Accessing the Privacy Portal via Multi-Factor Authentication

Note:

This feature is only available to users with Enterprise license types.

The Multi-Factor Authentication (MFA) workflow setting gives organizations an additional verification method when data subjects need to prove their identities or they are in possession of the email address used to submit the request. This setting can be used with one-time password (OTP) for improved access control when accessing the Privacy Portal.

When enabled for a workflow, a request approver will be prompted to generate a password that will be sent separately to the data subject. Whenever comments are added to a request, the data subject will receive an email notification containing a link to the Privacy Portal. They will be prompted to enter the aforementioned generated password to access the portal.

Note:

The generated password cannot be passed to the data subject from the OneTrust application or any communication sent by OneTrust. Your business will need to decide on how to provide the password to the data subject: physical mail or email address.

Prerequisites

You will need to contact OneTrust Support to enable the respective preview features to populate the MFA setting.

To enable the MFA setting

  1. On the Data Subjects Requests menu, select Settings > Workflows. The Workflows screen appears.

  2. Select a workflow. The Workflow Details screen appears.

  3. Navigate to the Details tab.
  4. Enable the Multi-Factor Authentication setting. The following options will appear for you to set password requirements.


    • Access Code Length (enter character count)

    • Include Uppercase

    • Include Lowercase

    • Include Special Characters

    • Include Numbers

  5. Click the Save button.
  6. Click the Activate button

Request Workflow with MFA Setting Enabled

  1. Once a data subject submits a request, they will be sent the initial email notification confirming their request submission.



  2. Once a request approver sends the first public comment, the data subject will receive another email notification with the link to the Privacy Portal.



    OneTrust users will see the following modal appear after they've sent the public comment.

    Note:

    As noted earlier in the article, this password cannot be passed to the data subject through the OneTrust application or notification emails. Your business will need to decide on how to provide the password to the data subject: physical mail or email address.



  3. The data subject will then be asked to enter the email address and the generated password in order to access the Privacy Portal.



  4. When the data subject selects the Forget Password, the request approver will be notified in order to generate a new password and re-send it to the data subject.