OneTrust Universal Consent & Preference Management Data Flow

The OneTrust Universal Consent & Preference Management Data Flow diagram illustrates the basic flow of data when a data subject (consumer) interacts with a OneTrust Collection Point or Preference Center. Additional details are available in the steps that follow, offering insight into the relationships between the key data structures used by the module when creating and storing consent data.



  1. OneTrust creates records of each interaction a data subject has with either a Collection Point or Preference Center.

  2. Each interaction creates a single Receipt as the primary document of record. A Receipt is an unchangeable record that summarizes and includes all relevant information about the data subject's interaction.

    Receipts include each Purpose that the data subject interacted with (e.g. opted-in or opted-out) as well as each Purpose Preference that the data subject interacted with. You can also find additional key details on the Receipt, such as the Data Subject Identifier, Interaction Date, the Collection Point from which the Receipt was generated, and associated Privacy Notices, if applicable.

  3. The receipt is further processed to create individual Transactions for each Purpose contained within that Receipt. A Transaction is an unchangeable record that is created for every individual action that the data subject made during their interaction with the Collection Point or Preference Center.

    For example, if a data subject interacted with two out of three Purposes in a Collection Point, then one Receipt would be created and two Transactions would be created. Each Transaction has a Transaction Type, which represents the type of action (or inaction) performed by the data subject for each purpose (e.g. opting in or out of a Purpose).

    Transactions detail the data subject's choices for a single Purpose. All Purpose Preferences that are associated with that Purpose are visible on the Transaction to specify the items that the data subject did or did not give consent. You can also find additional key details on the Transaction, such as the Data Subject Identifier, Interaction Date, the Collection Point from which the Transaction was generated, and the related Receipt ID,

  4. From each Transaction, OneTrust creates or updates a Data Subject Profile, which includes the Data Subject Purpose Status for each Purpose. The Data Subject Purpose Status is the outcome of the data subject's interaction. The Data Subject Purpose Status has a single value at any point in time and represents the end state of the consent as a result of processing the Transactions in date order.

    Note:

    Given this context, some transactions recorded will have no impact on the Data Subject Purpose Status.