General Data Protection Regulation (GDPR)
As a global industry leader in conversational AI, Nuance supports public and private sector clients with healthcare, omni-channel customer management, and speech recognition solutions. While we act as a data controller for our direct consumer products, most of Nuance's clients rely on our services exclusively as a data processor. In both types of engagements, we recognize the importance of delivering solutions that support compliance efforts consistent with applicable privacy and data protection laws.
The recent decision by the Court of Justice of the European Union in the Schrems II case has been cause for Nuance to evaluate the data transfers necessary for its multinational operations. Nuance has and will maintain standard contractual clauses and, as per the guidance of the European Data Protection Board, Nuance has implemented the process necessary to verify the conditions of transfers made pursuant to these standard contractual clauses which offer appropriate safeguards for the data processing required by our customer contracts. Nuance is confident its process aligns with that outlined by the Board.
Read more about Schrems
In recognition of the EU’s GDPR status as a global data protection model, Nuance has adapted our systems and procedures to meet the regulation’s stringent requirements. We remain firmly committed to helping our clients meet both current and evolving privacy and data protection regulations and will continue to monitor and adapt our systems, as necessary.
To support GDPR compliance efforts, Nuance:
- Regularly reviews existing policies, procedures, and systems to validate alignment with principles for data processing, particularly as GDPR is shaped and formed by new cases and guidelines.
- Offers clients their choice of location options for data processing and storage.
- Demonstrates a clear understanding of every client’s data, where it flows within our systems, and who has access.
- Offers Professional Services to support solution-level procedures to manage consents, including opt outs.
- Facilitates compliance with data subject requests for all rights including access, correction, restrictions, and deletion.
- Conducts Privacy Impact Assessments for new products, systems, and geographies.
- Applies appropriate retention periods.
- Encrypts data at rest and provides secure data transmission between Nuance and client systems.
- Offers assistance for clients to develop and maintain records of data processing.
- Applies security protocols and access controls on both the Nuance and client’s side of a solution.
- Ensures sub-processors and contracts are properly vetted according to GDPR requirements.
- Ensures continuous availability and integrity of data.
For any cloud-based or on-premise solution, responsibility with respect to data protection is shared. Our clients are responsible for configuring Nuance solutions in a GDPR-compliant manner and for applying GDPR requirements in the context of their enterprise.