Data Policies Implementation Guide

Introduction

A data policy is a prescribed set of guidelines that governs an organization's collection, storage, usage, and protection of data to maintain transparency. It requires a close examination of how data is handled, who has access, how long it's kept, and the measures taken to ensure privacy and security.

The Data Catalog module by OneTrust enables customers to translate their written guidelines into intelligent, actionable policies using the data scanned and classified by the Data Discovery product. This empowers Data Governance users to uncover potential security and compliance issues within their data ecosystem and conduct remediation as necessary when data aligns with condition criteria in a policy.

This document will address the basic setup required, common use cases, available features, and recommended configurations based on the application's current capabilities.

Business Use Cases

Data Minimization

Identifying data that has either passed the minimal retention period or reached the maximum retention period. This encourages an organization to minimize their data possession for only as long as necessary to remain compliant and avoid any potential violations.

Identifying data that is no longer required by the business and poses a violation risk. This requires an organization to detect where this data is stored and implementing a safe review methodology prior to its deletion.

Data Risk Mitigation

Identifying data that is considered internal but has been been improperly shared with external audiences. This requires an organization to detect where and how restricted files are shared and enables organizations to remediate their scenarios through removal of users or public access methods (e.g. links).

Prerequisites

User Access

The following system roles have been updated with permissions for viewing data policies or managing their details and configuration.

Role

Description

Unique Permissions

Data Governance Viewer

Data Governance Viewers can view basic details for assets and objects in the Data Catalog module. Users with this role cannot alter any configurations, nor can they create, update, or delete any data assets in the Data Catalog or Data Dictionary.

View DGOV Data Policies

Data Governance Manager

Data Governance Managers are responsible for overseeing all governance features and functions in the Data Catalog module. Users with this role can take action on including, but not limited to, classification tag inheritance, attributes, tasks, terms, business glossaries, and data policies.

Manage DGOV Data Policies

Basic Data Discovery Setup

  1. Connected data source for the external system. For more information, see Connecting Data Sources.

  2. Deployed worker node(s). For more information, see either Manual Installation Overview or Guided Installation Overview.

  3. Configured scan profile for the specific data source and scanning requirements. For more information, see Setting Up Scan Profiles.

  4. Configured classification profile enabled with the Document Classification feature. Document Classification uses a supervised machine-learning model to detect sensitives files which may have an associated retention or security policy.

    Note:

    Only available for full scans. Document Classification can also be enabled at the data source level. For more information, see Creating Classification Profiles and Understanding Document Classification

Advanced Options

Configured custom terms, and attributes needed for unique organization requirements. For more information, see the following:

Defining Data Policies

Data Policies require at minimum a unique name, a policy owner, and at least one condition to match against scanned data.

You can configure one or more condition relationships to specify when a policy is leveraged, either through a saved search existing in your catalog or by creating a new custom condition right here in this screen.



Note:

For more information, see Creating & Managing Data Policies.

Tracking Violations

A violation is a data asset that matches the conditions defined in the data policy. Violations are identified dynamically - as you scan more data into the catalog, the system will automatically evaluate that data against your defined data policies.

For example, you may have a retention policy that calls for the deletion of employee data after 7 years. You may set this up as a data policy that looks for data assets classified as Resumes that have a Created Date older than 7 years. Any data assets that match this criteria are considered "Violations".



The Violations tab allows you to review where the data was found in your data source and the approximate volume found on the disk.



Note:

For more information, see Managing Data Policy Violations.

Once you have remediated the data source for the given violation, you can perform a rescan to refresh the data policy against the data source and inspect for a lowered violations count. Currently rescans are limited to Catalog scan type only.



Note:

For more information, see Revalidating Data Policy Violations.

Remediation Options

Export for Review

Within each data policy you can create an .csv report with metadata details of violations grouped by data source and conduct reporting and administration review. Coupled with integration connections, reports can be created automatically by retrieving metadata details according to defined data policy conditions.





Note:

For more information, see Creating Exports of Data Policy Violations and Remediating Data Policies with Integrations.

Create Tasks

Tasks are helpful for users to review policy violations as part of your remediation process and can be tracked inside the application. The email notification can be created for one or more violations so the reviewer has access to a violation exports. Another assignment option is to create ticket in third-party systems like JIRA or ServiceNow.



Note:

For more information, see Creating Tasks to Review Data Policy Violations.

Rescan for Violations

Violations indicate if the data source has triggered a condition specified in the data policy. A full list of identified violations will be shown for each data source, along with the volume of data scanned and a timestamp of when the data source was last checked for violations.

Violation rescan can be performed for select data sources to check if the violation count has changed if remediation actions have occurred.





Additionally, you can leverage configured workflows in the Integrations module to automate certain actions using policy and metadata details identified by your data policy conditions. Once the violations are reviewed and remediated, users can rescan the violations on the policy to get an updated count. 



Note:

For more information, see Managing Data Policy Violations.

Policy & Retention Schedule Scenarios

Similar to advanced searches in the catalog, Data Policies are powerful platform options for detecting and surfacing data according to specific attribute values or classification tags. When coupled with a Date attribute value and a conditional relationship, Data Policies can trigger violations according to the Created Date, Last Modified Date, or Update Date attributes:

Tip:

The following policy configurations are examples of possible scenarios supported by OneTrust.

Please contact your Professional Services representative to discuss the specific business use case and possible configuration options to best accommodate your retention schedule or security policy requirements.

Data Protection - Restricted Data with Open Access

This example data policy helps identify unstructured restricted that is in violation of a data security policy. The data policy has been configured to look for Restricted Data that is available Open Access.



Data Protection - Passwords & Keys Shared Externally

This example data policy helps identify unstructured data that is in violation of a data security policy for handling restricted data such as passwords, authentication tokens, and API keys. The data policy has been configured to look for externally shared files containing Account Password, Authentication Key, Authentication Token, Account Password History.



Retention Policy - Legal Contracts

This example data policy helps identify unstructured data that is in violation of a corporate records retention policy for legal records such as Contracts. The data policy has been configured to look for legal contracts that are older than 1 day.



Retention Policy - Recruiting Documents

This example policy helps identify unstructured data that is in violation of a corporate records retention policy for recruiting documents like resumes. The data policy has been configured to look for resumes that are older than 1 day.



Retention Policy - Duplicate Documents

This example policy helps identify if scanned files are considered duplicates by the system. Users can then identify if large number of documents are redundant so they can avoid unnecessary storage and mitigate risk and monitoring costs.



Note:

For more information, see Reviewing Scanned Files and Understanding Document Classification (LINK).