Using Data Redaction for Privacy Requests
This article references UI components and configuration practices that are considered part of the Legacy workflow. OneTrust encourages all Data Redaction customers to migrate their redaction management to the Unified Product released in OneTrust 6.31. For more information, see OneTrust DSAR Redaction Feature Guide.
OneTrust Data Redaction is a new and powerful feature set that allows Privacy and IT teams tasked with privacy request fulfillment to use the power of Athena AI to redact third party and sensitive information from data sets prepared for access requests. Data Redaction not only helps reduce the manual overhead of data redaction and aggregation involved in privacy request fulfillment but also the risk of inadvertently causing a data breach.
This intelligent tool is able to discern and pull in all unstructured text to the Results Summary for a given request and automatically classify the populated results according to predefined data categories. Users will then be able to manually redact or remove elements as necessary during review before sharing the results with the data subject via the secure messaging portal.
Data Redaction can be used in the event an employee submits an access request to their employer and asks for a copy of all personally identifiable information (PII) their employer has collected from start of employment. Redacting the unstructured nature of data is particularly helpful when parsing dense volumes of information, such as threaded email responses, to detect and classify data elements which are confidential or irrelevant to the individual. Given the possible hundred or thousands of emails pertinent to the data subject, this DSAR add-on automates an otherwise tedious censoring process for privacy teams.
Launching the Integration
An integration for Data Redaction begins with a system subtask configured on a request workflow to kick off the initial GET call to scan all the relevant user emails in the system. OneTrust will retrieve those emails, post the unstructured text to the given request's Results Summary, and then redact the data elements found using OneTrust's classification service. This will update the system subtask status to Ready for Review .
For more information, see Configuring the Integration for Data Redaction.
Reviewing the Results Summary
The Results Summary screen will populate the unstructured data elements in the default group Unstructured Data with an preliminary Ready for Review status. Data elements that were not successfully assigned a classification will appear with a Not Classified label.
Click a result to review which data elements were detected and automatically redacted from the unstructured text in the Redaction Review pane.
The preview window will display the unstructured text and represent the text redaction with a darkened highlight. The Data Elements Detected section lists the retrieved identifiers and their respective classification category and confidence score level.
For more information, see Managing Redactions in the Results Summary.
Manually Redacting Results
If there is a data element that doesn't require redaction or was incorrectly redacted, you can either a) uncheck the identifier from the detection list or b) highlight the selection and click the Clear Redaction icon to remove the redaction from the preview.
If the classification service did not redact a sensitive data element which should be, you can highlight the selection in the preview and click the Redact icon. The selected text is now darkened, marking the identifier as redacted.
For more information, see Managing Redactions in the Results Summary.
Viewing Suggested Redactions
When data elements are discovered and displayed in the results summary, the Suggestion Redactions tab will populate a list of proposed data redactions by Athena AI for consideration.
Click a discovered identifier from the Suggested Redactions list to review additional details, which includes field name, content, type, and more. You can also select a specific Field Name to open the Redaction Review pane.
For more information, see Managing Suggested Redaction Results.
Excluding Redaction Results
You can exclude data elements from the Unstructured Data group prior to sharing results with data subjects. Either click the Context Menu of a single field then click Exclude Result, or select all desired results then click the Remove icon. Confirm this choice and the selected data elements will be moved to the Excluded - Unstructured Data group.
If you need to add back any excluded results to the Unstructured Data group, simply select the results in the Excluded - Unstructured Data group and click the Add icon. The Add to Group modal appears with the Unstructured Data group selected by default.
For more information, see Managing Redactions in the Results Summary.
Sharing Redaction Results
Once text is redacted and reviewed by a privacy team, the results summary can be exported to a .csv file to share with the data subject along with the structured data already supported by the export sent via a public comment.
Data subjects will be able to download this attachment from the Privacy Portal comment and see their collected PII. Concealed data elements will be replaced by X's within the file.
For more information, see Sharing Redaction Results with Data Subjects.