Step-by-Step Onboarding Guide: Data Mapping Automation

Getting up and running with your Data Mapping Automation solution

The OneTrust Data Mapping Automation Module is implemented to provide you with a means to catalog your data inventory that holds personal data. There are five types of inventories:

  1. Processing Activities

  2. Assets

  3. Vendors

  4. Entities

  5. Projects

These 5 types can collectively be referred to as "Inventory Records". Once set up, you can provide reports for your defined requirements, including identifying where personal data is processed.

Example: A multinational e-commerce company uses the Data Mapping Module to:

  • Map customer data processing activities across different regions

  • Track IT assets that store or process personal data

  • Manage relationships with third-party vendors who have access to customer data

  • Document legal entities involved in cross-border data transfers

  • Monitor data privacy projects, such as GDPR compliance initiatives

Let’s get you started

Follow the steps below to get your solution set up. Each stage of the process is covered by comprehensive guidance and support collateral on the my.onetrust.com online resource platform and this guide will direct you towards all the information you need.



Before you begin

Before you get started with your implementation, complete the following key activities:

  1. Assign Key Decision Makers

    This will be the main point of contact throughout the implementation and will make configuration/setting decisions for the module. These will usually be members of your privacy team and IT systems, but you may also wish to include those who touch on elements such as risks and security.

    Example: For a mid-sized financial services company, the key decision makers might include:

    • Chief Privacy Officer: Overall responsibility for the implementation

    • IT Director: Provides input on technical aspects and system integration

    • Compliance Manager: Ensures alignment with regulatory requirements

    • Head of Customer Service: Offers insights on customer data processing activities

    Identified individuals should take the guided hands on lab and available certification(s).

  2. Source Relevant Applications from Inventory

    Typically found in a CMDB, source the applications that are relevant for your overall Data Mapping Automation exercise; applications are usually privacy related or contain personal data. OneTrust has a standard import format found under Bulk Import to upload these common applications as assets.

    Example: A healthcare provider might identify the following applications for their data mapping exercise:

    • Electronic Health Record (EHR) system

    • Patient scheduling software

    • Billing and claims processing system

    • Internal communication and collaboration tools

    • Third-party laboratory results portal

  3. Gather Existing Processing Activities

    What are your core business processes that collect personal data? These processes can be outlined and assessed within the platform. Gathering these processes usually takes the longest and can be a dependency for launching a Data Mapping Automation assessment.

    Example: A retail company might identify these core processing activities:

    • Customer account creation and management

    • Order processing and fulfillment

    • Marketing email campaigns

    • Customer support ticket handling

    • Loyalty program management

  4. Gather Legal Entities Involved with Processes

    • Who are the legal entities within your company structure?

    • Establish which are the controllers and processors for your processes.

    • Do you have any clients whom you process data for or to whom you sell the data?

    • Categorize these by type to manage and filter between internal corporate structures, partners, and clients, allowing you to identify responsibility for notifications in the case of incidents.

    Example: A global manufacturing company might identify:

    • Parent company (controller)

    • Regional subsidiaries (joint controllers)

    • Outsourced HR service provider (processor)

    • Cloud storage provider (sub-processor)

    • Sales partners in various countries (separate controllers)

  5. Identify Existing Data Elements

    Common data points that you collect about individuals can be captured during the Data Mapping Automation process. Review the top data elements and related data subjects to build out the data element list. Consider how this can be used to meet industry requirements regarding special subjects or categories of data as well as for your privacy regulations.

    Example: An online education platform might collect the following data elements:

    • Full name

    • Email address

    • Date of birth

    • Educational background

    • Course progress and grades

    • Payment information

    • IP address and device information

Data Mapping Automation Configuration

You can access all our knowledge base articles at the link here. The steps below direct you to the most relevant way to get started as quickly as possible.

Step 1: Configure Attributes

Attributes are the key details you want to track and keep up to date on your inventory records for reporting purposes. Attributes are the fields that show up on your inventory details page that provide more specific insight into your inventory records.

Key points:

  • OneTrust provides system attributes out of the box to help with laws like GDPR, CCPA, and others.

  • These can be customized in the Inventory Manager to fit your organization's needs.

  • You can activate and deactivate these system attributes and create your own custom attributes.

  • Attributes can be populated through bulk importing excel files, responses to assessments containing attribute-type questions, public APIs, or directly on the inventory details screen for an individual inventory record.

Example

A travel agency might set up the following custom attributes for their processing activities:

  • "Travel Purpose" (dropdown: Business, Leisure, Mixed)

  • "Involves Minors" (checkbox)

  • "Requires Passport Data" (checkbox)

  • "Destination Region" (multi-select: Europe, Asia, Americas, Africa, Oceania)

Resources

Step 2: Configure Personal Data

Personal data refers to the combination of data subject types (types of individuals) about whom your organization may collect or process information and the data elements (specific pieces of information) that may be processed to carry out various processing activities.

Key points

  • Personal data configuration allows you to build the complete list of options that your business and IT owners will choose from.

  • You can create and manage data categories, which specify the type of information your data elements represent.

  • You can create and manage data classifications, which indicate the sensitivity level of your data elements.

Example

A social media platform might configure the following:

Data Subject Types

  • Registered Users

  • Non-registered Visitors

  • Advertisers

  • Content Creators

Data Categories

  • Account Information

  • User-generated Content

  • Behavioural Data

  • Device Information

Data Classifications

  • Public

  • Internal

  • Confidential

  • Restricted

Methods to build your lists of personal data

  • Bulk import options using the Create/Configure Personal Data Options template.

  • Add data subject types, data classifications, data categories, and data elements through the Inventory Manager.

