Data Mapping FAQ

No, the organization of the user does not need to be the same as the managing organization of the record. However, the user would need to be in the same hierarchy to be able to view the record and to answer assessment questions on it, unless the Access Control Override for Inventory Selection setting is enabled.

Primary records are used in assessments and are indicators on your inventory questions that tell the system which inventory type could be the main record for the assessment. Admin-driven templates can have more than one inventory type as the primary record (only one primary record for each inventory type), but when launching that template as an assessment, only one can be the primary record for that specific assessment. You must select one from the drop down when launching the assessment.

When primary record is set:

• It helps retrieve relationship information and prep-populate all connected Assets, Vendors, and Legal Entities in assessments.

• It also helps create follow-up assessments, e.g., a ROPA assessment followed by a DPIA assessment.

  Primary records tell system what to copy over from the previous assessment. So if the same inventory type is set as primary record in a follow-up assessment, the system will copy over and pre-populate inventory relationships.

  We recommend starting a TIA upon submission, but that PIA or DPIA assessments should be launched only upon approval, so that entries and relationships from the previous assessments are saved in the inventory and pre-populated in the follow-up assessment.

Standard users such as Project Respondents wouldn’t be able to, they would just be able to answer the questions within their assigned section. Users with elevated permissions (such as a Privacy Officer or Site Admin) would have the option to answer all questions regardless of their assigned assessment section.

Yes, from the inventory screen, use the check box to select multiple inventories or multiple inventories across pages to bulk launch assessments.

If the same attribute questions are included, the attribute values will still pull through in a different assessment template (given that the pre-populated attribute values setting is enabled in the assessment template.) Any assessment questions that are not attribute question types will not pull through from one assessment template to another.

You can use the \Localization Editor to replace the Skipped value with -.

Yes. On the bulk import template, you will need a separate line for each relationship and relationship type.

No, only to an internal user that has a user profile in OneTrust can be assigned to a risk.

No, automation rules can only be configured to send reports to internal, OneTrust users. Instead, create and download the report to send to the DPO.

The Inventory items are fetched based on Assessment Organization, not the user’s organization.

Yes, any record can be setup as a master as long as the user has permission to create master records and has access to that record (the record’s managing org must belong to the users organization or sub-organization).

No. Automatic inheritance does not currently include inheriting related inventories.

Consider the intent of the assessment, as well as which question is defining the purpose of the assessment. For example, if you're building a template for evaluating a vendor and your template contains a question like "What vendor are you assessing?", then this should be the primary record question.

No, there can only be one primary record per assessment.

Personal data is any information related to an identified or identifiable natural person. It is the information on individuals that can be collected, stored, or shared.

Yes, Projects can be related to all four existing inventory types: Assets, Entities, Vendors, and Processing Activities.

OneTrust generally refreshes every 30 minutes for all Dashboards & Reporting features, including column reports, PDF reports, and dashboards. Most data should appear in approximately 30 minutes, but it could take up to 90 minutes in certain situations based on volume. However, please expect larger times for updates to reporting services in case of bulk imports, updates, or deletion of data.

No. Inheritance settings must be configured separately for each master record.

Customize the inventory view to include the Master Record and/or Is Master attribute value.

Vendors represent third-party service providers whereas Legal Entities could represent either internal organizations or external organizations that aren’t necessarily service providers/vendors but could be involved in data processing activities.

The Cross-Border Map will show the cross-border transfers of data based on information from your related inventories. For more information on the Cross-Border Map, review this article.

Legal Entities are only shown on a lineage diagram when they are linked to processing activities as Source/Collection, Storage/Processing, or Destination/Access.

This is not yet supported but is on the roadmap. You can vote for the idea in our Ideas Portal.

Managing attribute visibility is possible by organization level, but not by individual inventory record. Child organizations can inherit the visible attributes from parent organizations or selectively by enabling the Override feature. This allows organizations to customize the visible attributes for Processing Activities, Assets, Legal Entities, and Vendors based on child organizations or reflect regional differences within an account.

For more information, see Managing Attribute Visibility Based on Organization.

Inventory records (such as processing activities, Assets, Vendors, and Entities) are used to document and manage your organization’s data landscape. These records are designed to capture detailed information, support reporting, and be populated and updated through assessments.

Object records (such as Projects or AI Systems) are used to organize and provide context for related records across modules. For example, a Project can group together multiple inventory records and link them to assessments and workflows.

Object records do not behave the same as inventory records. For example:

• Object records are not used as primary records of processing or data mapping.

• Object records do not support the same level of data capture and reporting as inventory records.

• Object records may require object-specific question types in assessment templates rather than inventory question types.

You should use inventory records to capture and maintain your data (for example, Processing activities, Assets, or Vendors) and object records to provide context, group related items, or track initiatives (such as projects), rather than as a replacement for inventory records.