Processing Activity System Attributes Guide

A processing activity inventory is a record of a business activity that involves the collection, storage, processing, and potential disclosure, sharing, or selling of personal information. Processing activities provide the business context as to why data is being processed.

OneTrust features out-of-the-box attributes that you can activate to gather specific information on your organization's processing activities. These attributes will display on a processing activity record's Inventory Details screen and can be updated manually, via assessment response, using bulk update, or through an API.

Attributes in bold are required when creating a processing activity inventory record. Attributes identified as editable can be edited directly on the Inventory Details screen.

The following attributes are available for use with processing activity inventory records:

Attribute

Description

Type

Editable

Aggregate Risk Level

How likely is it that this processing activity could expose personal information? To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.

Note:

This attribute determines what risk level displays for the processing activity.

Single-Select

No

Aggregate Risk Score

Overall risk score associated with the processing activity. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.

Note:

This attribute determines what risk score displays for the processing activity.

Text

No

Aggregated Inherent Risk Level

Overall inherent risk level associated with the processing activity. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.

Single-Select

No

Aggregated Inherent Risk Score

Overall inherent risk score associated with the processing activity. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.

Text

No

Aggregated Target Risk Level

Overall target risk level associated with the processing activity. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.

Single-Select

No

Aggregated Target Risk Score

Overall target risk score associated with the processing activity. To learn how this attribute is calculated, see Risks Settings and Setting Up Risk Scoring.

Text

No

Applicable Standards

Standards applicable to the processing activity (such as Codes of Conduct).

Multi-Select

Yes

Automated Decision Making

Existence of automated decision-making, including profiling (if applicable).

Single-Select

Yes

Business Function

Primary business function that this processing activity supports.

Single-Select

Yes

Business Process Owner

Individual responsible for the business process.

Single-Select

Yes

Categories of Recipients of Sale of Personal Information of California Residents

Categories of recipients to whom personal information of California residents is sold.

Multi-Select

Yes

Collection Purpose

What is the purpose of collecting this data element?

Multi-Select

Yes

Consent Attributes

What are the attributes you require for valid consent?

Multi-Select

Yes

Consent Evidence

Do you retain evidence to demonstrate what each individual has consented to, what they were told, and when and how they consent?

Single-Select

Yes

Consent for Minors (15 years)

Parental or guardian consent for minors of 15 years old.

Single-Select

Yes

Consent Withdrawal

Is withdrawing consent as easy as giving consent?

Single-Select

Yes

Controller Contact Information

Name and contact details of the Controller.

Text

Yes

Controller's Representative & DPO Contact Information

Name and contact details of the Controller's representative and Data Protection Officer (if applicable).

Text

Yes

Countries Utilizing Process

The country or countries where this process is used.

Multi-Select

Yes

Created By

Name of the user who created the record.

Single-Select

No

Created Date

Date when the record was created.

Date

No

Cross-Border Transfer Mechanism(s)

Mechanisms in place for the transfer of personal data out of the European Economic Area (EEA) to a third-country (if applicable).

Multi-Select

Yes

Data Accuracy

Steps taken to ensure accuracy of data.

Multi-Select

Yes

Data Breach Occurrence

Has any data breach ever occurred?

Single-Select

Yes

Data Minimization

Steps taken to ensure minimization of data.

Multi-Select

Yes

Data Protection Impact Assessment

Is a data protection impact assessment required and what's its progress?

Multi-Select

Yes

Data Retention

Describe the data retention time limits for erasure/disposal of the different categories of data processed for this activity.

Text

Yes

Data Retention Period

Describe the data retention time limits for erasure/disposal for each of the different data elements processed for this activity.

Text

Yes

Data Source

Source of the data involved in the activity.

Multi-Select

Yes

Data Subject Notice Description

What attributes describe the notice used to inform data subjects of their rights?

Multi-Select

Yes

Data Subject Rights Ensured

Which data subject rights do you ensure?

