Adobe’s suggestions:

• Review existing consumer rights workflows, internal processes and points of contacts to determine how collecting analytics data will align with current processes. 
• Identify a process to receive and respond to Data Subject requests. Consider building an automated tool to manage those requests.
• Consider how you will collect identifiers from Data Subjects (e.g., privacy postbox, web-based form etc.). 
• Consider authentication and validation requirements, particularly since data in Adobe Analytics can often be described as indirectly identifiable data (e.g., IP addresses or cookie IDs rather than authenticated data, such as where a user provides an email address). 
  • Evaluate the role for Adobe-provided JavaScript to enable certain types of identity resolution
• Conduct a data review prior to providing the Data Subject access to their data. Document the steps you put in place to help you to establish an audit trail.

To assess the need for consent and to develop an approach, consider the following:

• Determine what data you currently are collecting and want to collect in the future.  
• Assess how you will use it and your legal basis for processing.
• In those instances where consent is needed, determine how you, as the data controller, will get consent or If your current consent approach is sufficient. This can be managed internally or by using a third-party consent manager. A list of some of the privacy tech vendors in this space, some of which offer consent managers, can be found here.
• Decide whether to design a contextually relevant and on-brand consent experience (think Experiential Privacy) while determining the best approach for honouring consumer opt-outs or withdrawal of consent.

Evaluate and balance the cost of keeping, securing and responding to individual rights requests against your business needs by taking the following steps:

• Review your current tags and cookies to align with current use cases. Tailor your data collection practices to your marketing objectives.
• Consider removing any unused data from your instance of Adobe Analytics..
• Understand your contracted Adobe Analytics data retention policy and contact your Adobe representative to ensure that your organisation’s data retention period is set appropriately.

Adobe recommends that you review your processes for managing your data by taking the following steps:

• As discussed above, define your identity resolution strategy and process.
• Understand what data you collect via Adobe Analytics and why, with whom you share it, for how long you keep it and what security measures are used to protect the data. This may also be helpful for your records of processing activities.
• Adopt the data labelling tools offered in Adobe Analytics in order to operationalise your data governance practices and policies.
• If applicable to your use case (e.g., certain EU visitors) proactively engage with your Adobe representative to obfuscate the last octet of IP addresses or delete them completely after initial processing. 
• Consider managing the lifecycle of e-marketing tags or web beacons with a tag management system, such as Launch by Adobe.
• Develop a process to review changes to your use of Adobe Analytics to help ensure that you remain compliant over time.