Data Discovery Privacy Rights Automation Overview & Security Guide

Introduction

Welcome to the OneTrust Data Discovery Privacy Rights Automation overview and security document. This guide is in addition to the security practices and encryption methods referenced in the Data Discovery Security Guide and Privacy Rights Automation Security Guide.

The OneTrust Data Discovery product provides automation and intelligence tools to help Privacy, Security, and Data Governance teams discover and classify personal and non-personal data, automate privacy rights fulfillment, demonstrate compliance, and drive business value. 

Data Discovery enables organizations discover and classify structured and unstructured data across cloud, on-premises accounts, and legacy systems and assets. The Privacy Rights Automation add-on empowers organizations to automate consumer rights across data sources connected to OneTrust through Data Discovery. 

This is accomplished by indexing the information classified by OneTrust Athena AI. The index is populated with obfuscated classified information (values that have been passed through a 1-way SHA256 hash). 

The input provided by the consumer is then hashed when the automated search is triggered and performed against obfuscated values. Thus, if the index were to be compromised, the attacker would not obtain any customer classified information data.

Note:

For more information on how to use this feature set, please reference the Data Discovery Privacy Rights Automation Feature Guide.

Worker Node Retrieval Options

If data retrieval is disabled for the worker node, any received record or file retrieval jobs will fail and DSR Orchestration will not be performed.

Some organizations may elect to disable retrieval as an additional authentication control. In this event, use the below command in the terminal to disable data retrieval:

CODE 
kubectl config set-context --current --namespace="$NAMESPACE"
kubectl set env deploy/datadiscovery-onprem-agent IS_DATA_RETRIEVAL_ALLOWED=false

For more information on controls for worker nodes, see Data Retrieval & Sampling Security Controls for Worker Nodes.

Privacy Rights Automation with Data Discovery Flow

  1. Privacy request is created and the system subtask is triggered on a specific workflow stage

  2. Automated search job is initiated against the Data Discovery worker node 

  3. Worker node polls the OneTrust cloud for jobs and picks up the job 

  4. Worker node searches the index with custom criteria identified 

  5. Results are returned to the cloud identifying where classified information was found 

  6. Additional worker node job(s) triggered to retrieve records and/or files from the appropriate data source

  7. Results are returned to requests's Results Summary screen