Data Mapping Automation Setup Guide

Attributes are the key details you want to track and keep up-to-date on your inventory records for reporting purposes. Attributes are the fields that show up on your inventory details page that provide more specific insight into your inventory records.

OneTrust provides system attributes out of the box to help with laws like GDPR, CCPA, and others, which can be customized in the Inventory Manager to fit your organization's needs. Using the inventory manager, you can activate and deactivate these system attributes and create your own custom attributes.

Attributes can be populated through bulk importing excel files, responses to assessments containing attribute-type questions, public APIs, or directly on the inventory details screen for an individual inventory record.

To learn more, see the following:

• Adding, Editing, and Deactivating Attributes

• Configuring Options for an Attribute

• Configuring Attributes Using the Attribute Configuration Checklist

Personal data refers to the combination of data subject types (types of individuals) about whom your organization may collect or process information and the data elements (specific pieces of information) that may be processed in order to carry out various processing activities.

Personal data configuration allows you to build the complete list of options that your business and IT owners will choose from to indicate which types of individuals (data subject types) and which pieces of information (data elements) are involved in various processing activities and assets.

You can also create and manage data categories, which specify the type of information your data elements represent, and data classifications, which indicate the sensitivity level of your data elements.

Build your lists of personal data by doing any of the following actions:

• Bulk import options using the Create/Configure Personal Data Options template.

• Add data subject types, data classifications, data categories, and data elements through the Inventory Manager.

To learn more, see the following:

• Adding, Editing, and Deleting Personal Data

• Bulk Importing Personal Data

• Assigning Data Elements to a Data Subject Type

• Assigning Data Subject Types to Related Data Elements

• Automated Data Element Detection Feature Guide (for use with the Data Discovery module)

You can directly collect information needed for your inventory records by sending assessments and including specialized questions that will give you detailed insight into your inventories and the information they contain.

Assessments can be built from templates, which are pre-configured to help you achieve detailed and accurate responses. Once an assessment has been assembled, it can be launched and sent out to respondents. Upon completion and approval, the assessment will populate your inventories with the up-to-date information from your respondent's answers.

To learn more, see the following:

• Updating Inventory Records with Assessments

• Adding a New Template from the Gallery

• Creating a New Template

• Publishing a Draft

• Editing a Published Template

• Launching Assessments

• Launching an Inventory Assessment

Assets are the applications and systems, both internal and third-party, that are used to collect, store, process, or access personal data in support of various business processes. An asset is any entity that processes personal data, such as a system, application, database, or even a file cabinet. The types of information you will collect on assets may be more technical in nature and will typically be gathered from IT or application owners. 

Start populating your asset inventory by building out a comprehensive list of the systems, applications, and other assets your organization uses to process data. Populate your asset inventory by doing any of the following actions:

• Survey IT owners to gather asset information

• Bulk import a list of assets

• Discover assets by scanning IdP systems

• Manually create asset inventory records

To learn more, see the following:

• Adding, Editing, and Deleting Inventory Records

• Bulk Import

• Bulk Update

A processing activity is a business activity that involves the collection, storage, processing, and potential disclosure, sharing, or selling of personal information. Processing activities provide the business context as to why a certain asset may be processing data. 

You can populate your processing activity inventory with a list of all the processes, activities, and business functions your organization performs that may involve the processing of personal data. Populate your processing activity inventory by doing any of the following actions:

• Survey business process owners to gather processing activity information

• Bulk import your list of processes

• Manually create processing activity inventory records

To learn more, see the following:

• Adding, Editing, and Deleting Inventory Records

• Bulk Import

• Bulk Update

Legal entities are organizations other than third-party service providers that are involved in your organization's data processes. For example, these entities could be your company's subsidiaries, affiliates, or business parters. Details about legal entities include DPO, contact details, location of operation, etc. Typically, legal entities are related to processing activities to indicate the controller or joint controller of a process.

You can populate a structured list of all the registered businesses who are responsible for and involved in your organizations data processing activities by doing the following:

• Survey legal or privacy teams for legal entity information

• Bulk import a list of legal entities

• Manually create legal entity inventory records

To learn more, see the following:

• Legal Entities: Feature Guide

• Adding, Editing, and Deleting Inventory Records

• Bulk Import

• Bulk Update

Vendors are any external, third-party providers of goods or services involved in your data collection processes.

Vendors can be related to assets to indicate that they are the third-party organization that provides a specific asset or application. Vendors can also be related to processing activities as third-party processor, joint controllers, or a vendor that sources, stores, accesses, or has data sold to it as a part of a process. 

Populate your vendor inventory by doing any of the following actions:

• Survey third-party vendors to gather information on data collection, disclosure, or retention

• Bulk import your list of vendors

• Manually create vendor inventory records

To learn more, see the following:

• Adding, Editing, and Deleting Inventory Records

• Bulk Import

• Bulk Update

Relationship types describe the link between two inventory records. Certain types of relationships can be used with specific pairings to create links.

Linking and creating structured relationships is essential for processing business, asset, and legal information to generate an accurate record of processing. Structured relationships make reporting and record keeping quick and efficient. The tool helps avoid duplicating your efforts, which maximizes your capabilities and allows you to transition seamlessly into future enhancements.

You can create relationships between assets, processing activities, legal entities, and vendors to understand the full context and data flow of your organization's personal data.

To learn more, see the following:

• Creating and Managing Contextual Relationships

• About Inventory Linking and Relationships

• Configuring Data Lineage and Auto-Draw: Best Practices

Create insightful reports and visualizations to demonstrate accountability and compliance and obtain a high-level overview of your organization's compliance practices.

Reports allow you to display information and metrics, such as details about your assessments, inventory records, consent transactions, and data subject requests using specific data sources within your OneTrust application.

Dashboards offer a comprehensive view of your organization's capacity with visualizations that provide critical metrics. You can build custom dashboards for your assessments, processing activities, assets, and vendors. You can also build custom widgets and assemble them in a custom dashboard to highlight criteria most relevant to your organization's day-to-day operations and business needs.

Data Mapping Automation-specific visualization tools are also available, including data lineage diagrams, which depict the flow of data involved in a specific processing activity and related inventory items, an asset map, which displays your assets organized by hosting location, and a cross-border map, which shows cross-border transfers of data taking place within your processing activities.

To learn more, see the following:

• Mapping Processing Activity Lineage

• Viewing an Asset Map

• Visualizing Cross-Border Processing Activities

• Using the Risk Dashboard