Unified Purpose Feature Guide

Important:

Auto-migration of all tenants and legacy attribute deprecation was originally planned for Spring Release (202605.1.0), but will be paused until further notice. Follow our post in the Product & Community Announcements group to stay up to date.

Overview

The Unified Purpose object allows users to obtain a full picture of all aspects of their organization involved in processing personal data for a specific purpose. This centralized concept provides cross-solution insights into how personal data collected for that given purpose is used across your business, so that you are better able to associate things like data elements, processing activities, vendors, collection points, and projects through a common object. Admin users can even customize purposes for unique needs so that your products across the OneTrust platform are leveraging the same reference data.

Unified Purpose is currently supported for the following OneTrust solutions:

  • AI Governance

  • Data Mapping Automation

  • Universal Consent & Preference Management

  • Third-Party Management

How to Access

The Reference data menu in Global Data Manager contains the full list of seeded objects supplied by OneTrust. For additional information on reference data and value creation, see Global Reference Data Feature Guide.



Platform Use Cases

Standard Purposes

Purposes are the key building blocks of our consent product and are needed to set up collection points and preference centers. A person's consent is always stored against a defined purpose for which their data is collected or processed. Creating different purposes can promote understanding of why you would like to process personal information.

When creating a new standard purpose in Universal Consent & Preference Management, the Purpose Category field will pull the list of available values (system or custom) from the Purpose object in Global Data Manager.



Note:

For more information on consent purposes, see Setting Up Purposes of Processing.

Processing Activities & Vendors

Processing activities serve as a crucial component for understanding the business context of how personal data is handled within an organization. They encompass any operation or set of operations performed on personal data, which includes collection, storage, processing, and potential disclosure or sharing of that data.

When creating a Processing Activity in Data Mapping, the Purpose of Processing field will track the function that the given activity serves.



Vendors are included in Data Mapping Automation and Third-Party Risk Management because they are external, third-party providers of goods or services involved in an organization's data collection processes. Understanding the relationship between vendors and the data they handle is crucial for effective vendor risk management and compliance with privacy regulations.

The Purpose of data collection field will track the purpose as to why the given vendor needs to collect and/or process this data.



Note:

For more information on these inventory types, see Adding Processing Activities from the Process Gallery and Adding, Editing, and Deleting Inventory Records.

Projects

Projects are used to track where AI is deployed for business initiatives, applications, or services to achieve specific business outcomes. The Projects inventory allows organizations to capture a detailed record of an AI system's main optimization goals, purposes, and foreseeable uses, which aids in improved project tracking and progress monitoring.

The Purpose(s) field in AI Governance is used to track the intention of a particular Project object so you can evaluate whether the requested data can be used.



Note:

For more information on projects, see Managing Projects in AI Governance.

Purpose Data Usage

Important:

For more information on data syncs and Insights Dashboards, see Insights Dashboards FAQ

The Purpose data usage screen will allow you to drill into specific purposes across the platform and inspect their usage details. This provides privacy managers a central location for monitoring where a given purpose is used to better manage those records.



Using the Direct Marketing purpose as our example, we can see where this unified purpose is distributed across our AI projects, consent purposes, and processing activities. The Usage summary card to the right will tally the count of all instances of the given purpose across your tenant.

Click on the name of a object to access its details page.



About Legacy Purpose Fields

For existing purpose fields used prior to the introduction of Unified Purpose, these will be annotated with "[Legacy]" to record the historical purpose of the given object. This impacts the following objects and their attributes:

Object

Attribute

Processing Activity

Purpose of processing [Legacy]

Processing Activity - Personal Data

Collection purpose [Legacy]

Asset

Collection purpose [Legacy]

Vendor

Purpose of data collection [Legacy]

FAQ

Why has OneTrust introduced this change?

The new Purpose object (and supporting attributes) enables consistency across the platform, clearer reporting, and sets a strong foundation for upcoming in-app guidances and policy setting centered around the Purpose of data use and collection.

How can I configure the options that show up in the new Purpose of Processing attribute?

Authorized admins with the Reference Data Edit permission can add, enable, or disable any purpose option from the Global data manager.

Can I disable system options?

Yes, authorized admins with the Reference Data Edit permission can enable any disable any system or custom purpose option.

Can I add custom options?

Yes, authorized admins with the Reference Data Edit permission can add custom options.

What will happen to the Purpose of Processing [Legacy] attribute? Can I still use it?

The Legacy attribute will still be available in your environment for you to configure and use as needed.

If I do not wish to use the new Purpose of Processing attribute, can I disable it?

Yes.

If OneTrust decides to disable the Legacy attribute in the future, can I re-enable it?

Yes.

If I choose to migrate my purpose data, how will the migration handle custom options I previously created for the Purpose of Processing [Legacy] attribute?

The migration will recreate any existing custom options and make them available for administration within the Global data manager.

How will the migration impact my existing Processing Activities?

The migration will enrich your existing Processing Activities so that existing values available today in the Purpose of Processing [Legacy] attribute are reflected on the new “Purpose of Processing” attribute.

Note that if the user has already started to manually populate the new Purpose of Processing attribute with values, we will ignore those records for the migration to avoid overwriting customer-inputed data. In other words, if we find that the new Purpose already has a value, we will not overwrite it.

All existing data populated in the Legacy attribute will be preserved and available for use and reporting.

What are you doing to ensure there is no data loss on existing inventory records populated with data in the Purpose of Processing [Legacy] attribute?

Any data collected via this attribute on existing inventory records and assessments will continue to be available, regardless of whether you opt to migrate your data or not.

If the Legacy attribute is disabled, how will that impact my completed & in-flight assessments?

This will follow existing behavior for disabled attributes in assessments.

Assessment Status

Expected Behavior (If Attribute is Disabled)

Not Started

Question is visible but disabled, user can skip the question.

In Progress

Question is visible but disabled, user can skip the question.

Under Review

Question is visible but disabled, user can skip the question.

Completed

Question is visible but disabled, user can skip the question.

Reopened

N/A

If I choose to migrate, what behavior should I expect on my in-flight and completed assessments?

There is no impact to those assessments or the data collected via those assessments.

What happens if I choose not to update my templates, rules, integrations?

You may continue to use the Legacy attribute.

If I choose to migrate, will OneTrust migrate any custom translations I have in place for purpose options?

No. We do not support custom translations on system purpose options by design to preserve the integrity of the system options for future product enhancements. Customers looking to customize translations should represent those as custom options.

If there are assessments that are pointing to templates with Legacy field and those assessments are not yet approved when migration happens, will their values be not migrated since attributes get linked only after an assessment is approved ?

This is consistent with existing assessment behavior, as OneTrust will store the values only on approval. If a value is not present in the Legacy attribute at the time of migration, it will not be copied into the new attribute.