Using Advanced Attributes for CCPA Compliance

Introduction

Keeping track of which processing activities entail the sale or disclosure of personal data is key to CCPA compliance. CCPA disclosure requirements specify that organizations inform consumers when their data is sold or disclosed for business purposes. You can use the advanced system attributes Is Data Sold? and Is Data Disclosed? to track the sale and disclosure of personal data related to a specific processing activity.

Using Advanced Attributes for CCPA

Advanced attribute tracking offers a way to capture and report on information at a greater level of granularity for better insight and visibility into how specific data elements are treated and processed in the context of a processing activity. Advanced attributes can be captured per related personal data (per data subject type-data element combination) that is linked to a processing activity.

CCPA advanced attributes are available in the Process Attributes list in the Inventory Manager. These attributes gather information on the personal data within an inventory, instead of just gathering information on the inventory itself, and will display as existing at the Personal Data level. This allows you to gather and track information on how personal data within a processing activity is being handled.

For example, an entity may collect and process several different pieces of personal data from your employees as part of the onboarding process. As a result of that processing activity, the entity may disclose some data and sell other data. You can update, through the Inventory Details screen or assessments, the Is Data Sold? or Is Data Disclosed? attributes for every data element related to that process, ultimately supporting enhanced CCPA compliance.

Best Practices

Once activated, you can populate the Is Data Sold? and Is Data Disclosed? attributes for each related data element by selecting Edit Data Element Details from the Context Menu in a processing activity's Related tab. You can also update the attributes by adding them to assessments.

Activating CCPA Attributes in the Inventory Manager

Before you can use CCPA advanced attributes to collect information processing activities, you must activate the attributes in the Inventory Manager.



Once activated, you can configure assessment templates to update these attributes for data elements related to a processing activity record.

Using the Related Data Elements Tab

You can keep track of data sale and disclose directly within your processing activity records. To start, go to the Related tab of a processing activity record's Inventory Details screen and click the View More button under Related Data Elements.

Start by selecting an inventory from your Inventory list and going to the Related tab. Click View More under Related Data Elements.



Ensure that the attributes Is Data Sold? and Is Data Disclosed? are listed under Visible Fields in the Column Selector.



To configure advanced attribute responses, select Edit Data Element Details from the Context Menu. You can also configure advanced attributes for multiple elements at once by using the checkboxes and clicking Edit Details.



Select responses for the Is Data Sold? and Is Data Disclosed? attributes.

Note:

All activated advanced process attributes will display in the modal, regardless of Column Selector visibility configuration.



Launching Assessments

In order for your assessments to update advanced CCPA attributes, follow the steps below. You will need to configure a template and launch an assessment. Once the assessment is completed and approved, the responses will update the advanced attributes. The updates will be viewable in a processing activity record's Related tab.

  1. Set up your assessment template

    To get started, you can select a template from the template gallery or create your own custom template.

    When configuring your template, there are three key steps to ensure responses will update advanced CCPA attributes.

    1. Establish a primary record inventory question

      The primary record question should be the very first question in your template. This question will determine which processing activity your data elements are linked to and which advanced attributes are updated with response information.





    2. Add a personal data question

      In your template, add a personal data question after your primary record question. This question can be in a different section of the template. If you're working from a pre-configured gallery template, check to make sure it includes a personal data question.



    3. Link your primary record and personal data questions

      The personal data question must be linked to your primary record to establish a relationship between the two and indicate the processing activity record to which your data elements are related.

      To link your personal data question to your primary record question, click the link icon on the personal data question in the Builder.



      Select Relate to an Inventory Question and select your primary record question from the Related Question menu.



    4. Add an attribute question with the personal data question as source

      After the personal data question, add an attribute question which updates the personal data question. Select a CCPA advanced attribute for the response to update.



  2. Launch the assessment

    Once your template has been configured to update advanced attributes and published, it can be launched as an assessment.



  3. Provide and review responses to the assessment

    When respondents are answering the personal data question, they will select applicable data elements for each relevant data subject type.



    To answer the advanced attribute question you've configured, respondents will provide answers that update the advanced attribute you've selected. Once the personal data question is answered, the advanced attribute question will appear. Respondents can click the Edit Answers button to open the question and leave responses.

    When responding to an advanced attribute question, all of the data subject types and data elements selected from the personal data question will display. The respondent will be able to provide responses for each data element.



    The respondent can also apply a response to multiple data elements by selecting multiple elements and clicking Apply to Selected after responding. Entire data categories or data subject types can also be selected. Once the responses are applied, they can be saved by clicking the Save button.



    Upon submission, reviewers will be able to view responses to the advanced attribute question.



  4. View inventory updates in the Related tab

    Once the assessment has been completed and approved, the responses will updated the advanced attributes on your inventory record's related data elements. You can view the updated data element details in the Related tab of an inventory record.



    Note:

    The assessment stage must be Approved for this data to populate.

Reporting

When activated, CCPA advanced attributes and their responses will display for each processing activity in your processing activity exports in the PA - Personal Data tab.



When creating processing activity column reports, you can include the Is Data Disclosed? and Is Data Sold? attributes by moving them to Visible Fields in the Column Selector after the report has been created.



A column for the attribute will display in-app and in column report exports.