Legal Entities: Feature Guide

What is it?

The legal entities inventory provides a structured way to capture, store, and report on the details (location, DPO details, contact info etc.) of the entities involved in various data processing activities. You can re-use that information across processing activity records and generate accurate and up to date reports.

Who should use the feature?

All organizations using the Data Mapping Automation module are encouraged to use legal entities as it provides a structured way to store information on the organizations involved in various data processing activities.

Processing using OneTrust:

• Record your clients/customers in the legal entities module with the "type" attribute set to 'client'.

• Use the linking feature to relate the customers (legal entities) to the various processing activities (services/categories of processing your organization provides) that the clients are acting as 'controllers'.

Large multi-national organizations will multiple DPOs that consist of: Various brands, operating companies, subsidiaries, or affiliates operating under one parent company.

• Record all of your internal legal entities - Subsidiaries, affiliates, operating companies, business partners as legal entities.

• Relate/link the legal entities to processing activities to better understand data flow and legal responsibility (controller, processor, joint controller relationship to process).

Organizations concerned with CCPA compliance:

• Associate legal entities to processing activities using the 'recipient of sale' link type to capture information on which entities, perhaps business partners or affiliates, you may be selling information to as a part of a process.

  Note:

  You can also capture which third party vendors/service providers you sell information to for a process by linking vendors to processing activities with the same link type.

Challenges/Problems

Before the legal entities inventory, clients were using free text attributes on the processing activities to capture controller and processor DPO information and contact details. Due to the unstructured nature of free text fields, it is difficult to report on them. Additionally, this resulted in a lot of manual/duplicate effort, maintenance, and user error because the fields capturing this information had to be filled out and updated on ever single processing activity record.

Benefits - How does the feature help?

Capturing information and storing it in a structured manner by using the entities inventory and the entity relationships will reduce manual effort, improve reporting and visualization capabilities, and allow you to get the most value out of your data.

Structured data for visuals and reports:

• Capture data flows between various legal entities for a given processing activity by linking them to the process using the 'collection/source' 'storage/processing' and 'destination/access' link types to visualize the entities on the lineage diagram.

Reduce maintenance, manual effort, and questions for business owners:

• Capture information such as DPO, contact details, operating location, on a legal entity once and re-use this information across all processing activities where this entity is involved by linking the entity to the processing activity records.

Accurate and relevant reporting:

• When generating a processing activity or Article 30 report, you can pull in the related legal entity information for those entities linked to the processing activities such as DPO name, contact details, operating location and easily filter and slice and dice on this information.

  
  
  

Capabilities & Best Practices

1. Populating Information

   Details on legal entities can be gathered and populated into the legal entities inventory four ways:

   Bulk Import

   - Use the "Bulk Create/Update" templates to import existing data form an excel file.

   PIA & DPIA Automation

   - Include legal entity 'inventory' type questions and attribute questions into templates to gather information on entities through assessments or use our gallery template "Legal Entities Questions 1.0.0".

   Inventory

   - Enter information directly using the inventory UI.

   Public API's

2. Linking/Creating Relationships

   Relationship between legal entities and processing activities can be created the same four ways as mentioned above.

   Bulk Import

   - Use the "Create Inventory Links" import template to create relationships from existing data in an excel sheet.

   PIA & DPIA Automation

   - If you want to capture information about how various legal entities are involved in processing activities using assessments, here are some tips on how to add this to a custom template: (e.g. what entity is acting as a controller for a processing activity)

   • Add a legal entity 'inventory' question to your processing activity discovery template. (e.g. Who is the controller for this activity?)

   • Link the entity 'inventory' question to the processing activity question.

     • Hover on the inventory question to find the chain link icon.

     • Select the relationship type (what role will the selected as a response to this question be playing for the processing activity. (e.g. Controller)

   
   
   
   
   

   Inventory

   - Link entities from the "related" tab of a processing activity or vice versa on the "related" tab/widget on a legal entity.

   Public API's

   Relationship Types

   - What is available and what should they be used for?

   • Linking legal entities to processing activities

     Legal Responsibility

     - “Controller”, “Joint Controller”, “Processor” Use these relationship types to capture the role the legal entity is playing in a processing activity from a legal standpoint.

     Data Flow

     - “Source/Collection”, “Storage/Processing”, “Destination/Access”, “Recipient of Sale” Use these relationship types to capture how a legal entity could may be involved in a processing activity from a data flow perspective.

3. Reporting and Visualizations

   Storing details of legal entities through a structured inventory and creating structured relationships will enable easier and more accurate reporting. It will also allow you to ensure reports to local regulators only contain the relevant information based on the location of the regulator.

   Note:

   For example, if a German DPA asks for a report on your records of processing, you can generate an Article 30 report and then filter down the report down to only show processing activities where the legal entities linked as 'controllers' are located in Germany so that you're only showing what is relevant to the regulator (see screenshots below for example).

   Filter on "Primary Operating Location - Controller (Entities)" = Germany

   
   
   
   
   

Frequently Asked Questions (FAQ)