Related Data Element Attributes: Feature Guide

What is it?

Advanced attribute tracking offers a way to capture and report on information at a greater level of granularity for better insight and visibility into how specific data elements are treated and processed in the context of a given asset or processing activity.

This feature allows you to add advanced attributes which can be captured per related personal data (per data subject type-data element combination) that is linked to a processing activity or asset.

Who should use the feature? (Use-Cases)

Organizations who want to keep processing activity records broader at a higher business process or single-user flow level but still want to capture specific details about data elements at a granular level.

Organizations concerned with CCPA compliance and reporting on what data is sold and disclosed.

• Utilize the system attributes provided by OneTrust to capture and report on the specific data elements that may be sold or disclosed in the context of a given processing activity.

Organizations requiring the ability to capture data retention and data deletion triggers per data element or data category in the context of a processing activity.

• Use the system attributes provided by OneTrust to capture Data Retention Period per data element/data category in the context of a processing activity.

Challenges/Problems

Most organizations prefer to take the approach of recording processing activities at a broader "business process" level as this is easier to reference internally and in privacy policies/notices and easier to maintain.

Organizations currently have to get very granular when creating processing activities in OneTrust to ensure that all the data elements involved are treated/processed the same since details (such as: purpose and data retention) are captured at the processing activity level. Having a plethora of granular processing activities makes it difficult to gather information and keep it up to date.

Benefits - How does the feature help?

• Enable easier discovery and maintenance of processing activities by allowing organizations to record processing activities at a broader business process level, while still capturing the accurate and necessary details for reporting and record keeping about each data element involved in the process.

• Accurate and relevant reporting to aid in execution of data subject and consumer access requests.

• Easily identify and report on which data elements are sold vs. disclosed to aid in CCPA compliance and disclosure requirements.

• Capture data retention period per data category for accurate GDPR reporting.

Capabilities/Best Practices

1. Configuring Advanced Attributes

   You can activate any of the OneTrust out-of-the-box attributes using the Inventory Manager.

   
   
   

   (Configuring Advanced Attributes)

   Advanced attributes can be configured in the processing activity or asset attribute manager.  In order to add advanced attributes, a user needs the Data Mapping Automation Advanced Attribute Configuration permission.

   This permission is given to the Site Admin, Privacy Officer, Data Mapping Automation Manager and any custom role who has permission to add custom attributes (Inventory Add Attributes).

   Basic vs Advanced

   1. Basic Tracking: these attributes are tracked directly at the inventory record (processing activity or asset) level and will show up on the inventory details page of the processing activity or asset. They can be updated through the inventory details page, through assessment attribute questions, and through the normal ‘bulk update’ import templates.

   2. Advanced Tracking: these attributes are contextual and are populated at the ‘relationship’ level and cannot be captured directly at the inventory record level. Currently, “Advanced” attributes can be tracked per related ‘personal data’. This means that you can populate this field per related data subject type-data element combination in the context of the processing activity or asset that the data subject-element is linked to. 

      Note:

      These attributes will not show up on the inventory details page and can be viewed and populated on the ‘related data elements’ table within the details of the processing activity or asset record.

      There is a column in the attribute manager called Level to help you understand what level the attribute is tracked at. Basic attributes are tracked at the inventory level and “Advanced” attributes are tracked at the related Personal Data level.

      
      
      

2. Populating and Gathering Information on Advanced Attributes

   Related data elements attributes can be populated into the inventory multiple ways.

   Related Data Elements - Populating Advanced Relationship Attributes

   1. Any ‘advanced’ attributes that are in an ‘active’ state in the attribute manager will be displayed as columns on the related data elements table in the details of a given processing activity or asset record.

   2. Use the context menu option on an individual related data element record to edit the relationship attributes of a given data subject type-data element combination that has been linked to the process or asset.

      
      
      

   3. Bulk select data elements and click Edit Details to edit advanced attributes in bulk for a group of data elements (available in version 5.12.0).

   Bulk Import - Bulk Import to Populate Advanced Attributes

   • Use the “Link Personal Data to Inventory” import template to populate information in bulk per related/linked data element.

     
     
     
     Note:

     We recommend exporting your inventory and copying/pasting this information into the bulk import template. If the related “advanced” attribute columns are left blank, they will overwrite any existing values in the inventory. If you do not wish to populate these columns, you can simply remove them from the bulk import template.

   Using Assessments to Populate Advanced Attributes

   You can configure assessment templates to capture data element details for a processing activity or an asset using advanced attributes: Capturing Data Element Details with Advanced Attribute Questions.

   • Configure your assessment template to capture related data element details.

     
     
     

   • Launch the assessment.

     
     
     

   • View updated advanced attribute information in the Related tab of an inventory record.

     
     
     

3. Reporting

   1. Inventory Export - the advanced attribute values will be populated on the processing activity or asset inventory export on the “PA-personal data” or “Asset-personal data” tab of the excel sheet.

   2. Custom Reporting

      1. Summary View

         • You can include these ‘advanced’ attributes in a processing activity or asset column or PDF report. They are listed under the “personal data” category when choosing which fields to include in the report.

           
           
           

      2. Expanded Column Report

         • Once the data subject type or data element attribute has been included in a column report, a new tab will appear on the report called Personal Data Objects – this will allow you to report on each individual data subject type – data element and its ‘advanced’ attributes on individual rows.

           
           
           

Frequently Asked Questions (FAQ)