Data Discovery Privacy Rights Automation Feature Guide

The OneTrust Data Discovery module provides automation and intelligence tools to help Privacy, Security, and Data Governance teams discover and classify personal and non-personal data, automate privacy rights fulfillment, demonstrate compliance, and drive business value. This can be accomplished with structured and unstructured data across clouds, on-premises accounts, and legacy systems and assets.

The Privacy Rights Automation add-on empowers organizations to automate consumer rights across data sources connected to OneTrust through Data Discovery. It relies on an integration workflow that's launched via a request subtask that's able to search, scan, and retrieve data and files by leveraging the OneTrust cloud and your on-premises worker node.

For additional guidance on this add-on's architecture flow and security standards, please reference Data Discovery Privacy Rights Automation Overview & Security Guide.

To create a connection via the Athena Wizard

This step-by-step walkthrough helps you select search values for classifiers and then appropriately map a chosen web form's fields to its classifier counterpart.

Note:

OneTrust recommends customers use the Wizard as a guided and simple configuration route for DSAR automation.

  1. On the Integrations module menu, select Gallery. The Integrations Gallery screen appears.

  2. Search and the Athena tile. The Gallery Details screen appears.


  3. Click the Add button on the Wizard DSR: Data Discovery workflow tile. The Connection Details screen appears.


  4. Enter a new name for the connection and provide an optional email to receive error alerts.


  5. Click the Next button. The Configure Search Conditions screen appears.

  6. Use the condition blocks to build a list of classifiers that must be satisfied before the system will return results.

    Click the Add Condition Block to stack classifiers and enforce stricter validation standards. You will map active form fields to the classifiers chosen here in the next screen.



  7. Click the Next button. The Field Mapping screen appears.

  8. Choose a published web form, then select which active fields should be aligned with their corresponding classifier. This will inform the system where to map and classify the data subject's submitted request details.


  9. Click the Next button. The Advanced Settings screen appears.

  10. Enable these settings to supplement the review and/or minimize the amount of data returned for the DSAR request.
    Tip:

    Use these settings at your discretion for your discovery use cases and request fulfillment needs.



    Setting

    Description

    Redact Files

    When the automation retrieves files from unstructured data sources these files can be sent to the OneTrust redaction service to ensure only the relevant information is delivered back to the data subject.

    For more information, see OneTrust DSAR Redaction Feature Guide.

    Check Friendly Name

    When results are retrieved from structured data sources, pull the column friendly names from the data catalog and use the friendly name when posting the results to DSAR Results Summary.

    This uses a data asset attribute available in the Data Catalog Attribute Manager. For more information, see Using the Attribute Manager and Configuring Catalog Attributes.

    Return Classified Fields Only

    When results are retrieved from structured data sources, only retrieve the columns where a term was found that was labeled classified by your organization. If you data subject is requesting all available personal information, you can disable this setting to capture all possible terms.
  11. Click the Activate button. The Connection Details screen appears with summary details, setting options, and active workflows with logs. You can deactivate the Wizard by clicking the Deactivate button.


  12. Refer to the Settings tab to review and update the connection triggers, field mapping, and advanced settings as necessary.
  13. The connection is now activated and is available for selection during system subtask/connection setup in the Privacy Rights Automation module. It will appear in the Add Connection pane in the format: [Entered-Connection-Name]-DSR-Orchestration.
    Note:

    For more general information on subtask configuration for requests, see Using Subtasks in Request Workflows and Adding Connections to Requests.



To add the DSAR: Data Discovery workflow

For customers wanting to manually configure their automation route, this seeded workflow option lets you easily create a workflow prepared for DSAR Orchestration. You will need to update the action/API values as necessary to meet your request intake and processing needs.

  1. On the Integrations module menu, select Gallery. The Integrations Gallery screen appears.

  2. Search and select the Athena tile. The Gallery Details screen appears.


  3. Click the Add button on the DSAR Data Discovery workflow tile. The Add Workflow Name modal appears.


  4. Enter a new name for the workflow and select an existing credential.
    Note:

    For more information on creating system credentials, see Configuring Integration Credentials.



  5. Click the Create button. The Workflow Builder screen appears with the Athena DSAR: Data Discovery workflow.


To configure the DSAR: Data Discovery Workflow

Subtask Action

  1. Click the Edit icon on the Data Subject Access System Subtask Created action.
  2. Configure the action's criteria conditions upon the system subtask should be created that will call this integration. Use the Add Condition to stack additional conditions.
  3. Click the Done button when finished.
  4. Click the Save button.

Orchestration API

  1. Click the Edit icon on the POST DSAR Orchestration API action.
  2. The call comes seeded with the classifier and value targeting "email". You can modify the Body field to update the desired classifier and respective value to inform the call what data to search for.

    Some example classifiers:

    • First Name (firstname)

    • Last Name (lastname)

    • Phone Number (phonenumber)

    Note:

    For more information on the supported classifiers for Data Discovery, see Using System Classifiers for Discovery.



  3. Use the Settings tab to modify the action's error handling option, as necessary.
  4. Click the Finish button.
  5. Click the Save button.
  6. Click the Activate button.

To add the connection to a request workflow

Note:

For more information on subtask configuration for requests, seeUsing Subtasks in Request Workflows and Adding Connections to Requests.

  1. On the Privacy Rights Automation module menu, select Setup > Workflows. The Workflows screen appears.

  2. Select the workflow to which you want to add the system subtask. The Workflow Details screen appears.

  3. Select the desired workflow stage from where integration should be triggered.
  4. On this workflow stage, click the Add Connection button. The Add Connection pane appears.

  5. Locate and select your newly activated workflow from the Add Existing Connection list, then click the Add button.
    Note:

    Users can also create the connection directly in this Connection pane using the suggested systems. See the section in Adding Connections to Requests on suggested connections.



  6. The select connection will be added as a new system subtask under the given workflow's Subtask tab.
  7. Hover over the subtask to reveal and select the Context Menu icon. You can click one of the available options to do the following:

    • Edit the subtask's name, description, assigned connection, and required/mandatory option for the workflow owner or user subtask assignee.

    • Edit the connection details and be directly navigated to the respective Workflow Builder screen.

    • Check the subtask logs to review and troubleshoot errors

  8. Click the Save button.
  9. Click the Activate button.

To validate the connection

  1. Advance a workflow to a stage which request details and system use will successfully trigger the subtask based on your defined conditions.
  2. You should observe that a new system subtask will appear in the given workflow stage with a Processing status.
  3. Once the status as updated to Complete, an internal comment will be posted in the Activity tab stating that the request automation has been completed.
  4. Navigate to the given request's details screen, then click the Results Summary button.
  5. Observe that any found data or files will populate in the given system's data group or attachment group as a result of your discovery automation handled by the integration connection.