OneTrust for CCPA
The California Consumer Rights Act of 2018 (CCPA) comes into effect on January 1, 2020. If you're already using OneTrust to manage your organization's privacy program and compliance initiatives, you can easily implement the options features and tools OneTrust has built specifically for CCPA.
How does OneTrust help with CCPA compliance?
ResearchUse OneTrust DataGuidance® Research to research the CCPA by reading the full text of the law, summaries, handbooks, and regulatory guidance written by experts in the field. The resources in OneTrust DataGuidance® Research are continually updated to reflect the latest amendments and other legal changes.
PlanningLeverage OneTrust Maturity and Planning to get your organization ready by measuring your existing privacy program against the requirements in CCPA and other global privacy laws. Identify gaps, review recommended remediation steps, and track your organization's path to compliance. Use the planning assessment to create detailed reports for stakeholders and leadership in your organization to demonstrate the progress and value of your privacy program.
Data Flow TrackingComply with the 12-month "look back" requirement in CCPA by tracking the flows of data that impact California consumers with automatically generated lineage diagrams that describe the flow of data and parties involved. Use OneTrust Data Mapping Automation to define relationships between types of consumer and the data being collected. Then, track, manage, and analyze the categories of data being collected to comply with data requests made by consumers.
Consumer Rights ManagementDisplay the required Do Not Sell My Personal Data link on your websites and then use tools for identity verification, duplicate request management, and deadline tracking to manage the requests you receive. Fulfill Do Not Sell and information requests made by California consumers using dedicated workflows and response templates configured for CCPA consumer rights management.
Do Not Sell for CookiesCategorize and manage the cookies and advertising content on your site that pass and sell data. Use the OneTrust banner script to display your organization's notice of sale and allow consumers to opt out of the sale of their data.
Verified Preference Choices and ConsentIntegrate your existing marketing systems with OneTrust to track and verify consumer consent using flexible identifiers such as email address, membership numbers, device ID, and more. Pass the preference choices selected and consent given to existing systems to ensure opt-out requests are honored and allow your organization to re-solicit consent after the 12-month waiting period.
Vendor ManagementIdentify and assess your organization's vendors to better understand the companies and services with which you share consumer data and may need to contact in order to comply with Do Not Sell requests. Use the information in Vendorpedia by OneTrust to see security, privacy, and contact information for your vendors and potential vendors allowing for greater transparency as your organization evaluates its vendor relationships.
Data Breach Investigation and NotificationInvestigate potential data breaches and assess the impact for each jurisdiction, including California. Leverage templates, notification guidance, and workflows to comply with California data breach regulations and the "Cure Period" requirement in CCPA.
Data Minimization and Purpose LimitationUse OneTrust assessment templates to conduct Privacy Impact Assessments (PIAs) to evaluate your organization's processes and projects for the data minimization and purpose limitations laid out in CCPA and other privacy regulations. These assessment templates can be used to identify how data is used in your organization and automatically flag risks based on assessment responses.
New OneTrust Features for CCPA
Planning Assessment
You can configure a maturity assessment that will measure your organization's program against the requirements of CCPA. This will help to gauge your organization's readiness for compliance and help to identify gaps. The guidance and analysis built in to OneTrust's Maturity and Benchmarking tools can provide a solid foundation for building your privacy program.
Assessment Templates
OneTrust provides a gallery of assessment templates that can be used to evaluate your organization and its processes for readiness and compliance with CCPA and other global regulations.
CCPA Processing Activity Inventory
This template can be used to evaluate and update your processing activity records to include information specific to how data from California residents is sold.
Processing Activity Attributes
You can use attributes to describe the various facets of your processing activities. Starting in OneTrust 5.0, you can leverage default attributes that describe the categories of data being sold and the recipients of the data.
|
Attribute Name |
Attribute Type |
Attribute Value Options |
|---|---|---|
|
Categories of Recipients of Sale of Personal Information of California Residents |
MultiSelect |
B2B Customers Business Partners Service Providers Other |
|
Sale of Personal Information of California Residents |
Single Select |
Yes No |
|
Sale of Personal Information of Minor California Residents
Note:
Under CCPA, "minor" refers to a resident of California under the age of 16. |
Single Select |
Yes No |
Exercise Your Rights Button
Under CCPA, California residents have the right to object to the sale of their personal data. Organizations are also obliged to provide an easy means for consumers to lodge these requests.
OneTrust provides an easy-to-use script that you can implement on your existing website to help individuals submit Do Not Sell requests. When a person clicks on the Exercise Your Rights button, your OneTrust web form will open and the request can be submitted.
For more information about how to add the Exercise Your Rights button, see Embedding the Exercise Your Rights Button.
Targeted Data Discovery for Consumer Requests
Depending on the request, you may need to investigate and manage data held in other systems. You can automate this process through your consumer request workflow using OneTrust Targeted Data Discovery.
Targeted Data Discovery brings integrations with your business applications for CRM, marketing automation, identity management, and more. You can leverage pre-built workflows to automate the discovery and management of personal data in industry-leading applications. You can also build your own workflows to work with your organization's internally-developed and custom tools.
OneTrust provides standard integration workflows for the following applications:
|
System |
Common System Purpose |
|---|---|
|
ForgeRock |
Identity and Access Management |
|
Hubspot |
Marketing and SEO |
|
MailChimp |
Email Marketing |
|
Salesforce |
Customer Relationship Management (CRM) |
|
Okta |
Identity and Access Management |
For more information about OneTrust Targeted Data Discovery, please contact your account executive or OneTrust Support.