About OneTrust EU Data Residency Options for Cloudflare

Important:

The OneTrust EU Data Residency feature is available to purchase for customers with accounts hosted in a OneTrust European Union environment. Please contact your account representative or OneTrust Sales to update your contract.

On July 16, 2020 the Court of Justice of the European Union (CJEU) invalidated EU-US Privacy Shield as a data transfer mechanism between the EU and US. Based on the CJEU ruling, the European Data Protection Board (EDPB) has adopted recommendations on 'supplementary measures' to the transfer tools envisaged by the GDPR, aimed at ensuring compliance with the EU’s level of personal data protection when transferring personal data from the EU to a 'non-adequate' third country.

OneTrust is dedicated to offering our customers flexible options that meet their unique business needs along with their interpretation of these new guidelines. Among these options is Data Residency and Regional Payload Inspection, which allow our customers to fully control where their traffic is handled and where their data is processed.

Overview

The OneTrust application is served through the Cloudflare network. Cloudflare forwards requests from your web browser to the OneTrust application and provides increased scalability, performance, resilience, and security of our services - including support for our Content Delivery Network (CDN) and DDoS. Cloudflare provides a variety of services to protect our customers, which in turn protects our customers' end users. The security processing in OneTrust's global network analyzes traffic for attacks and other threats and blocks them. Those processes produce request header logs containing IP addresses, which is the data transmitted to the United States and stored in our data centers.

To help address Schrems II cross-border data transfer concerns and comply with evolving regional data privacy requirements, Cloudflare introduced the Cloudflare Data Localization Suite to provide an approach to data localization and make it easier to adhere to compliance regulations. With this feature, OneTrust is able to offer the following options:


Option	Description
Data Residency	Allows you to isolate all end-user traffic logs containing IP addresses to your preferred region (i.e. the EU) avoiding any cross-border transfers of these logs to other regions such as the US.
Regional Payload Inspection	Allows you to limit the decryption and inspection of your data to within a selected region. This option is most suitable for companies where most of their users are within the selected region as users in other regions may see a performance impact in some areas.

Note:

These features are available to purchase for customers with accounts hosted in a OneTrust European Union environment.

Prerequisites

In order to qualify to use OneTrust's Data Residency option, your company must meet the following requirements:

Your account must be hosted in a OneTrust European Union environment.

Note:
APP-CH and APP-UK are outside of the European Union and are not eligible.
Your account must have a custom subdomain.

Note:
Customers that do not currently have a custom subdomain will be converted to a custom subdomain when the EU Data Residency feature is enabled. For more information, see Customizing OneTrust with a Custom Subdomain.

Things to Know

If the Data Residency feature is enabled for existing customers with a custom subdomain, the URL will be migrated from yourcompany.my.onetrust.com to yourcompany.my.onetrust.eu. Please update all instances, such as bookmarks, emails, and other content, that may contain links to the previous domain.

Module Action Required

The following features will continue to work when the Data Residency feature is enabled. However, additional action will also be needed to enforce Data Residency for these features, if utilized:


Module	Features	Action Required
Universal Consent & Preference Management	Preference Center Login Links Hosted Web Form Links Website Web Form Script Embedded Web Form Script	Preference Center Login Links (Both Login & Magic Links) Customers will need to republish the preference center and replace existing links to the preference center, including links sent via their email automation service, with the new URLs. For more information, see Integrating a Multi Page Preference Center. Hosted Web Form Links Customers will need to republish the collection point and replace existing links to web forms with the new URLs, including web forms used in iframes. For more information, see Integrating OneTrust Hosted Web Form Collection Points. Website Web Form SDK Customers will need to republish the collection point and replace the existing script tag on their website(s) with the new script tag. For more information, see Implementing the Collection Point JavaScript SDK. Embedded Web Form SDK Customers will need to republish the collection point and replace the existing script tag on their website(s) with the new script tag. For more information, see Integrating OneTrust Embedded Web Form Collection Points.
Cookie Consent	Cookie Banners	Cookie Banners Customers will need to republish their cookie banners and update the script src on their websites. For more information, see Implementing Cookie Consent Scripts.
Mobile App Consent	SDK	SDK Customers will need to republish their SDKs and update the script src on their websites.
Privacy Rights Automation	Web Forms	Web Forms Customers will need to republish web forms and replace existing web form links with new URLs. For more information, see Generating a Web Form Link.

Subprocessor Features

There are certain features that are provided by OneTrust Subprocessors that cannot be controlled by OneTrust's Data Residency setting. The following features may or may not meet compliance guidelines based on your interpretation.


Subprocessor	Functionality	Recommended Action
Salesforce	Account Administration, Product Feedback, and Support	Customer can enable the Customize Support Message setting on the Support > Help Center screen in Global Settings to route support requests to an internal email.
Twilio/SendGrid	Voice, E-mail, and SMS services	Customer can choose to not use OneTrust's default SMTP services and instead set up a custom SMTP or Microsoft Exchange account on the Email and Branding > Email Settings screen in Global Settings.
Pendo	End User Behavior Analysis	Customer can disable product tutorials at the user or account level using the Subprocessors Controls screen in User Preferences or the Feature management screen > General features tab in Global Settings.
Microsoft Office Online	Access and create Microsoft Word files using the Web Application Open Platform Interface (WOPI) protocol	Customer can disable the Microsoft Word Online Integration setting on the Policy Management > General screen in Global Settings.

Note:

For more information, see List of Subprocessors.

Additional Information

The following items are things to know when the EU Data Residency feature is enabled:


Feature	Recommended Action
mTLS	Customers that have existing OneTrust client credentials with mTLS enabled will need to reupload the certificate used in the authentication.
CAPTCHA	OneTrust's BotDetect CAPTCHA can be used instead of reCAPTCHA for web forms in the Privacy Rights Automation module to ensure Data Residency is enforced.
myOneTrust	myOneTrust, the official online community for OneTrust users, partners, and experts, will not be bound by OneTrust's Data Residency feature.

Requesting EU Data Residency Options

Complete the following procedure to request access to the Data Residency feature.

Customer contacts their OneTrust Representatives to request access to the Data Residency feature. The following details are required:
- Account ID
- Name of the custom subdomain
- Environment that hosts the customer's account
OneTrust processes the request and enables the feature for the customer's account.

To view the Data Residency configuration

You can view the Data Residency configuration in Global Settings once enabled for your account.

Click the gear icon in the upper right-hand corner to access Global Settings.
On the Global Settings menu, select Support > Feature management and click the General features tab.
View the Data Residency configuration and modify the Regional Payload Inspection configuration, if needed.

Field

Description

Data Residency

The Data Residency option is read-only and no changes can be made directly within Global Settings. For additional assistance, contact OneTrust Support.

Data Residency Region

The Data Residency Region is read-only and is limited to the European Union.

Regional Payload Inspection

The Regional Payload Inspection option is disabled by default.

If you want to limit the inspection of your data to the Data Residency Region, you can enable this option. However, please note that users within other regions may see a performance impact in some areas.
Click the Save button.

Terms & Conditions

If Customer enables the Cloudflare Data Localization feature, Customer Logs generated by the interaction of Customer’s Authorized or End Users with the Cloud Services and IP addresses will not be transferred to a location outside of the selected region; provided that Customer does not upload or otherwise accesses through the Cloud Services to content tied to a domain located outside of the selected region.

The Cloudflare Data Localization feature was designed for Customers whose users accessing or interacting with the Cloud Services are predominantly located within Customer’s selected region. Customer understands that the enablement of the Cloudflare Data Localization feature may impact the performance of the Cloud Services outside of the selected region.

Account Management