Managing Request Fulfillment with Multiple Brands

OneTrust accounts can be set up with organizational hierarchies to define user access and controls throughout the platform. Many OneTrust customers use this functionality to account for the various brands their parent organization might oversee when collecting or processing personally identifiable information (PII) in various jurisdictions.

Because multiple levels can exist within a single OneTrust account, OneTrust recommends setting up an organization hierarchy that strives for the following best practices when getting started with the OneTrust Privacy Rights Automation module. :

  • Business brands should be presented correctly on web forms, Privacy Portal, and email notifications to maintain a consistent user experience from intake to fulfillment.

  • Privacy requests are automatically routed and queued to the right organization level and its respective workflows via automation rules.

  • Access and administration ability are strictly controlled by organization and user role assignment.

Note:

For more information on organizations and setting up hierarchies, see Managing Organizations.

Customizing the User Experience

Managing Brand Visibility with Web Forms & Privacy Portals

OneTrust customers can customize a web form template to adhere with their organization's branding or create unique web forms for each brand they wish to represent. Expand the Form Styling drop down to select from the available customization options, which includes page favicon, header logos, backgrounds, button coloring, guidance text, and more.





Note:

For more information on branding, see Customizing a Web Form.

The Privacy Portal will adopt the branding of the organization as defined in Global Settings. Organizations can also provide custom footer text to include a link to their privacy policy and additional information for data subject reference.



Note:

For more information on configuring organization branding, see Application Branding Settings.

For more information on the Privacy Portal, see Setting Up the Privacy Portal.

Managing Email Branding & Templates

The OneTrust platform uses templates to send automated email notifications to internal users and data subjects who have submitted requests. When setting up the Privacy Rights Automation module, customers can tailor templates to align with their organizational branding at large and for each given brand they wish to represent so data subjects receive emails that are styled accordingly, contain content applicable to the given brand, and presented in their preferred language.

Users can only manage templates for their organization or child levels nested beneath. Ensure that you enable or restrict the appropriate level of access to your email templates for your users at each organization level to align with your branding goals.

Additionally, you can enable or disable specific templates for the given organization and all its child organizations in the Email and Branding menu options. Select the Override setting for a given template to override inherited content from its parent organization so you can configure the template for your specific brand or audience.



Note:

For more information on email branding and templates, see Emails: Branding & Templates.

Processing Requests by Brand

Automatically Routing Requests by Brand

For a simple configuration, customers can create a single web form for a parent company configured with automation rules to route applicable requests to the correct managing brand, the applicable workflow, and an approver assigned to that organization level. Approvers can layer multiple conditions as well as several rules with specific acceptance criteria to filter and send requests to the appropriate organization.

In this example, we've configured an automation rule on a Global template to route CCPA-based requests to a managing organization level and user in North America and started the request on the CCPA workflow template. This allows authorized users to determine not only the correct administration of the request but control which branding the data subject sees in the Privacy Portal.



Note:

For more information on configuring web form settings and automation rules, see the following:

Request Administration with Workflows

OneTrust workflows can be created for each individual organizational level so your privacy team has the proper administration protocols in place to process requests for a brand and all its unique considerations. Request workflows can also support the automatic assignment of subtasks to responsible individuals via integration workflows who are authorized to action on requests within that brand.



Note:

For information on workflows, see Adding and Deleting Workflows and Customizing a Workflow.

Access Controls & Request Management

When users are created within the OneTrust platform, they are assigned to a default organization for their given role and permissions set. Users can also be assigned multiple roles within several organizations (given those additional organizations are a child of the parent organization). This provides flexibility to accommodate each user's specific permissions needed to perform their respective job duties.





When concerning privacy rights, user access should only be given to the brand(s) or level(s) necessary in order to view, process, and fulfill requests submitted to that specific brand. This allows privacy teams to access the appropriate Request Queue view and subsequent request details relative to their brand or responsibility area. You can change the Request Queue view by brand by selecting the Organization drop-down and choosing the appropriate level.



Note:

For more information on creating users and assigning role permissions, see Managing Users.

For more information on requests administration, see Processing Requests.

Communicating with Response Templates

OneTrust customers utilize response templates as their organization's preferred method of contact when responding to request decisions or sending messages to the data subject. OneTrust provides a number of default templates to meet common privacy rights and response decisions established by GDPR, CCPA, LGPD, and PDPA.

Currently, to meet the necessary access controls for organization levels and user assignment, OneTrust users need to create uniquely named response templates on each organization level. You can create custom response templates and craft your own messages using the text editor. These templates can also be leveraged to send public comments to data subjects as a standardized communication practice.



Note:

For more information, see Using Response Templates.