Data security and privacy review

Protecting customer data

TikTok, like many organizations, faces cybersecurity threats and is committed to protecting the data of TikTok users. It is a top priority to keep our data, systems, and assets safe from emerging cybersecurity threats and this diligence extends to our third-party service providers. Because of the sensitive nature of direct message data, TikTok has implemented a higher level of due diligence for developers that will process direct messages on behalf of Business Account users. This means that TikTok must validate access, processing and/or storage of Protected Data, business headquarters location, level of foreign ownership, primary and alternate workforce location(s), system location(s), and subcontractor(s) utilization of all prospective and current Business Messaging API developers.

What we expect from developers

Before obtaining the Business Messaging scope of permission for your developer app, we require all potential developers to complete the Data Security and Privacy Review ("DSPR"). This review assesses the maturity of each developer's privacy and security practices, ensuring they align with both regulatory requirements and TikTok's compliance standards before accessing customer data.

Privacy

Compliance with privacy laws and industry standards is essential for all stakeholders involved with TikTok Business Messaging, including our developers integrating Business Messaging API. Our objective is to create a best-in-class ecosystem to protect and safeguard all data through transparent disclosure and privacy safeguards throughout the data lifecycle (including data collection, storage, process, transfer, and disposal). The privacy mechanisms listed below are required to comply with all regional privacy laws (that is, GDPR and CPRA), industry standards and our own data management standards. Failure to comply may result in significant regulatory penalties and/or loss of access to TikTok Business Messaging data and/or TikTok API for Business.

Dedicated roles & responsibilities

Within your organization, there should be individuals responsible for overseeing data privacy compliance to ensure personal data is processed and protected properly, and act as point of contact for any privacy-related inquiries. A Data Protection Officer is also required under certain jurisdictions.

Privacy notice

A privacy notice provides clear explanations for each aspect of the data lifecycle, including what data will be collected, why this data is collected, how this data will be used, where this data will be transferred, how this data will be protected, and how long this data will be stored.

Data subject rights

Data subject rights provide individuals control over their data, including the ability to access, download, update, and delete their data upon request. Developers must be able to assist TikTok Business Account users in fulfilling these rights, especially when required by local regulations.

Data retention

Personal data must not be kept longer than necessary to fulfill the purpose it was originally collected and processed. When a TikTok Business Account user no longer authorizes sharing data with a developer, the developer must delete the personal data in a timely manner. Furthermore, organizations must provide data deletion capabilities to users in certain states in accordance with state law.

Data minimization

Developers must only request or access the minimum amount of data required by the service you are providing. To achieve so, developers should only request access to API that is required to achieve their specific business purpose.

Security

Security is the foundation for any data transfers. It is essential for our developers to have proper organizational and technical controls to protect TikTok Business Account users' sensitive data, to maintain trust, and to comply with regulatory compliance. For our developers, we expect you have implemented the following security measures to protect customers' data.

Information security policies

Developers must have an established information security framework as daily operation baselines to ensure data safety. The policy or guideline should be regularly reviewed, updated, and signed off by senior leadership to ensure correct security measures are enforced throughout the organization.

Network security

Developers must segregate network environments to protect internal network accesses, and implement network security tools, such as NIDS or HIPS, to monitor external threats.

Endpoint protection

Developers must install anti-virus or host intrusion prevention systems (HIPS) to ensure endpoint safety. Security scans should be conducted regularly, and virus policies should be updated near to date.

Security baselines

Developers must adopt a series of workplace security measures through domain control or other security tools to ensure daily operation security, such as minimum password requirements (Upper or lower cases, length, special characters, and so on), Multifactor Authentication (MFA) for administrator accounts, Screen auto-lock after a time period (for example, 15 minutes), and periodic awareness training.

Data protection

Developers must have a published Access Control policy. Partners should encrypt all personal data at-rest using at least AES-256 or RSA-1024 higher, data in-transit with TLSv1.2 or above.

Access control

Developers must have a published Access Control policy based on "Need-to-know" and "Least-privilege" principle. Employees and contractors should be granted privileges based on specific roles. System access logs should be retained and user privileges to company systems should be reviewed at least annually.

Vulnerability management

Developers must have security measures to ensure threats are constantly monitored, tracked, and remediated. Vulnerability scans or penetration testings should be conducted and reports should be retained.

Incident management

Developers must have a published incident responses policy. Incident drills should be conducted at least annually to test the effectiveness of recovery procedures. Incident reports should be properly documented for review.

Important notes

The assessment will normally take 2-4 weeks. In order to speed up the approval process, we recommend you provide more details and supporting documents, such as ISO27001 certificate or SOC 2 report, and the latest vulnerability scan or penetration testing report. If your application is rejected, please refer to the assessor's comments to provide additional information.

Please be noted, nothing mentioned in this page is intended to replace the security and privacy obligations you have as outlined in the TikTok for Business Developer Terms nor contributed to legal advice.

As a final reminder, you will not be able to obtain Business Messaging scope of permission for your developer app without completing the data security and privacy review process. There are no exceptions.