New Data Policies Migration Guide

OneTrust is excited to announce the release of the new version of our Data Policy product, packed with enhanced capabilities to elevate your experience. With this new design, users can review violations in the application to ensure accuracy and then take appropriate actions on those violations instead of scheduled actions being taken before understanding the details of violations flagged. The new features include but are not restricted to the following:

Dynamic Violations Count

View updated violations as the data is scanned and classified. Manually running a rule/policy is not required to view the updated violations.

In-app Review of Policy Violations

Exporting of violations is not required anymore to review the violations flagged.

Track Compliance

Track the violation count in the Policy Trends chart for each policy from week-to-week or month-over-month.

Rescan to Validate Remediation Actions

Select to rescan the data source to verify if the remediation actions have resulted in a lower count.

OneTrust has migrated all customer environments still on the V1 engine to the V3 engine in the 202407.1.0 - July 5, 2024 release. No action or preparation was required from customers. OneTrust has deprecated the V1 engine in the Summer '24 Release (202407.2.0).

The migration will produce the following key actions and outcomes:

• V1 policies will be read only

• Individual V1 rules will be migrated and created as standalone policies in the V3 engine.

• Existing V1 rules will be seamlessly migrated with conditions according to status type.

• V1 Tasks and Integrations will not be migrated.

• The policy creation date will become the V3 migration date in the policy's details.

Migration Notice

When your tenant is updated to OneTrust 202407.2.0, a modal will appear when you access Data Policies module to inform you of the migration status. If the migration was not successful in moving all data policies, the system will keep them active until August 1, 2024. You will need to manually create these policies in the new experience before they are no longer accessible.

Field Mapping

V3 Field	V1 Field
Policy Name	Rule name - policy name
Description	Policy V1 description
Organization	Policy V1 organization
Policy Owner	Policy V1 owner if present. If not, then policy creator.
Severity	Always empty
Standards/Frameworks	Always empty
Enabled Status	If V1 rule is enabled, then V3 Policy will also be enabled. If V1 rule is disabled, then V3 Policy will also be disabled. If V1 policy is deactivated, then rules are also disabled.
Created Date/Modified Date/Effective Date	This will be the date when the V3 Policy was created during migration.
Created By/Last Modified By	Policy Creator

OLD

This document will refer toas the original, generally available feature set available to customers currently.

NEW

The new experience, referred to as, includes more robust functionality for managing policies as part of data governance management.

The main difference lies in creating and managing policies. In the old version, a user would take the following steps to create and define a policy:

1. Create a new policy with details like name, description, etc.

2. Define policy conditions by creating a new rule with choice actions taken on scheduled basis or manually.

With the new Data Policies Experience we have simplified the process of creating and defining Policies. With the new experience, you take the following steps:

1. Create a new policy with details like name, description, policy owner, and severity.

2. Define policy conditions with no rules required.

We have also decoupled the actions and scheduling of actions for a much better-guided user experience. Remediation can happen in one of three ways:

• Export violations for review

• Create tasks for administration

• Trigger connections to automate select jobs

Managing automation rules is also different in the new experience. In the Data Discovery module menu, select Setup > Automation Rules. Existing rules from the old experience will appear here. For more information, see Configuring Automation Rules for Catalog Searches.

The below table displays the progress in bringing feature parity between the old and new experiences. With the intent to list the new experience as Public Preview by end of Q3FY24, all the features from the old experience should be available to customers in the new. Only when the new experience is Generally Available will we deprecate the prior, so that customers are not managing policies in two different experiences.