Resources

Step 3: Create and Manage Assessments

You can directly collect information needed for your inventory records by sending assessments and including specialized questions that will give you detailed insight into your inventories and the information they contain.

Key points

  • Assessments can be built from templates, which are pre-configured to help you achieve detailed and accurate responses.

  • Once an assessment has been assembled, it can be launched and sent out to respondents.

  • Upon completion and approval, the assessment will populate your inventories with the up-to-date information from your respondent's answers.

Example

A bank creating a new mobile app might use the following assessment process:

  1. Use the "Privacy by Design" template from the gallery.

  2. Customize questions to address mobile app-specific concerns.

  3. Add questions about data retention and encryption methods.

  4. Include a section on third-party SDK usage.

  5. Set up an approval workflow involving the privacy team, IT security, and legal department.

Most Common Templates

  • Processing Activity Template

  • CCPA Processing Activity Inventory

  • Asset Discovery Questionnaire

  • Legal Entities Questionnaire

Resources

Step 4: Populate Inventory Records

Assets

Assets are the applications and systems, both internal and third-party, that are used to collect, store, process, or access personal data in support of various business processes.

Methods to populate your asset inventory

  • Survey IT owners to gather asset information

  • Bulk import a list of assets

  • Discover assets by scanning IdP systems

  • Manually create asset inventory records

Example

A technology company might list the following assets:

  • Customer Relationship Management (CRM) system

  • Internal HR database

  • Cloud-based email service

  • On-premises file servers

  • Mobile device management solution

Processing Activities

A processing activity is a business activity that involves the collection, storage, processing, and potential disclosure, sharing, or selling of personal information.

Methods to populate your processing activity inventory

  • Survey business process owners to gather processing activity information

  • Bulk import your list of processes

  • Manually create processing activity inventory records

  • We also have a Process Gallery, which gives you a list of sample processes we have gathered from various industries for you to choose from and populate further

Example

A fitness tracking app company might list these processing activities:

  • User registration and profile creation

  • Daily activity and exercise logging

  • Sleep pattern analysis

  • Social features (friend connections, activity sharing)

  • Personalized fitness goal recommendations

Entities

Legal entities are organizations other than third-party service providers that are involved in your organization's data processes.

Methods to populate your entity inventory

  • Survey legal or privacy teams for legal entity information

  • Bulk import a list of legal entities

  • Manually create legal entity inventory records

Example

A multinational corporation might list:

  • Global headquarters (USA)

  • European regional office (Ireland)

  • Manufacturing subsidiary (China)

  • Research and development canter (Israel)

  • Sales office (Brazil)

Vendors

Vendors are any external, third-party providers of goods or services involved in your data collection processes.

Methods to populate your vendor inventory

  • Survey third-party vendors to gather information on data collection, disclosure, or retention

  • Bulk import your list of vendors

  • Manually create vendor inventory records

Example

An e-commerce platform might list these vendors:

  • Cloud hosting provider

  • Payment gateway service

  • Customer support chatbot

  • Email marketing tool

  • Shipping and logistics partners

Resources

Step 5: Create Relationships Between Inventory Records

Relationship types describe the link between two inventory records. Certain types of relationships can be used with specific pairings to create links.

Key points

  • Linking and creating structured relationships is essential for processing business, asset, and legal information to generate an accurate record of processing.

  • Structured relationships make reporting and record keeping quick and efficient.

  • The tool helps avoid duplicating your efforts, which maximizes your capabilities and allows you to transition seamlessly into future enhancements.

Example

For a customer support process, you might create the following relationships:

  • Processing Activity "Handle Customer Inquiries" is linked to:

    • Asset: "Customer Support Ticketing System"

    • Vendor: "Cloud-based Call Centre Software"

    • Entity: "Customer Support Department (USA)"

  • The "Customer Support Ticketing System" asset is linked to:

    • Vendor: "Ticketing Software Provider"

    • Personal Data: "Customer Name," "Email," "Purchase History"

Resources

Step 6: Reporting

Create insightful reports and dashboards to demonstrate accountability and compliance.

Reports allow you to display information and metrics using specific data sources within your OneTrust Application, such as details about:

  • Assessments

  • Inventory Records

  • Relationships & Personal Data Information

Dashboards offer:

  • A comprehensive view of your organization's capacity with visualizations that provide critical metrics.

  • Ability to create custom dashboards for your assessments, processing activities, assets, and vendors.

  • Build custom widgets and assemble them in a custom dashboard to highlight criteria most relevant to your organization's day-to-day operations and business needs.

Data Mapping Automation-specific visualization tools are also available, including:

  • Data lineage diagrams - which depict the flow of data involved in a specific processing activity and related inventory items.

  • Asset map - which displays your assets organized by hosting location.

  • Cross-border map - which shows cross-border transfers of data taking place within your processing activities.

Use the below Data Mapping Automation specific articles to help you:

For all reporting and dashboard articles, click here.

Complete!

Congratulations on completing your implementation.

Implementing OneTrust's Data Mapping Automation module as outlined in this guide provides a solid foundation for understanding and managing your organization's data landscape. To maximize its benefits:

  • Regularly update your inventory records to maintain an accurate representation of your data processing activities.

  • Utilize the reporting and visualization tools to gain insights and identify potential privacy risks.

  • Integrate this module with other privacy management processes, such as PIAs and DSARs, for a comprehensive privacy program.

Effective data mapping not only aids in regulatory compliance but also enhances decision-making and streamlines data governance. Stay proactive in maintaining your data map, and leverage OneTrust's resources to continually refine your approach to data management and privacy.