Enabling Data Samples for Classification

You can display classification data samples that provide users contextual samples so they can check against false positives when reviewing recommended terms. These samples are stored at the cloud level.

This feature relies on an enabled permission set Data DiscoveryViewSamples to grant users access to sample data during Discovery Review. This permission has been granted to Site Admin, Data Governance Manager, Data Mapping Automation Manager, and Privacy Officer roles by default.

Important:

If you have elected to keep the samples for training and would like to delete the samples older than 30 days, please contact OneTrust Support. For more information on contacting OneTrust Support from myOneTrust, see Creating a Support Case in myOneTrust.

About Data Sampling & Purging

You can purge data samples are passed from the scanner to the classification review once your team has managed the recommendations. This removes data and prevents unnecessary access to potentially sensitive information passed through the classification service.

Purging Scenarios

  • Manual Approval and Rejection

  • Automatic Approval and Rejection

  • Bulk Action Approvals and Rejections

Note:

Data samples will not be deleted if the recommended term is marked for later review.

To enable classification data samples

  1. On the Data Discovery menu, select Settings. The Classifier Settings screen in Global Settings appears.

  2. Enable the Collect classification data samples setting.
  3. The Maximum Sample Size field will appear for you to enter a desired sample size limit of 1-5.


    Tip:

    If the Maximum sample size is left at 0, no data samples will be returned after scanning. Ensure that you provide a count to properly return samples.

  4. Use the Turn on data masking setting to obscure sensitive information during sample collection.


  5. Use the Include context near sample setting to inspect surrounding data to help more accurate decisions when reviewing samples and approving terms.


  6. Click the Save button.
  7. When reviewing recommended terms, you can now hover over View Samples to display the classification data samples from the scan results.


To set the Sample Retention Policy

  1. On the Data Discovery menu, select Settings. The Classifier Settings screen appears.

  2. Locate the Sample Retention Policy options.
  3. Choose to keep the samples for training purposes, or configure a custom retention policy for when they should be deleted. You can apply both deletions options, but at least one must be enabled.

    • Delete sample(s) once the recommendation is either approved or rejected.



    • Delete all samples every [X] days.



  4. Click the Save button.

To delete existing samples

  1. On the Data Discovery menu, select Settings. The Classifier Settings screen appears.

  2. Click the Delete button under Data Sample Collection. All collected samples will be removed from View Samples in discovery review.

Worker Node Sampling Options

To avoid malicious actors from using samples to pull PII from systems, you have the option to manually override the data sampling settings with a configuration control at the worker node level.

The IS_SAMPLE_COLLECTION_ALLOWED environment variable in the installer script can be set to false (default is true) so the worker node does not send any samples back to the cloud, even if the below settings are enabled. The datadiscovery-onprem-agent will log a warning stating: "The job had sampling enabled, but sampling is not allowed on this worker node. Overriding to 'false'."

CODE 
kubectl config set-context --current --namespace="$NAMESPACE"
kubectl set env deploy/datadiscovery-onprem-agent  IS_SAMPLE_COLLECTION_ALLOWED=false

#This value is set to true by default.

For more information on controls for worker nodes, see Data Retrieval & Sampling Security Controls for Worker Nodes.