Setting Up Consent Retention Policies

You can set up data subject retention policies for Universal Consent & Preference Management to automatically remove data subject information from your OneTrust environment. The following retention policies can be configured for consent data: Data subject retention, Data subject purpose retention, and Data subject receipt retention. You can begin creating a consent-specific retention policy using the Data retention screen within Global Settings.

To set up a data subject retention policy

You can select the Data subject retention option to set up an automated process to delete full data subject records. This option includes the ability to select specific purpose statuses to be considered for deletion and keep receipt and transaction records after deletion.

  1. On the Global Settings menu, select General Settings > Data retention. The Data retention screen appears.


  2. Select the Consent tile. The Retention policies screen appears.

  3. Click the Add retention policy button, and select the Data subject retention option. Configuration fields appear for the retention policy.


    Field
    Description
    Create custom policy

    Enter a name for the retention policy.

    Retention window

    Enter the amount of time before data subject records are purged. The amount of time can be entered in either days, weeks, months, or years.

    Retain data based on

    Select the date attribute to be used for the retention window. The following options are available:

    Last transaction

    Date and time at which the last transaction was written to the database.

    Last updated date

    Latest date when there is any change to the data subject profile in the database, based on Last Transaction Date.

    Interaction date

    Date and time that the user interacted with the interface for a consent transaction.

    Consent date

    Date and time at which the data subject gave their last active consent.

    Created date

    Date and time at which the data subject profile was created.

    Purpose status(Optional)

    Select the purpose statuses to consider when purging data subject records. Multiple statuses can be selected. If no statuses are selected, all statuses will be considered for deletion.

    Note:

    For the Data subject retention policy, the Purpose status setting will match with data subjects that have one or more purposes in those statuses. For example, if you select Withdrawn in the Purpose status selection field, then it will match data subjects that have purpose A = Withdrawn and purpose B = Active.

  4. Complete the fields, as necessary.
  5. (Optional) Expand the Advanced options menu to configure the following additional settings:
    Field
    Description
    Keep receipts and transactions

    Enable this setting to retain data subject receipt and transaction records that will be available to view under the Receipts reporting screen after deletion.

    De-Identify Records

    Enable this setting to redact data elements on receipts and transactions that contain Personally Identifiable Information (PII).

  6. Click the Save button.

To set up a data subject purpose retention policy

You can select the Data subject purpose retention option to set up an automated process to delete profiles based on more granular criteria like purpose or collection point.

  1. On the Global Settings menu, select General Settings > Data retention. The Data retention screen appears.


  2. Select the Consent tile. The Retention policies screen appears.

  3. Click the Add retention policy button, and select the Data subject purpose retention option. Configuration fields appear for the retention policy.


    Field
    Description
    Create custom policy

    Enter a name for the retention policy.

    Retention window

    Enter the amount of time before data subject records are purged. The amount of time can be entered in either days, weeks, months, or years.

    Retain Data Based On

    Select the date attribute to be used for the retention window. The following options are available:

    Last transaction

    Date and time at which the last transaction was written to the database.

    Last updated date

    Latest date when there is any change to the data subject profile in the database, based on last transaction date.

    Interaction date

    Date and time that the user interacted with the interface for a consent transaction.

    Consent date

    Date and time at which the data subject gave their last active consent.

    Created date

    Date and time at which the data subject profile was created.

    Withdrawal date

    Date and time at which the data subject withdrew their previously given consent.

    Expiry date

    Date and time at which the data subject consent was expired.

    Purposes

    Select one or more purposes to be removed from data subject records as a result of this policy.

  4. Complete the fields, as necessary.
  5. (Optional) Expand the Advanced options menu to configure the following additional settings:
    Field
    Description
    Purpose status

    Enable this setting to restrict the removal of records to those under a specific purpose status.

    Collection points

    Enable this setting to restrict the removal of records to those generated from specific collection points.

  6. Click the Save button.

To set up a data subject receipt retention policy

You can select the Data subject receipt retention option to set up an automated process to retain, delete, or redact data subject receipts based on purposes, collection points, and consent statuses within the selected time frame. Using this retention policy will only affect receipts and not the entire data subject record.

  1. On the Global Settings menu, select General Settings > Data retention. The Data retention screen appears.


  2. Select the Consent tile. The Retention policies screen appears.

  3. Click the Add retention policy button, and select the Data subject receipt retention option. Configuration fields appear for the retention policy.


    Field
    Description
    Create custom policy

    Enter a name for the retention policy.

    Retention window

    Enter the amount of time before data subject records are purged. The amount of time can be entered in either days, weeks, months, or years.

    Retain data based on

    Select the date attribute to be used for the retention window. The following options are available:

    Interaction date

    Date and time that the user interacted with the interface for a consent transaction.

    Created date

    Date and time at which the data subject profile was created.

    Purposes

    Select one or more purposes to be removed from data subject receipts as a result of this policy.

  4. Complete the fields, as necessary.
  5. (Optional) Expand the Advanced options menu to configure the following additional settings:
    Field
    Description
    Collection points

    Select one or more collection points from which receipts were generated that should be removed with the policy.

    Consent status

    Select the consent statuses for which receipts will be retained.

    De-Identify Records

    Enable this setting to redact data elements on receipts that contain Personally Identifiable Information (PII) rather than deleting the receipts.

    Retain most recent consent

    Enable this setting to run the receipt retention policy as defined, keeping receipts that have the most recent consent even if they are outside of the retention window.

    Note:

    If you have fewer than 100 million data subjects, we recommend setting your data retention period to at least one week before your regulatory deletion deadline to allow sufficient time for processing.

  6. Click the Save button.

To edit a data subject retention policy

  1. On the Global Settings menu, select General Settings > Data retention. The Data retention screen appears.

  2. Select the Consent tile. The Retention policies screen appears.

  3. Click the Context Menu icon corresponding to the retention policy you want to edit, and select the Edit option.


  4. Modify the configuration, as needed.
  5. Click the Save button.

To view records scheduled to be deleted

You can access the Scheduled items screen to review records scheduled to be deleted. The Policy field can be used to filter through other available retention policies, as needed.

  1. On the Global Settings menu, select General Settings > Data retention. The Data retention screen appears.

  2. Select the Consent tile. The Retention policies screen appears.

  3. Click the Context Menu icon corresponding to the retention policy that you want to review, and select the View scheduled ttems option. The Scheduled items screen appears, where you can view data subjects scheduled to be deleted.