-out is effective on the next send with no batch delay. List-Unsubscribe and one-click List-Unsubscribe-Post headers are added automatically.

Data residency

Choose provider regions to keep message content in a jurisdiction: Azure ACS regional deployments, Mailgun EU, SES regional endpoints. Salesforce record storage follows your org's instance. Residency is set per provider config and can be enforced by routing rules.

Retention and erasure

Configure eventRetentionDays for tracking and event data.
Erasure requests remove message bodies and tracking while retaining non-identifying delivery statistics.
Consent history and audit logs are retained as proof of compliance, in line with regulatory expectations.

RME_Privacy.erase(contactId, new Set<String>{ 'BODY', 'TRACKING' });

Evidence for audits

Auditors typically ask for: proof of consent, the exact content sent, the timestamp, the sender identity, and the opt-out path. Every one of these is a queryable Salesforce record.

Continue to Best Practices.

Was this helpful?

PreviousSecurity NextBest Practices