Step-by-Step Onboarding Guide: Universal Consent & Preference Management
Getting up and running with your Consent and Preference Management solution
Thank you for choosing the OneTrust Universal Consent & Preference Management solution to help manage your privacy, security, and governance program needs.
The solution is designed to be intuitive and easy to configure and this guide will take you through each step one by one.
And if you have questions along the way, or at the end of your implementation, you can reach out to the team who will be happy to help.
Let’s get you started
Follow the steps below to get your solution set up. Each stage of the process is covered by comprehensive guidance and support collateral on the my.onetrust.com online resource platform and this guide will direct you towards all the information you need.
Before you begin
Before you get started with your implementation, complete the following key activities which will help you accelerate your implementation:
-
Get Familiar with Key Terms
Purposes
These are the business purposes for which you are processing personal information. Specifically, we are referring to the processing activities that rely on consent as their best legal basis, as opposed to bases such as legitimate interest or legal obligation.
Examples include – Newsletter subscriptions, promotional updates, participation in surveys or studies, and the sharing of information with third-party partners.
Collection Points
These are the places where consent is collected. Typically, consent is collected at the same time as the personal information to be processed, though this is not always the case. Most collection points are some types of webform, though they may also include paper forms and other interactions such as trade show meetings and phone conversations.
Collection points should provide, or reference, written notice text describing the Purpose(s) for which consent is being collected as well as the relevant privacy policy. You should consult your legal counsel as to what constitutes consent for your specific use cases.
Data Subjects
This term is used to describe the individual who is giving consent to the client, for a given purpose.
Data Elements
This term is used to refer to additional data that is gathered for the data subject not related to consent.
Examples include – First Name, Last Name, Address, Mobile and Email.
-
Assign Key Decision Maker
This will be the main point of contact throughout the implementation and will make configuration/setting decisions for the module.
-
Assign Technical Resources
Integration of the Universal Consent & Preference Management module often requires adding snippets of code to websites or connecting existing systems (collecting consent records or updates) to OneTrust via API. Identify the best technical resource within your organization to carry out these tasks.
-
Identify all business processes that rely on consent
Consult your legal counsel and identify all business processes that rely on consent as the best legal basis for processing personal information. In OneTrust we call these ‘Purposes’ of processing. Your legal counsel should provide or approve the notice text that is displayed to data subjects when collecting consent, as well as a linked privacy policy.
-
Identify all points where consent is collected
Consent is most often collected via web forms that include notice text, a check box, and a link to your privacy policy. You may also collect consent through other means such as paper registration forms and interactions at trade shows. In OneTrust we call these ‘Collection Points’ and that is collecting consent for one or more ‘Purposes’ of processing personal information.
It is also important to identify points where consent can be withdrawn, such as unsubscribe buttons in emails. It is also important to identify if the OneTrust preference center will be deployed as a part of the implementation.
-
Identify all third-party tools involved
Determine the tools, marketing or otherwise, that are a part of collecting, storing, and processing personal information based on consent.
For example, you may be leveraging Marketo to host web forms where your customers can sign up for a newsletter. These forms might also be collecting consent that is transmitted to Salesforce for phone-based marketing campaigns, while your content management system has a form to subscribe to product updates, which need to be sent out through SendGrid.
Review all the tools that you use to collect, store, and leverage personal information, and this will help you identify everything that is, or should be, connected to consent.
If a complex integration with a system is required, there should be an SOW previously created, stating the scope of the implementation, and identified deliverables.
Consent and Preference Management Configuration
For an overview of Universal Consent & Preference Management and its features access all our knowledge base articles at the link here. The steps below direct you to the most relevant way to get started as quickly as possible.
|
Step |
Description |
|---|---|
|
1 |
The first step to setting up Universal Consent & Preference Management is to create a purpose. Purposes are the reasons why you will be collecting and processing a data subject's data. You must define purposes of processing to set up Collection Points. Use the below article as guidance: |
|
2 |
If needed, you can create and customize data elements to act as descriptors and potential identifiers for your Collection Points. Data elements bring structure to the data being collected across your organization's Collection Points. Use the below article as guidance: |
|
3 |
Collection points can take many forms but are the points of interaction where consent is initially gathered or recorded, usually some interface that a data subject directly interacts with, such as a form on a web page. However, it can be any place where an action is taken that signifies the giving of consent. You can set up collection points to reflect digital interactions such as web forms, mobile apps, and website banners as well as interfacing with systems where your organization might collect and store consent gathered through analog means such as phone conversations, physical mail, or in-person interactions. Use the below article as guidance: Creating Custom API Collection Points |
|
4 |
Use the below articles as guidance depending on which integration method you would like to take: Implementing the Collection Point JavaScript SDK Implementing the Collection Point with REST API Integrating OneTrust Hosted Web Form Collection Points |
|
5 |
A Preference Centre is a webpage where the data subjects can log in and update their consent and preferences. You can leverage our out-of-the-box Preference Centre and configure it to display the necessary data elements, purposes and text to quickly provide your data subjects with a way of reviewing and updating their consent. If you are building your own custom Preference Centre and you need to push into OneTrust an update or withdrawal of consent, you can use a collection point of type "API". Use the below links for guidance: |
|
6 |
Check Transactions are coming through You can view all consent transactions captured through collection points that have been set up in the application using the Transactions tab on the Receipts screen. The Transactions tab provides details, such as the identifier value, purpose, and collection point, for each consent transaction. Various links are available on this tab to allow you to easily access additional information related to a specific consent transaction. Check Data Subject Profiles You can create new data subject records and view a list of data subjects for which consent transactions have been captured using the Data Subjects screen. The Data Subjects screen provides higher level details for a data subject, such as the identifier type, the total number of transactions, and the date and time of the last consent transaction. From this screen, you can access the respective Data Subject Details screen for a specific data subject for a more in-depth look into the consent captured for that data subject. Check Records can be updated You can add, modify, and withdraw consent on behalf of a data subject using the following procedures. This allows you to manually manage their consent preferences, which can be useful for instances where the data subject communicates desired changes through analog means. For guidance on all the above, please see the below articles: |
|
7 |
You can use integration workflows to automate tasks in external systems based on triggers set up in OneTrust. Workflows can be leveraged to update third-party marketing systems, create tickets, and more. OneTrust provides templates for common system integrations and use cases. Additionally, you can set up a custom integration with any system that uses Open RESTful APIs. Use the below articles as guidance: Getting Started with Integration Workflows Creating Integration Workflows Customizing Integration Workflows Managing OAuth 2.0 Client Credentials Configuring Integration Credentials There are also system specific articles on my.onetrust.com, so please do search for the relevant system to see if we have guidance. If you need additional support with integrations and you would rather have a OneTrust consultant help you build and document the outbound connections (Integration Workflows), you can purchase additional hours as part of a Statement of Work. |
|
8 |
You can create a new report to display information such as details about your assessments, inventory records, consent transactions, and data subject requests on the Create a Report screen. Reports can be created using one of the Reports Gallery templates that are preconfigured with module-specific fields or created manually using the Custom Report template. The Consent Dashboard offers a comprehensive overview of your consent receipts and transactions using widgets of various visualization styles to highlight key consent metrics within your organization. You can also configure custom consent dashboards using the Copy button or by navigating to the Reports module to create dashboards that prioritize the data most relevant to you and your organization. Use the below articles as guidance: |
|
Complete! |
Congratulations on completing your implementation. |