OneTrust Recommended Data Policies

This best practices guide is intended to assist Data Policy customers in establishing robust data policies for their organization. In an era where data is paramount, aligning with industry standards and leveraging common retention and Redundant, Obsolete, Trivial (ROT) detection policies is essential.

The following sections provide a head start in crafting effective data policies, empowering you to comprehend and manage data efficiently. Explore the recommended policies within, tailored to help you navigate the complexities of data governance and enhance your organization's data management practices.

Note:

OneTrust has seeded policy templates available in Private Preview. For more information, see Using Data Policy Templates.

Best Practices

These policies are recommended as they come from standards and frameworks that are commonly complied with by customers. They are built to identify data across all data sources. You can also configure these policies to look for data limited to only certain data sources. To do so, you can use the Data Source ID or the Data Source Name filter in the Policy Condition.

Concerning Privacy Law

Regarding personal data use cases, organizations are strongly recommended to review the specific requirements for the respective law/framework to which they are held.

For example, the GDPR has stricter protections for criminal offense data which have unique personal data processing, collection, and retention scenarios. Unlike EU privacy law, the United States breach laws like in California have a closed list of personally identifiable information elements. If they are involved in a breach, they constitute a breach regardless of the scenario.

Managing breach notification obligations starts with the proper configuration of your data policies so your teams can identify and remediate violations.

Flag Sensitive Account and Authentication Data (PCI)

Sensitive Authentication/Account information cannot be stored after the transaction has taken place.

  • PCI 3.3.1 - Retention of SAD

  • PCI 3.3.1.2 - Retention of CVC

  • PCI 3.3.1.1 - Retention of Track Data

  • PCI 3.3.1.3 - Retention of PIN



Attribute Type Name

Policy Condition

Values

Terms

Equals To Any Of

Credit Card CVV, Credit History, Account Number

PIN is also recommended, though, not currently available in our glossary. OneTrust recommends to create a custom term to flag these values.

System Type

Equals To Any Of

S3, Amazon S3

Identify Unencrypted Passwords (ISO)

According to ISO27001/2, passwords cannot be stored in clear text format anywhere (data sources, email, files, messages, etc.). If OneTrust is able to flag any asset with a password, this means that the asset is NOT encrypted.



Attribute Type Name

Policy Condition

Values

Terms

Equals To Any Of

Account Password, Account Password History, Password

Data Protection Impact Assessment (EU and UK GDPR)

Identify where sensitive personal information, or ‘special category data’ under the GDPR terminology, is stored and review it annually to ensure it is stored and processed according to the purposes set out in Records of Processing Activities (ROPA) and DPIA (where applicable).. Organizations must maintain an inventory of special categories of personal data processed by the organization as well as its purpose of processing. The documented inventory is reviewed by management on at least an annual basis and provided to legal authorities on request.

Tip:

According to the GDPR, DPIAs are mandatory for sensitive personal information when it is processed on a large scale. Regular auditing can help with proper purpose usage and identify additional systems where data is either shared or sent.



Attribute Type Name

Policy Condition

Values

Classification Tags

List Contains

Sensitive Personal Data

Note:

This tag includes the following related terms by default:

  • Genetic Sequence

  • Fingerprint

  • Hand/Palm Imagery

  • Charitable Donations

  • Disability or Specific Condition

  • Gait Patterns or Rhythms

  • Eating Habits

  • Drug Test Results

Customers can add additional terms to the tag for association so they can be identified with these policies.

Tip:

OneTrust provides several default classification profiles to scan data and classify data based on the regional variant, including Germany, Spain, and The Netherlands.

The GDPR extends an additional level of protection for criminal offense data (e.g. criminal activity, allegations, investigations, and proceedings). Custom classifiers can help detect these if you're processing it for a specific narrow purpose, which you must be able to prove with strict retention.

(HIPAA) Protected Health Information

Identify all data sources where health data related to any person is stored and can be identifiable.

