OneTrust Targeted Data Discovery & Integration Workflow FAQ

OneTrust Targeted Data Discovery helps to get, update, and delete specific data about a given user from your systems.

Traditional e-discovery is designed to help organizations find, classify, and manage their data systems. This often requires extensive access to servers, databases, and file shares in order to read, map, and categorize. The data found through traditional e-discovery can be used to build your data map and records of processing.

OneTrust Targeted Data Discovery, however, uses API calls, SQL queries, and other search techniques to gather and manage specific points of data in your systems. This process is easy to set up and can be used to respond to requests from data subjects and consumers in relation to their rights as individuals.

OneTrust has pre-built integration connectors for many of the tools used by our customers and partners. These integration packages represent some of the most common use cases and requirements. New systems are added frequently, prioritized based on customer request.

If you don't see your system as a pre-configured connector, you can easily define your own using the Swagger or OpenAPI specification file for the application.

OneTrust also supports integration with custom enterprise systems using the individual endpoints, request body, and expected response for each call you want to use.

Yes! If there's a way to manually query your system, OneTrust can help you automate access to it.

OneTrust can connect to on-premises systems as long as the correct ports are open to allow OneTrust to fetch the data. These ports can be locked to prevent unauthorized access by using IP safelisting for IP address block associated with your OneTrust application environment.

Additionally, OneTrust dedicated cloud environments can connect to on-premises networks and dedicated cloud environments through site-to-site VPN.

Some systems do not provide immediate responses to requests and instead use a queueing mechanism (middleware) for asynchronous response. Though we do not provide direct connections to asynchronous systems, OneTrust is easily able to accommodate these systems such as Kafka, AWS Kinesis, and ActiveMQ via REST APIs. Integration via TCP protocol is not supported.

Data is encrypted in transit with TLS 1.2 and at rest with Azure Transparent Data Encryption AES-256. A retention policy automatically deletes request attachments after the time configured by your organization.

OneTrust's Data Discovery engine uses credentials you provide to authenticate communication with your systems. Access to data is limited by the permissions associated with the credentials provided. We support all common authentication mechanisms such as API Key, OAuth2, Username/Password, etc.

OneTrust can integrate with third-party systems using the following types of authentication:

• Bearer Token

• Basic Authentication (Username and Password)

• OAuth2 - Client Credentials

• OAuth2 - Password Credentials

• OAuth2 - Auth Code

• OAuth2 - Refresh Token

In many cases, it's preferable to anonymize data to prevent negative effects on statistical analysis and other consequences to the integrity of your data. Depending on the system to which it's connecting, OneTrust Targeted Data Discovery has the ability to both anonymize and delete data.

OneTrust Targeted Data Discovery can aggregate data from multiple systems using a summary API. You can map data from multiple systems and then group the data based on your organization's needs. This aggregated result can then be shared with your data subjects in response to access requests.

OneTrust can fetch and attach files to requests to provide information to data subjects. Files are encrypted when stored and scanned for malicious code before being served to the request.

OneTrust leverages error handling, and both short- and long-term retry logic to account for situations where externals systems experience downtime or credentials are outdated.

In the event a connected system experiences an outage and OneTrust is not able to connect, OneTrust will automatically hold all pending and new requests until the connected system comes back online. No requests will be lost.

In the event of an individual request failure, each automated task will be retried twice after the initial failure before being routed to a failed message container for manual review.