> ## Documentation Index
> Fetch the complete documentation index at: https://faqs.xoxoday.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How does Loyalife comply with GDPR and global data laws?

> Xoxoday Loyalife complies with GDPR, CCPA, NDPR, and regional privacy laws through data encryption, consent management, and residency controls.

<Note>
  Xoxoday Loyalife complies with major global data protection frameworks including GDPR, CCPA, and NDPR through built-in consent management, AES-256 encryption at rest, TLS 1.2+ encryption in transit, right-to-erasure workflows, and role-based access controls.
</Note>

Managing loyalty programmes across borders means navigating a complex web of regional privacy laws. Xoxoday Loyalife is built to handle this complexity, maintaining compliance with GDPR (European Union), CCPA (California), NDPR (Nigeria), and other jurisdiction-specific data protection frameworks — without requiring custom engineering from your team.

## Data Minimisation and Consent Management

Xoxoday Loyalife enforces data minimisation principles by collecting only the member attributes necessary to operate your loyalty programme. Explicit consent is captured and recorded at enrolment, with granular controls that let members update or withdraw consent at any point. This consent lifecycle is fully logged and auditable, meeting GDPR Article 7 requirements out of the box.

## Right to Erasure and Data Portability

When a member requests deletion of their personal data, Xoxoday Loyalife supports right-to-erasure workflows that propagate across Loyalife's data stores. For organisations running Loyalife alongside HR systems like Workday or SAP SuccessFactors, the erasure process can be coordinated with member offboarding flows, ensuring no residual personally identifiable information remains in active records.

## Encryption and Data Residency

All personal data transmitted through Xoxoday Loyalife is secured with TLS 1.2 or higher in transit and AES-256 encryption at rest. Data residency controls allow your organisation to pin member data to specific geographic regions, helping satisfy locality requirements under frameworks such as GDPR's cross-border data transfer restrictions or India's Digital Personal Data Protection Act.

## Access Governance and Audit Trails

Xoxoday Loyalife applies role-based access controls (RBAC) to govern who can view, export, or modify member data within your organisation. Every administrative action generates an immutable audit trail, providing a clear record for internal privacy reviews or external regulatory audits. This access governance architecture aligns with the controls recognised under ISO 27001 and SOC 2 Type II certification frameworks.

## Ongoing Compliance Reviews

Privacy regulations evolve continuously across jurisdictions. Xoxoday Loyalife conducts regular privacy audits and compliance reviews to track regulatory changes across all supported regions. This means that as requirements shift — whether from updated GDPR guidance or a new regional law — Loyalife's controls remain current without requiring additional configuration from your team.

**Learn more:** \[Xoxoday Loyalife Help Centre — General]\(

<CardGroup cols={2}>
  <Card title="Role-Based Access Controls" href="/loyalife/security/can-the-product-restrict-access-to-content-or-areas-based-on-the-users-role-with">
    Understand how Xoxoday Loyalife uses RBAC to govern data access, restrict administrative permissions, and maintain a full audit trail of user actions.
  </Card>

  <Card title="Data Encryption and Security Standards" href="/loyalife/platform/with-the-relevant">
    Learn about the encryption standards, network security protocols, and third-party certifications that underpin Xoxoday Loyalife's security posture.
  </Card>
</CardGroup>