Step-by-Step Onboarding Guide: Privacy Rights Automation with Data Redaction

Get up and running with your Privacy Rights Automation solution

The OneTrust Privacy Rights Automation module provides a way for your organization to manage privacy rights requests inside of a secure platform. Requestor authentication, communication, and information are all contained securely within the OneTrust application and Privacy Portal application, giving your organization full control of any personal data related to an individual.

The Privacy Rights Automation module includes enhanced security measures, as well as encryption of personal data in transit and at rest. Access to any such personal data is strictly controlled using roles-based access and organizational hierarchy inside the OneTrust application.

Let’s get you started

Follow the steps below to get your solution set up. Each stage of the process is covered by comprehensive guidance and support on the my.onetrust.com online resource platform and this guide will direct you towards all the information you need.



Before you begin

Before you get started with your implementation, complete the following key activities which will help you accelerate your implementation. Each step includes an explanation of its importance and examples to illustrate how it can be applied in practice.

  1. Assign key decision maker

    Choosing a key decision-maker is crucial for maintaining consistency and accountability throughout the implementation process. This individual will be the main point of contact for your organization and will work closely with your OneTrust consultant.

    Example: The Director of Data Privacy could be an ideal key decision maker. Their responsibilities would include:

    • Approving the final workflow design

    • Deciding on verification methods for requests

    • Setting retention periods for request data

    • Approving any changes to the privacy rights process

    Identified individuals should take the guided hands on lab and available certification.

  2. Define Requestor Types

    Identifying the types of individuals who might submit requests is essential for creating appropriate webforms and processes. Different categories of requestors may require different handling or verification processes.

    Examples of requestor types include:

    • Employees: Current full-time, part-time, and temporary employees

    • Prospective Employees

    • Customers/Consumers: Both active and former customers

    • Contractors: Freelancers, consultants, and temporary workers

    • Students

    • Website Visitors: Individuals who have interacted with your website but may not have made a purchase

    • Loyalty Program Members: Customers enrolled in a rewards or loyalty program

  3. Outline Supported Request Types

    Different privacy regulations grant individuals various rights. Understanding and defining the types of requests you'll support is crucial for creating appropriate processes and training your team.

    Common example of request types include:

    • Right to disclosure

    • Right to deletion

    • Right to opt out ('Do Not Sell')

    • Right to non-discrimination

    • Right to be informed

    • Right to access

    • Right to rectification

    A full list of privacy regulations and rights afforded under them can be found here.

  4. Identify Request Fulfillers

    Different types of requests may require different expertise or access levels. Identifying who within your organization should fulfill each type of request ensures efficient processing and maintains data security.

    Examples of request fulfillers and their responsibilities:

    • Customer Service Team: Handle initial triage of all requests and fulfill simple access requests.

    • IT Department: Responsible for searching and compiling data from various systems for complex access requests.

    • Legal Team: Review and approve deletion requests to ensure compliance with retention requirements.

    • HR Department: Handle all employee-related requests.

  5. Identify Corresponding IT Teams

    Privacy requests often require accessing data from multiple systems. Identifying the relevant IT teams ensures you have the necessary technical support to fulfill requests accurately and efficiently.

    Examples of IT teams and their roles:

    • Database Administration Team: Access and retrieve data from core customer databases.

    • Cloud Services Team: Manage data stored in cloud-based applications and storage.

    • Legacy Systems Team: Access and retrieve data from older, potentially offline systems.

    • Information Security Team: Ensure secure transfer and handling of sensitive data during the request process.

    These teams should be added as super users in the OneTrust system. Identifying the IT teams that will need to work together to fulfill these requests is a key step in implementing a privacy rights request process.

  6. Analyze Existing Customer Service Processes

    Understanding your current processes for receiving and handling privacy requests helps identify areas for improvement and ensures smooth integration with the OneTrust system.

    Consider the following questions:

    • How is your organization currently accepting requests?

    • Will these processes remain the same after implementing One Trust's Privacy Rights Automation module or will they be absorbed into the new OneTrust process?

    • What changes are you willing to make to adopt this module implementation?

    Examples of existing processes and how they might be integrated:

    • Current email-based request system: Could be integrated with OneTrust by setting up automatic forwarding of privacy-related emails to the OneTrust platform.

    • Existing customer support ticketing system: Could be connected to OneTrust via API to create a seamless workflow.

    • Phone-based requests: Train customer service representatives to input requests received by phone directly into the OneTrust system.

Privacy Rights Automation Configuration

You can access all our knowledge base articles at the link here. The steps below direct you to the most relevant way to get started as quickly as possible.

