Leveraging Privacy Rights Automation for US Privacy Law

Below is a guide to the available Privacy Rights Automation web forms, workflows, and response templates for each state. Guidance is provided for states with privacy regulations that do not have seeded templates.

For more information on setting up web forms, workflows, and response templates, see the following:

For complete documentation, see the Privacy Rights Automation knowledge base in myOneTrust. 

California

Web Form

Workflows

Response Templates

  • California (CCPA as amended) - 1.0; or

  • United States

  • CCPA (as amended) Right to Correction - 1.0

  • CCPA (as amended) Right to Deletion - 1.0

  • CCPA (as amended) Right to Know (Categories of PI) - 1.0 

  • CCPA (as amended) Right to Know (Selling & Sharing) - 1.0 

  • CCPA (as amended) Right to Know (Specific PI) - 1.0 

  • CCPA (as amended) Right to Limit Use & Disclosure - 1.0 

  • CCPA (as amended) Right to Opt Out - 1.0

  • Right of Deletion (CCPA Section 1798.105)

  • Right to Request Information if Business Collects Personal Information about Consumer (CCPA Sections 1798.100 and 1798.110)

  • Right to Request Information if Business Sells/Discloses Personal Information about Consumer (CCPA Section 1798.115)

  • Verify Consumer Request (CCPA)

  • Not a Verifiable Consumer Request (CCPA)

Colorado

Web Form

Workflows

Response Templates

  • Colorado (CPA); or

  • United States

  • CPA Appeals Workflow

  • CPA Opt Out Workflow

  • CPA Right to Access

  • CPA Right to Correction

  • CPA Right to Deletion 

  • CPA – Acknowledgment

  • CPA – Notice of 45-day extension (CPA 6-1-1306(2))

  • CPA – Right of Access (CPA 6-1-1306(1)(b))

  • CPA – Right to Correction (CPA 6-1-1306(1)(c))

  • CPA – Right to Deletion (CPA 6-1-1306(1)(d))

  • CPA – Right to Opt Out (CPA 6-1-1306(1)(a))

Connecticut

Web Form

Workflows

Response Templates

  • Connecticut (CTDPA); or

  • United States

  • CTDPA Right to Access

  • CTDPA Right to Appeal

  • CTDPA Right to Correction

  • CTDPA Right to Deletion

  • CTDPA Right to Opt Out

  • CTDPA Right to Revoke Consent - 1.0 (Preview Feature)

  • CDTPA – Acknowledgement

  • CDTPA – Appeal (CTDPA §4(d))

  • CDTPA – Notice of 45-day Extension (CTDPA §4(c)(1))

  • CDTPA – Opt Out of Automated Decision Making

  • CDTPA – Right of Access (CTDPA §4(a)(4))

  • CDTPA – Right of Correction (CTDPA §4(a)(2))

  • CDTPA – Right to Deletion (CTDPA §4(a)(3))

  • CDTPA – Right to Opt Out (CTDPA §4(a)(5))

Delaware

Web Form

Workflows

Response Templates

We suggests to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

Florida

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

Indiana

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

Iowa

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

Kentucky

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

Montana

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

Nevada

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Non-Discrimination

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

New Hampshire

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

New Jersey

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

Oregon

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making
Note:

The following workflows are available as a preview feature. To enable this feature, contact OneTrust Support or your account representative.

  • OCPA Appeals Workflow - 1.0

  • OCPA Right of Access - 1.0

  • OCPA Right to be Informed - 1.0

  • OCPA Right to Erasure - 1.0

  • OCPA Right to Opt Out - 1.0

  • OCPA Right to Rectification - 1.0

  • OCPA Right to Revoke Consent - 1.0

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

Tennessee

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

Texas

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Rectification

  • Right to Erasure

  • Right to Object/Opt Out

  • Right to Portability

  • Right to not be subject to automated decision-making
Note:

The following workflows are available as a preview feature. To enable this feature, contact OneTrust Support or your account representative.

  • TDPSA Appeals Workflow - 1.0 

  • TDPSA Right of Access - 1.0 

  • TDPSA Right to Correction - 1.0 

  • TDPSA Right to Deletion - 1.0

  • TDPSA Right to Opt Out - 1.0

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US Privacy Law - Appeal

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Opt out of Automated Decision-Making

  • General US State Privacy - Right of Correction

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer

  • General US State Privacy - Right to Limit Use/Disclosure of Sensitive Personal Information

  • General US State Privacy - Right to Opt Out

Utah

Web Form

Workflows

Response Templates

  • Utah (UCPA); or

  • United States

  • UCPA Opt Out Workflow

  • UCPA Right of Access

  • UCPA Right to Deletion

  • UCPA – Acknowledgement

  • UCPA – Notice of 45-day Extension (UCPA §4(c)(1))

  • UCPA – Right of Access (UCPA §5(1)(a)-(b); UCPA §5(3))

  • UCPA – Right to Deletion (UCPA §5(2))

  • UCPA – Right to Opt-out (UCPA §5(4))

Virginia

Web Form

Workflows

Response Templates

  • Virginia (CDPA); or

  • United States

  • Virginia CDPA Appeals Workflow

  • Virginia CDPA Workflow

  • CDPA – Automated Decision Making

  • CDPA – Correction Request

  • CDPA – Data Portability Request

  • CDPA – Deletion Request

  • CDPA – Opt Out Request

  • CDPA – Access Request

  • CDPA – Appeal

Washington

Web Form

Workflows

Response Templates

We suggest to create a web form with the below request types:

  • Right to be Informed

  • Right to Access

  • Right to Erasure

We suggest to create one workflow per request type with subtasks relevant to each request type.

You may want to use CCPA (as amended) workflows as templates to model off of.

We suggest to create one response template per request type.

You may want to use the general US State Privacy Response Templates as templates to model off of.

  • General US State Privacy - Acknowledgement

  • General US State Privacy - Not a Verifiable Consumer Request

  • General US State Privacy - Notice of 45-day Extension

  • General US State Privacy - Right to Deletion

  • General US State Privacy - Right to Know Information Sold/Shared

  • General US State Privacy - Right to Know Information the Business Holds About the Consumer