  • HP - Individual Rights on Restrictions (R)

  • HP - Individuals Access to PHI and Denials (R)

  • HP - Individuals Request on PHI Amendment (R)



Attribute Type Name

Policy Condition

Values

Terms

Equal To Any Of

Account numbers, Biometric elements, including finger, retinal, and voiceprints, Certificate/license numbers, Dates related to the health or identity of individuals, Device attributes or serial numbers, Digital identifiers, such as website URLs, Email addresses, Fax numbers, Geographical elements, Health insurance beneficiary numbers, IP addresses, Medical record numbers, Other identifying numbers or codes, Patient names, Photographs of a patient's face, Social security numbers, Telephone numbers, Vehicle identifiers

Note:

Some of the above classifiers are available by default, while others you may need to create as custom classifiers.

Leverage the HIPAA Classification Profile to see what classifiers are seeded in by default.

Data Risk Detection

These data policies can quickly give you insight into risky or sensitive data that is possibly unencrypted or being held somewhere with incorrect access levels. The Shared Access value can be updated based on your use case and the access type gathered for the data source type. Please refer to the available myOneTrust connector articles for additional information.

Sensitive Personal Data Shared Externally



Attribute Type Name

Policy Condition

Values

Classification Tags

List Contains

Sensitive Personal Data

Note:

This tag includes the following related terms by default:

  • Genetic Sequence

  • Fingerprint

  • Hand/Palm Imagery

  • Charitable Donations

  • Disability or Specific Condition

  • Gait Patterns or Rhythms

  • Eating Habits

  • Drug Test Results

Customers can add additional terms to the tag for association so they can be identified with these policies.

Shared Access

Equals To Any Of

Shared - External

Sensitive Personal Data Shared Internally



Attribute Type Name

Policy Condition

Values

Classification Tags

List Contains

Sensitive Personal Data

Note:

This tag includes the following related terms by default:

  • Genetic Sequence

  • Fingerprint

  • Hand/Palm Imagery

  • Charitable Donations

  • Disability or Specific Condition

  • Gait Patterns or Rhythms

  • Eating Habits

  • Drug Test Results

Customers can add additional terms to the tag for association so they can be identified with these policies.

Shared Access

Equals To Any Of

Shared - Internal

Data Retention

These data policies use a minimization approach based on a specific guideline or regulatory framework so that the data is only held or used for as long as is necessary. OneTrust's recommendation is to modify these based on your company's policies or refer to DataGuidance for regional information.

The retention date can be based on the File Creation Date or the Last Modified Date to calculate the age of the files. They can be modified based on company retention policy.

Important:

These two fields are only supported for unstructured data. Structured data sources are not currently supported for this policy type.

Data Retention - Recruiting Documents

Based on information in DataGuidance, the recommended retention date is 1 year to account for annual audits and associated HR controls.



Attribute Type Name

Policy Condition

Values

Classification Tags

Equals To Any Of

Resume

Note:

This tag is applied to documents automatically when document classification is enabled. For more information, see Understanding Document Classification.

Created Date

More Than

6 months

Data Retention - Legal Contracts

Based on information in DataGuidance, the recommended retention period is 7 years.



Attribute Type Name

Policy Condition

Values

Tags

Equals To Any Of

Legal Contract

Note:

This tag is applied to documents automatically when document classification is enabled. For more information, see Understanding Document Classification.

Redundant, Obsolete, Trivial (ROT) Data Detection

Adhere to ROT best practices by detecting common data types and deleting them to minimize your data footprint.

Digital Certificates

This policy will help find the location where digital certificates reside to ensure they are secure.



Attribute Type Name

Policy Condition

Values

File Type

Equals To Any Of

pfx, _get-info

File Type

Contains Any

pem, key

Trivial Data - Audio Files

This policy will help you find trivial data like audio files that can be removed to help make progress on the data minimization use case.



Attribute Type Name

Policy Condition

Values

File Type

Equals To Any Of

mp3, mp4, mov, wav, mpeg

Trivial Data - Database Scripts

This policy helps you identify data related to database scripts that is trivial so that it can be removed.



Attribute Type Name

Policy Condition

Values

File Type

Equals To Any Of

sql, py, sh, psd