Step 1: Webforms

Webforms are the primary interface for requestors to submit their requests. They should be designed to collect necessary information while being user-friendly and accessible.

OneTrust provides seeded webform templates to process requests for various global privacy regulations. Many of these templates come equipped with special form fields, conditional skip logic, and specific workflows for improved request fulfillment.

Examples of webform configurations:

  • Multi-language support: Create forms in multiple languages to cater to a diverse customer base.

  • Conditional fields: Show specific fields based on request type (e.g., only show "Account Number" field for access requests).

  • Identity verification: Implement a two-step verification process using email confirmation and a security question.

Additional considerations:

  • Implement auto-calculations for request deadlines, especially for requests taken offline that need to be added to the tool.

  • Add various verification methods to ensure the identity of the requestor.

To help with the configuration of web forms, see the following articles:

Creating a Web Form

Customizing a Web Form

Configuring Multilingual Web Forms

Managing Web Form Settings

Creating Rules for a Web Form

Configuring Dynamic Fields with Visibility Rules

For more information you can see all web form configuration articles here, and some FAQs here.

Step 2: Workflows

Workflows define the process of handling requests from submission to completion. They should be designed to ensure efficiency, compliance, and proper oversight.

Within OneTrust, you can configure your workflow based on the specific requirements of your organization and relevant privacy regulations (such as GDPR, CCPA, or CPRA). Define the sequence of steps, approval processes, and actions for different types of requests.

Examples of workflow configurations:

  • Multi-stage approval process:

    1. Initial review by customer service

    2. Data compilation by IT team

    3. Legal review

    4. Final approval by privacy officer

  • Automated assignment: Assign requests to specific teams based on request type or requestor category.

  • SLA tracking: Set up automatic reminders for approaching deadlines (e.g., 25 days for GDPR requests).

Customizable workflows allow organizations to ensure accurate processing of privacy rights requests. This includes:

  • Configuring stages

  • Offering multilingual guidance text for the privacy team

  • Assigning subtasks to internal users

  • Enabling stage-specific settings

You can configure your workflows to connect with other applications through integrations This is accomplished by adding a system subtask to your workflow that utilizes an integration workflow configured with API triggers and actions.

Additional considerations:

  • Remove stages that are redundant in the workflows

  • Add team-based stages

  • Create internal workflows for employees

  • Consider organizational hierarchy when assigning webforms

Leverage subtasks to enhance collaboration within your organization and to kickstart integration workflows, resulting in more efficient communication, task delegation, and automated request processing.

Examples of subtasks:

  • Data retrieval subtask: Automatically trigger a data pull from the CRM system for access requests.

  • Document redaction subtask: Assign a team member to review and redact sensitive information from compiled documents.

  • Quality check subtask: Have a second team member review the compiled data before sending it to the requestor.

Subtasks are grouped by their workflow stage. Within each stage, subtasks are launched by their due date then alphabetically. When requests are closed or rejected, subtasks in the most current workflow stage will be visible.

Note:

Clarify whether subtasks can run simultaneously or if they must be completed sequentially.

For more information about building and customizing workflows, see the below articles:

For all workflow articles click here, and for workflow FAQs click here.

Step 3: Response Templates

Response templates help ensure consistency in communications with requestors and save time in request processing. They should be clear, informative, and compliant with relevant regulations.

OneTrust Privacy Rights Automation provides the option to utilize the response templates gallery or the text editor to customize the style and format of your organization's custom message that notifies requestors a decision was made regarding their request.

Examples of response templates:

  • Initial acknowledgment: "Thank you for your [request type]. We have received your request and will process it within [X] days."

  • Request for additional information: "To proceed with your request, we need additional verification. Please provide [specific document or information]."

  • Complete fulfillment: "Your [request type] has been fully processed. [Provide summary of actions taken and any necessary next steps]."

For more information on response templates, see the following articles:

Step 4: Retention Schedule/Policy

A clear retention policy for request-related data is crucial for compliance and data minimization. It should balance legal requirements, business needs, and privacy rights.

OneTrust's Privacy Rights Automation provides default seeded retention schedules that are available by default in the Global Settings. These schedules help your organization establish and document standard retention periods for different categories of personal data.

Examples of retention policies:

  • Request data: Keep for 2 years from the date of request completion for audit purposes.

  • Identity verification documents: Delete 30 days after request completion

  • Compiled personal data (for access requests): Delete within 90 days of sending to the requestor

It is crucial to set up policies that will assist users in removing personal information from the application when required.

Once you have completed the steps above you will be ready to integrate your web form and start taking in request and fulfilling them.

Based on your configuration requests will then be taken in via web form, triaged according to the rules you have set up and will then be managed by the responsible employees following the workflows you created.