Multi-Select

Yes

Data Subject Rights Exercise

Methods adopted to allow the data subjects to exercise their rights in practice.

Text

Yes

Data Subjects Region

Primary target regions that the data subjects may reside.

Multi-Select

Yes

Data Subjects Volume

Number of data subjects whose personal data is being processed.

Multi-Select

Yes

Derogation or Suitable Safeguards (Art. 49)

Describe the derogations or suitable safeguards pursuant to Article 49 of the GDPR.

Text

Yes

Description

Description of the processing activity.

Text

Yes

Destinations

Once the data is in the Primary Storage Asset, where else may it be sent to?

Multi-Select

Yes

DPO Opinion

Opinion of the DPO.

Text

Yes

External ID

This field contains a unique identifier for the record from a system outside of OneTrust.

Text

Yes

ID

This field contains a unique identifier for the record of a particular inventory type.

Text

No

Is Data Disclosed?

Is information disclosed, shared with, or accessed by another party (whether internal or third-party) for a business purpose?

Single-Select

Yes

Is Data Sold?

Is information sold for monetary or other benefit/value as a part of the process?

Single-Select

Yes

Is Master

Indicates if an inventory is a parent/master record.

Single-Select

No

Join Controller Contact Information

Name and contact details of the Joint Controller (if applicable).

Text

Yes

Last Updated By

Name of the user who last updated the record.

Single-Select

No

Last Updated Date

Date when the record was last updated.

Date

No

Legal Basis for Processing

What is the legal basis that allows you to use the data for this activity?

Multi-Select

Yes

Legitimacy

Can you justify the need and relevance of the data?

Text

Yes

Legitimate Interest

What are the legitimate interests you are pursuing?

Multi-Select

Yes

Locations of Parties (Access/Use)

Location of recipients/individuals who may access or use the data.

Multi-Select

Yes

Managing Organization

OneTrust organization group that this processing activity is related to.

Note:

This field will affect access control and the ability to view and edit this processing activity.

Single-Select

Yes

Master Record

Master inventory record to which the processing activity record belongs (if a local version).

Text

No

Minimization Controls

What are the minimization controls applied to this data element?

Multi-Select

Yes

Name

Name of the processing activity.

Text

Yes

Parties who Access/Use Data

Parties that may have access and may use the data.

Multi-Select

Yes

Policy Document

Is personal data retained and erased according to your policy document, where required?

Text

Yes

Processor Contact Information

Name and contact details of the Processor.

Text

Yes

Processor's Representative & DPO Contact Information

Name and contact details of the Processor's representative and Data Protection Officer.

Text

Yes

Purpose Limitation

Steps taken to ensure processing for specified, explicit, and legitimate purposes.

Multi-Select

Yes

Purpose of Processing

Category of business purpose for processing data.

Multi-Select

Yes

Sale of Personal Information of California Residents

Whether personal information of California residents is "sold" to third parties.

Single-Select

Yes

Sale of Personal Information of Minor California Residents

Whether personal information of California residents under age 16 is "sold" to third parties.

Single-Select

Yes

Schedule Condition for Processing

Further conditions for processing required by the Data Protection Act 2018, Schedule 1.

Single-Select

Yes

Security Considerations

Considerations taken into account for choosing security measures.

Multi-Select

Yes

Status

Status of the processing activity.

Single-Select

No

Storage Limitation

Steps taken to ensure that data are kept in a form that allows identification of individuals for no longer than what is necessary for the processing purpose.

Multi-Select

Yes

Transfer Method (From Sources)

Method for collecting data into the Primary Storage Asset.

Multi-Select

Yes

Transfer Method (To Destinations)

Method for sending data from the Primary Storage Asset to an additional Destination Asset.

Multi-Select

Yes

Type

The type of process represented.

Single-Select

Yes

Use Limitation

Steps taken to ensure that data are not further processed in a manner incompatible with those purposes.

Multi-Select

Yes

Vendor DPA

Is there a data processing agreement in place?

Single-Select

Yes