Privacy Notice Management Project Preparation

Define Objectives

With the assistance of the PNM Playbook, you will: 

  • Gain a clear understanding of the core business use cases supported by PNM.

  • Follow a structured, step-by-step approach to implementing the PNM solution, with each step mapped back to the business outcomes it enables.

  • Apply recommended decision points and best practices to guide deployment choices and support long-term optimization and maintenance.

Identify Key Stakeholders

Identify and align the stakeholders responsible for designing, implementing, and validating the OneTrust Privacy Notice Management solution.

Note:

Depending on organizational structure, one individual or team may fulfill multiple roles.

Key Roles & Responsibilities

  1. OneTrust Super User (Site Administrator)

    • Acts as the primary owner of the OneTrust platform. Responsible for configuration oversight, access control, issue troubleshooting, and day-to-day platform governance.

  2. Privacy Notice Manager

    • Responsible for authoring and maintaining privacy notice content, configuring templates, setting up approval workflows, and managing updates within the solution as the primary subject-matter expert.

  3. Testing and Validation Group

    • Responsible for implementing the privacy notice SDK on the website, configuring CSS and styling to match brand guidelines, and ensuring the notice content renders correctly, functions as expected, and is fully tested across supported browsers and devices.

Assess Organizational Structure

Please review internally the existing setup and discuss any changes, where applicable.

Should there be no prior setup, you will be required to determine how to represent your organization's structure within OneTrust. This will impact data visibility, access controls, and reporting capabilities.

Best Practices

  1. Determine whether it is beneficial to reflect your organizational structure within OneTrust, including sub-organizations or individual brands. This is particularly relevant if different brands require visibility only into their own data subjects, consent records, and configurations within the tenant.

    When multiple brands are supported, an organizational hierarchy enables brand-specific customization, such as tailored preference center branding and email templates. Assess whether this model aligns with your operational needs, noting that an organizational hierarchy is optional and not required for all use cases.

  2. Implement role-based access control (RBAC) to ensure appropriate data access and permissions. RBAC enhances data security, prevents unauthorized access, and ensures users only see information relevant to their roles and responsibilities.

  3. Plan for future organizational changes and ensure your structure is scalable. Organizations evolve over time. A flexible, scalable structure in OneTrust reduces the need for major reconfigurations as your organization changes.

  4. Consider language requirements if multi-lingual use is applicable to your organization.

Proceed with a Design Phase

The Privacy Notice Management Implementation article summarizes the key implementation activities, along with associated decision points and best practices to consider during design.