There are additional Privacy Rights Automation settings within the Privacy Rights Automation module that allow you to tailor your data subjects’ experience in the Data Subject Portal, your retention policy, criteria to detect duplicate requests and a cost calculator.

For more details on managing requests, see the below articles:

For all articles on managing request details, click here.

Use the below articles to help you with the setup of the Privacy Rights Automation settings:

For all articles on configuration Privacy Rights Automation settings, click here.

Step 5: Redaction Preferences

Redaction preferences help automate the process of removing sensitive information from documents before sharing them with requestors. This helps protect the privacy of other individuals and sensitive business information.

OneTrust Data Redaction, available as an add-on product, seamlessly integrates with the Privacy Rights Automation module. It enables organizations to upload files, automatically scan them, and redact sensitive information.

Key points about OneTrust Data Redaction:

Classifier Engine:

  • OneTrust employs a classifier engine to detect specific terms (such as addresses or credit card numbers)

  • Default classifiers are provided, and custom keywords can be created

Setting Up Classifiers:

  • Navigate to Privacy Management Workspace > Workspace Administration > Privacy Rights Redaction Preferences

  • Configure custom redaction preferences for your organization's unique data elements

Default Classifiers:

  • Review the list of classifiers detected and redacted by default

  • Choose to skip, review, or automatically redact when handling attachments

Confidence Scores:

  • Confidence scores determine the system's redaction accuracy

  • One Trust’s classifying engine uses back-end algorithms to assess data detection confidence

Examples of redaction rules:

  • Always redact: Social Security numbers, credit card numbers, bank account numbers

  • Review before redaction: Names, email addresses, phone numbers

  • Custom redaction: Company-specific identifiers (e.g., employee ID numbers, loyalty program IDs)

For more details on Data Redaction, see the below articles:

For all Data Redaction articles, click here.

Step 6: Reports

OneTrust's Privacy Rights Automation module offers powerful reporting capabilities through its Insights Dashboards. These dashboards provide actionable insights and performance metrics to help you monitor and optimize your privacy rights request process.

Key Dashboard Tabs:

  1. Requests Actionable Insights

    • View open requests, including overdue requests

    • Analyze requests by stage, approver, and submission date

  2. Subtasks Activity

    • Monitor open subtasks and their statuses

    • Track subtask assignments and creation dates

  3. Overall Performance

    • Get an overview of total and completed requests

    • Analyze average completion time

    • View requests by subject type, country, and request type

  4. CCPA Performance

    • Specific metrics for CCPA-related requests

    • Track received, denied, and completed CCPA requests

Example use cases:

  • Compliance Monitoring: Use the "Average Days to Complete" metric to ensure you're meeting regulatory deadlines (e.g., 30 days for GDPR, 45 days for CCPA).

  • Resource Allocation: Analyze "Open Requests by Approver" to identify team members who may need additional support or to redistribute workload.

  • Process Optimization: Review "Requests by Stage" to identify bottlenecks in your workflow and streamline the process.

  • Geographical Insights: Use the "Requests by Country" map to understand where most of your requests are coming from and allocate resources accordingly.

Best Practices:

  1. Set up regular dashboard review meetings with key stakeholders to discuss trends and areas for improvement.

  2. Use filters to drill down into specific data sets (e.g., by request type, date range, or managing organization) for more targeted analysis.

  3. Create custom reports for specific needs, such as monthly compliance updates for leadership or quarterly trend analysis for process improvement.

  4. Monitor the "Open Overdue Requests" metric closely to prevent compliance issues and maintain a positive requestor experience.

  5. Use the insights gained from these dashboards to continually refine your privacy rights request process, update training materials, and inform resource allocation decisions.

By leveraging these reporting capabilities, you can ensure your privacy rights automation program remains efficient, compliant, and aligned with your organization's needs.

For Privacy Rights Automation specific reporting articles, see below:

For all reporting and dashboard articles, click here.

Complete!

Congratulations on completing your implementation.

By implementing OneTrust's Privacy Rights Automation with Data Redaction as outlined in this guide, you've taken a significant step towards efficient and compliant privacy rights management. Remember to:

  1. Regularly review and optimize your processes as regulations and organizational needs evolve.

  2. Leverage the reporting capabilities to continuously improve your privacy rights handling.

  3. Integrate this module with other privacy management tools for a holistic approach to data protection.

Effective privacy rights automation not only ensures compliance but also builds trust with stakeholders and can become a competitive advantage. Stay proactive in your approach, and don't hesitate to utilize OneTrust's resources and support as you continue to refine your privacy rights management strategy.