Preserving or Deleting Hidden Data
Currently, when the show logic is triggered via an assessment question, the respondent provides responses to subsequent questions. Those responses are saved to an inventory record. When that record is reassessed, and skip logic for the same set of questions is triggered, the subsequent responses are retained in the inventory record, despite those questions being hidden from the respondent. Because the show logic was not triggered, the subsequent questions (and previously collected responses) are no longer valid. Additionally, the subsequent questions (and previous responses) are hidden from the respondent, who cannot make changes or updates.
This creates incorrect data that is included in the RoPA, making the Record of Processing Activity report incorrect and potentially causing a compliance problem.
To better help organizations collect and maintain accurate assessment and inventory data, and to improve the accuracy of the system-provided RoPA (Record of Processing Activity), this enhancement allows organizations, via template configuration, to configure the option to delete attribute values and related attributes for questions hidden in assessments (via skip/show logic) and reflect this in the assessed inventory object. When enabled, this enhancement will improve the accuracy of data collection via assessment and ensure that inventory objects reflect the most up-to-date information.
How it works
When enabled via the template setting, this enhancement enables the following behavior for questions hidden by template logic (skip/show).
- Question responses
-
The question and response value are removed from the assessment. The removal of the question-response pair is captured in the assessment activity log.
- Question NMI and comments
-
Any associated NMI (Need More Information) requests and comments are also removed on hidden questions.
- Question attachments
-
When this enhancement is enabled, the reference link to question attachments is removed, though the attachment itself is preserved in the inventory object.
- Inventory attributes
-
If the response is tied to an inventory’s attribute value, that value is also removed. For example, if a question asks, “Does the activity involve the use of automated profiling?" and has an existing response value of “yes”, if that question is hidden, the inventory object value for Automated Decision Making” is cleared (changed to null) upon approval of the assessment.
- Assessment risks
-
If the response value triggered the identification of a risk (through risk rules), that risk is removed from the assessment. Similarly, the risk relationship between the assessment and the inventory object is removed.
- Inventory object risks
-
If the assessment is the only source of a risk on the related inventory object, the risk is removed from the object. This assures that risks identified on objects are current and valid. If that risk is related to other sources (e.g., other assessments), the relationship is removed, but the risk is otherwise unaffected.
- Risks in the risk register
-
If the inventory risk is the only source of a risk in the risk register, it is also removed from the register. If that risk is related to other sources (e.g., other inventory objects), the relationship is removed.
- Inventory relationships
-
If an inventory relationship is defined as part of a question that is hidden, that relationship is removed for that inventory object.
To enable the feature
By default, OneTrust will maintain the current functionality and preserve data for hidden questions. To activate the enhancement, you will need to set the Preserve or delete hidden data setting to Delete on the assessment's Template details screen.
This must be enabled manually for each template, which gives you more granular control.
Scope and limitations
- Inventory only
-
Inventory-backed assessments, including Privacy and AI Governance inventory object assessments, are the core use case for this enhancement, so it is limited to inventory-related attributes/risks and the assessments associated with them.
- System attributes
-
Some inventory object types have required system attributes; these attributes are unaffected by this enhancement. For example, Hosting Location is a required field for Assets; this value is never affected by this enhancement.
- Read-only question values
-
Read-only questions (and their values) are never affected by this enhancement.
FAQ
Can I push an updated template to In Progress and Under Review assessments?
Yes, if an assessment template is updated with this enhancement enabled, and the template is pushed to assessments in Not Started, In Progress, and Under Review stages, the enhancement will work as intended.
Where in the workflow are hidden question attribute values deleted?
Attribute values and related risks are updated when the assessment is approved and moves to the Completed stage.
If a previously hidden question is shown due to template logic, and the response is changed, will the new response update the inventory?
Yes, if the question response is an inventory object attribute, and it is visible in the assessment, the inventory will be updated.
If the question is not visible (hidden by template logic) and Preserve or Delete Hidden Data is set to Delete, the question and response are deleted from the assessment, and the corresponding inventory attribute value is cleared.