FAQs for Governing Data Use

The module, OneTrust Data Discovery, is for discovering data that is unknown or has no known location. The market solution, TDD, is for targeted data searches across catalog sources. TDD does not leverage performance-based searches; instead, it knows all existing tables, data sources, etc., to look for and retrieve back to the application.

After a worker node is deployed, connected data sources begin a catalog scan. This helps identify the data structure and alerts the system to the types of files in the source. Then it scans, first starting at the data element level. Once the data is profiled, metadata is sampled. For more information, see Data Discovery Architecture Overview.

Data is performed in memory, purely ephemeral. Once processed, the data is dropped, and metadata is populated in the cloud. Customers can dictate whether data persists based on custom classifiers or data sources.

Data Discovery requires a deployed worker node for worker-node scans. The worker node uses the applicable data source connector and the source's native mechanisms to perform scans. For more information, see the Worker Node Management and Deployment Guides sections in the Data Discovery Knowledge Base.

Data Discovery typically requires read-only access, but the required permissions depend on the data source. For databases, grant access to the schemas and users required to cover the intended scan scope. For SaaS products, configure OAuth-based access with the appropriate read-only permissions where supported.

Credentials are stored on the worker node, which is protected by your established security controls.

An inventory is always the most up to date information about a processing activity or asset or vendor. It is your evergreen record. The data stored in the inventory is used to create visuals and reports for regulators, so keeping it up-to-date is important.

Personal data is any information related to an identified or identifiable natural person. It is the information on individuals that can be collected, stored, or shared.

Inventory records (such as processing activities, Assets, Vendors, and Entities) are used to document and manage your organization’s data landscape. These records are designed to capture detailed information, support reporting, and be populated and updated through assessments.

Object records (such as Projects or AI Systems) are used to organize and provide context for related records across modules. For example, a Project can group together multiple inventory records and link them to assessments and workflows.

Object records do not behave the same as inventory records. For example:

• Object records are not used as primary records of processing or data mapping.

• Object records do not support the same level of data capture and reporting as inventory records.

• Object records may require object-specific question types in assessment templates rather than inventory question types.

You should use inventory records to capture and maintain your data (for example, Processing activities, Assets, or Vendors) and object records to provide context, group related items, or track initiatives (such as projects), rather than as a replacement for inventory records.

Vendors represent the third party service providers whereas legal entities could represent either internal organizations or external organizations that aren’t necessarily service providers/vendors but could be involved in data processing activities.

For capturing third party vendors/service providers, we recommend using the vendors module and linking vendors to your processing activity records as the vendor module has very specific functionality designed for handling contracts and identifying risks associated with third parties.

The lineage diagram displays data subject types linked to a processing activity. It also shows swim lanes for assets, vendors, and entities linked to the processing activity as source/collection, storage/processing, or destination/access. Parties with access are populated by the processing activity attribute.

No. Manual updates to the diagram will not update the underlying data or relationships. Relationships and data must be modified directly on the processing activity itself.

Editing an inventory or submitting an assessment does not automatically refresh the diagram. You can generate an updated diagram by clicking the Auto Draw button, which will reflect the most recent changes.

Yes, from the inventory screen, use the check box to select multiple inventories or multiple inventories across pages to bulk launch assessments.