Managing Access Controls for Privacy Rights

Regarding the administration of privacy rights, the OneTrust application provides several default user roles to accommodate various levels of access and managing privileges. User roles can be restricted with permission sets and tied to specific organizations to ensure only the appropriate personnel are allowed to see or act upon a data subject or consumer rights request. This is intended to maintain a privacy by design approach and promote secure operation of your organization's request fulfillment.

Provided OneTrust User Roles

The following table outlines the available system roles available to the Privacy Rights Automation module. These can be copied and edited as necessary to meet any custom needs.


Role	Description
Site Admin	Site Admin users have complete access to the application. By default, all permissions are enabled for Site Admin users. Only existing Site Admins can assign the Site Admin role to another user.
Privacy Rights Automation Manager	Privacy Rights Automation Managers are business users who have access to most everyday and some administrative functions in the Privacy Rights Automation module. By default, Privacy Rights Automation Managers have limited access to deletion and configuration functions.
Privacy Officer	Privacy Officer users are high-level users who have access to most functions in the application. By default, Privacy Officer users do not have access to administrative and destructive functions such as audit logging, deletion, and integrations.
Project Owner	Project Owner users are business users who have access to everyday functions in the application. By default, Project Owner users have limited access to administrative, destructive, and configuration functions. Project Owner users can launch assessments, review inventory data, view scan results, and complete other everyday business tasks.

Implementing Role-Based Access

OneTrust uses roles-based access controls to prevent misuse of functionality and ensure the proper privileges are in place for an internal team. Features in the application are tied to permission sets, which can be further edited to enhance or restrict abilities. If a user does not have permission to utilize a feature, it will not be accessible in the interface.

When logging in to the application, users assigned with multiple roles within multiple organizations will automatically have access to all permissions tied to each role that they are assigned. Role permissions will be inherited down the organization tree, which means that a Site Admin at a parent organization will have Site Admin permissions in all lower child organizations.

To add and edit roles

Navigate to Global Settings > User Management > Roles.
Select a role. The Edit Role screen appears.
Select DSAR from the menu options.
The list will display all available DSAR permissions tied to the given role.
Now navigate to Global Settings > User Management > Users.
Select a user from the list, then click the Roles tab.
The Roles tab contains all the active roles assigned to the given users. Use this screen to add, edit, or remove their roles as necessary.
To create a custom role, click the Add Role button from the Roles screen. You will be asked to define, described, and enable permissions for the new role. Click the Create button to save the new role and assign it to your user(s).

Note:

For additional information on creating and editing user roles within OneTrust, see Managing Users and Managing Roles.

Implementing Organization-Based Access

When users are created within the OneTrust application, they are assigned to a default organization for their given role and permission set. Users can also be assigned multiple roles within several organizations (given those additional organizations are a child of the parent organization). This provides flexibility to accommodate each user's specific permissions needed to perform their respective job duties.

To add organization access during user creation

Navigate to Global Settings > Users.
Click the Add User to create a new user.
On the Add User - Assign Roles to User screen, you will be asked to define the role of the new user and the organization level to which they will belong.
You can update their organization level at any time by navigating to the Roles tab.

To check the organization level

Users can view each organization in which they are a member by clicking the User icon in the upper right-hand corner. On the menu that appears, they will be able to see the organizations in which they are assigned a role.

Users can hover over an organization to view the explicit roles that they are assigned within the organization, and click the organization's name to switch to that particular organization.