FAQs for Fulfilling Privacy Requests

In the OneTrust application, Site Administrator users configure web forms that contain custom branding and styling for a particular organization. Once configured, an HTML link is generated that organizations can embedded on their privacy policy pages, making the web form available for data subjects to submit requests.

Web forms are hosted by the OneTrust application, meaning web form submission is performed directly in the OneTrust platform. Requests can also be created using the Asynchronous Request Creation API, which is secured by safelisted URLs, an API token, and an expected payload. On Premises clients will need host this on their own infrastructure.

It is ultimately up to your organization to choose where to make your shareable link accessible to requestors. However, organizations commonly publish their web form via a hyperlink in their privacy policy or the footer of their public-facing website.

Yes, the setting Mask Entry in Web Form in the Web Form Customization screen will allow you to mask personal information and prevent unauthorized users from viewing that data. This setting also masks sensitive data on request details and in the Privacy Portal.

It is open to all user input type fields.

OneTrust supports a number of common attachment types as part of request fulfillment. For more information, see Accepted File Types for Privacy Rights Automation.

Each OneTrust web form template is pre-configured with a set number of supported languages. However, OneTrust does not support machine or auto-translation of the templates to meet custom translations. For more information, see Providing Translations on Web Forms.

No, you do not need to generate a new link to the web form as the URL is maintained.

Web forms must be published in order for new configurations to appear on live web forms.

Check if the Request Details field contains unsupported characters or HTML.

Any time you make updates to a workflow that is assigned to a web form, you must reactivate the workflow in order for the web form to update to the new workflow. Otherwise, any requests that are submitted will trigger the last published version of the workflow.

Ideally, it is recommended no more than two days with one day being the most practical use case. Users are more likely to verify their email right away as soon as they receive the initial email. This also minimizes the amount of time the email verification is idle in a user's inbox.

You can resend email confirmation notifications to unverified data subjects whose request is in held in the UNVERIFIED workflow stage. For more information, see Enabling Web Form Verification Settings.

Once a request expires because an email wasn't verified, the data subject must submit a new request to re-initiate the intake process. You can use the resend email verification feature to send reminders days in advance before expiration.

This action is restricted by design until email verification is complete. It is not recommended to send or share personal info with an unverified data subject until they have confirmed ownership of the email submitted on the request. If OneTrust customers elect to bypass this default security design, they can do so by manually moving the request to the next stage.

Yes, OneTrust supports partnerships with identity providers to assist with identity verification. When data subjects submit their request, Privacy Teams can add verification methods within the request workflow to process identity verification before honoring the request fulfillment. Privacy Team members can view the verification status, collect documentation, and track comments in the verification results.

OneTrust does not charge the data subject for receiving the message, though, standard rates may apply depending on the data subject's phone provider. For more information, see Twilio's SMS FAQ.

OneTrust can ONLY send data to LexisNexis that is collected through the seeded web form fields, which includes the following:

1. First Name

2. Last Name

3. Address

4. City

5. State

6. Country

7. Zip Code

8. Date of Birth

9. National ID (used to collect full or last four digits of SSN)

No. You will need to replace (i.e. delete or disable) those fields and enable the seeded fields.

OneTrust can ONLY send data to Experian that is collected through the seeded web form fields, which includes the following:

1. First Name

2. Last Name

3. Address

4. City

5. State

6. Country

7. Zip Code

8. Date of Birth

9. National ID (used to collect full or last four digits of SSN)

10. Phone Number

11. Contact Preference

No. You will need to replace (i.e. delete or disable) those fields and enable the seeded fields.

As soon as there are less than 24 hours left on a day (after 12am in local time), the days left should decrease by 1. For example, if a request is created at 11:50pm with 30 days left, the count decreases to 29 when it turns 12:00 am.

Yes, you will need to enable the workflow stage setting Auto-calculate request deadline at this stage on the Unverified stage.

Data subjects can access the Privacy Portal using a secure link that is provided whenever a member of your organization posts a public reply to the request. The link is not provided in the data subject request submission confirmation email. For more information, see Accessing the Privacy Portal and Accessing the Privacy Portal via Multi-Factor Authentication.

Public comments and automated comments can be seen by data subjects in the portal.

Calendar days. Under GDPR and ICO guidance, requests must be completed in calendar days, not business days.

Data Redaction is currently limited to unstructured text and HTML (i.e. email body content in plain text or HTML). Support for additional text and document types is under future consideration. You can vote on these enhancements in the OneTrust Ideas Exchange.

No, but customers can redact documents outside of the OneTrust application and upload the file. This is still limited to unstructured text and HTML.

Currently, no. However, you can upload redacted files into the results summary and include in your response to the Data Subject. You can vote on these enhancements in the OneTrust Ideas Exchange.

Result summary data can be exported to .csv or .pdf files.

Athena scans the unstructured data and uses Natural Language Processing (NLP) technology to classify the content. This works by using context clues to classify words and phrases within the data.

No, Athena is able to autonomously detect the names of companies, people, and places using Named Entity Recognition (NER) technology.

Confidence scores indicate the relative distance between the data sample being evaluated and the closest surrounding class labels. Athena will detect assumed data elements and classify text in its used context. Redacted results will populate an assigned data category and percentage indicating Athena's confidence of the match. For more detailed information on our classification service, see Using Classifiers for Data Discovery.

This is the expected behavior. OneTrust considers the Country and State fields as encrypted personally identifiable information (PII). OneTrust does not currently allow the filtering of encrypted fields.