Privacy Rights Automation Security Guide
Introduction
Welcome to the OneTrust Privacy Rights Automation overview and security document.
The module provides a way for your organization to manage data subject requests and consumer rights request inside of a secure platform. Data subject authentication, communication, and information are all contained securely within the OneTrust application and Privacy Portal application, giving your organization full control of any personal data related to a data subject.
The module includes enhanced security measures, as well as encryption of personal data in transit and at rest. Access to any such personal data is strictly controlled using roles-based access and organizational hierarchy inside the OneTrust application.
Architecture Overview
The OneTrust application provides the platform for configuring and managing workflows that data subjects can use to log any privacy related inquiries. These inquiries are then delegated and managed inside the OneTrust application. Once these inquiries are reviewed and responded to by the privacy team, communication is required with the data subject. This communication is facilitated in a separate, secure Privacy Portal application. Data subjects are given a link for the validated email address they provided in the initial request, which gives them access to the Privacy Portal to correspond with the privacy team. The Privacy Portal provides data subjects with a way to access their personal data and correspond with the privacy team without sensitive information ever being transmitted over email or unsecured channels. All messaging and attachments provided by the privacy team are securely contained within the Privacy Portal. These communications are never sent over email.
Security
Encryption
Each piece of PII in the module is encrypted at rest and in transit. An independent encryption service is called every time data is retrieved or stored in the database. Data is only decrypted for the moment it is in use. An environment-specific Master Key and a tenant-specific Operational Key are both required to properly decrypt data maintained in the OneTrust database. Operational keys are encrypted via the environment's master encryption key using AES 256. The master encryption key is stored in a Java key store.
Security Practices
The OneTrust application uses SSL certificates, HTTPS endpoints, TLS ciphers, and a web application firewall to prevent malicious access and provide secure transport between the application and your browser. All data transported between the OneTrust application and your browser session are encrypted and rendered un-usable to an unauthorized user.
Accessing the Privacy Portal
Data subjects can only log in to the Privacy Portal by using the email address submitted with the web form. Email addresses can be independently verified by your Privacy Team before any access to the Privacy Portal is given.
Data subjects access the Privacy Portal using a secure link sent via email that is provided whenever a member of your organization posts a public reply to the request. The link is not provided in the initial request submission confirmation email. This link can be clicked up to 10 times for re-entry.
Before entering the Privacy Portal, data subjects will be prompted to request a one-time access code that will be sent to their verified email. They will also need to complete the Captcha validation.
Data subjects can select the Remember this device setting to remain signed into the Privacy Portal for specific number of days, which is configured in the Global Settings menu. Data subjects can remain in the Privacy Portal as long as they remain active. Once data subjects exit the Privacy Portal, they will need to enter their email again to request a new one-time access code to enter the Privacy Portal.
Role-Based Access Control & Organizational Hierarchy
Roles can be individually set on user accounts in the OneTrust application, with specific permissions that can only access the parts of the application you want them to see. All roles and permissions are managed by Site Administrator users, which can be tailored to meet your business and privacy needs. Permissions restrict access to functionality, and data that you do or do not want to make available to specific users.
The OneTrust organizational structure provides an additional level of control to direct information between organizations that fall on the same tier.
FAQ
How are requests logged?
In the OneTrust application, Site Administrator users configure web forms that contain custom branding and styling for a particular organization. Once configured, an HTML link is generated that organizations can embedded on their privacy policy pages, making the web form available for data subjects to submit requests.
Web forms are hosted by the OneTrust application, meaning web form submission is performed directly in the OneTrust platform. Requests can also be created using the Asynchronous Request Creation API, which is secured by safelisted URLs, an API token, and an expected payload. On Premises clients will need host this on their own infrastructure.
How long are requests stored in OneTrust?
Indefinitely until they are manually deleted from the application. For more information, see Deleting a Request Permanently.
How does my Privacy Team communicate with a data subject
If a privacy team member needs to correspond with a data subject, they can simply view the request related to the data subject, select a public reply, and enter a message pertinent to their workflow. This sends an email notification to the data subject notifying them of a message for them in the Privacy Portal and providing a link to access the message.
If my Privacy Team wants to communicate with a data subject, isn't it risky to send personal data over email
Yes, which is why all communication between the Privacy Team and the data subject is conducted inside of the secure Privacy Portal. When a Privacy Team member replies to the data subject, the data subject is given temporary access to the Privacy Portal, where they can view the comments made by the privacy team, download any attachments, and reply to the Privacy Team without their information ever leaving the secure environment. Data subjects can upload attachments to send to the Privacy Team as well, in case more information is needed.
What if the data subject wants to track the status of their request or make additional inquiries?
Data subjects can always return to the Privacy Portal to review the status of their requests and correspond with the privacy team. Each time they return to the Privacy Portal, a one-time password (OTP) is sent to their email account for additional verification. Links are only valid for a single session and a new link needs to be generated for each session when the Privacy Team has not actively reached out to the data subject.
Can anyone with an email address can get into the Privacy Portal?
No. Data subjects cannot access the Privacy Portal unless their identity and email address have been independently verified and approved by the Privacy Team. If a data subject’s identity cannot be verified by the Privacy Team, then the request can be rejected by the privacy team, and the data subject is only notified of the rejection - without gaining access to the Privacy Portal.
Why don’t we just have data subjects create their own username and passwords for the Privacy Portal?
Remembering all the usernames and passwords they have for various accounts is challenging and cumbersome for users. OneTrust streamlines authentication by verifying a data subject’s email address, and then providing access via a link sent through email. Users will use this to request a one-time password and access the Privacy Portal for a secure session. By using this method, the data subject doesn’t have to remember any new information.
Who can see 'internal’ comments by the Privacy Team?
Site Admins, Privacy Officers, request approvers, and users assigned to complete subtasks, are the only ones who can see all of the internal’ comments made on a request. These comments are never made available to the data subject in the Privacy Portal, only public comments are.
Can people who are assigned subtasks reply to a data subject?
They cannot. Subtask assignees can only complete the subtask assigned to them or post internal comments back to the approver of the request or Privacy Team members.
Can web forms be pre-filled existing information in a system?
Organizations can set up OpenID Connect (OIDC) integration for web forms to pre-fill fields with information from Identity Providers (IdPs) who support the implicit grant type. This allows organizations to populate web form fields with users that already exist in a given system.
Web form OIDC requires a secure integration between the OneTrust web form and the IdP, which enables mapping of custom scopes and claims to collect specific information and fill the corresponding web form field. These fields cannot be edited once filled.
How secure are the API calls used to create web forms?
OneTrust encrypts its API calls using the Transport Layer Security (TLS) 1.2 protocol as a supported solution to securing communications. API calls are tied via an access token between the user session and their respective account. This ensures that communication to and from OneTrust during web form creation is secured over a network.
Can I integrate OneTrust with my existing identity providers to process identity verification?
Yes, OneTrust supports partnerships with identity providers to assist with identity verification. When data subjects submit their request, Privacy Teams can add verification methods within the request workflow to process identity verification before honoring the request fulfillment. Privacy Team members can view the verification status, collect documentation, and track comments in the verification results.