FAQs for Privacy Automation

Assessments can be thought of as a "moment in time," a snapshot, or a receipt of what a processing activity or asset looked like at a given time. They are used as a way to gather information to populate the inventory records.

Primary records are used in assessments and are indicators on your inventory questions that tell the system which inventory type could be the main record for the assessment. Admin-driven templates can have more than one inventory type as the primary record (only one primary record for each inventory type), but when launching that template as an assessment, only one can be the primary record for that specific assessment. You must select one from the drop down when launching the assessment.

When primary record is set:

• It helps retrieve relationship information and prep-populate all connected Assets, Vendors, and Legal Entities in assessments.

• It also helps create follow-up assessments, e.g., a ROPA assessment followed by a DPIA assessment.

  Primary records tell system what to copy over from the previous assessment. So if the same inventory type is set as primary record in a follow-up assessment, the system will copy over and pre-populate inventory relationships.

  We recommend starting a TIA upon submission, but that PIA or DPIA assessments should be launched only upon approval, so that entries and relationships from the previous assessments are saved in the inventory and pre-populated in the follow-up assessment.

There are several benefits to setting the primary record of an assessment.

• Pre-population of Data

  • Setting the primary record will automatically pull in and pre-populate related inventory and personal data (depending on the associated template configuration).

• Reporting

  • Setting the primary record will make for easy reporting when identifying the assessments conducted for a specific inventory record.

    Note:

    Users can search, sort, and filter based on Primary Record Name and Primary Record ID from both the Assessment List and Assessment Reports.

• Reassessment:

  • Primary record allows you to easily reassess your inventory records and copy over prior responses, evidence, and notes from prior assessments. Approvers can then reference any updates using simple change tracking inside of the assessments.

• Inventory Automation Rules:

  Important:

  These Rules are Dependent on a Primary Record.

  • Users can set up rules to automatically reassess their inventory records on a scheduled cadence.

  • This allows users to set up automated reassessment of their inventory records based on a variety of conditions: Risk Level, Last Assessment Completion Date, Last Updated Date, Contract Expiration, etc.

• Users will need to set up their templates to support primary record in the Template Builder. For more information, see Enabling Primary Record. .

• Add an Inventory Question to a section to support primary record in a template.

• When using an engagement as the primary record, an engagement question must be added and then set to be the primary-record question.

• Only Inventory Questions enabled with the "Primary Record" setting will accept a Primary Record. Users can configure one primary record inventory question per inventory type on a template.

  Note:

  For example: Users can have up to four Primary Record questions on a single template (One of each - Vendor, Asset, Entity, and Processing Activity).

• For Admin-Driven, to configure an inventory question as a Primary Record question, simply edit an inventory question, and turn the Primary Record setting to ON in the question builder. For Respondent-Driven, the respondent selects the Primary Record when responding to the assessment.

  Note:

  The Primary Record setting can be changed on an inventory or engagement question when editing both a draft and published version of the template.

  
  
  

• When Admin-Driven, the Primary Record must be added by the creator while launching the assessment. When Respondent-Driven, it is added by the respondent.

Take into consideration the intent of the assessment, as well as which question is defining the purpose of the assessment. If you're building a template for evaluating a vendor and your template contains a question For Example: ("What vendor are you assessing?"), this should be the primary record question.

For Admin-Driven, the primary record is set on the assessment and the Primary Record question is disabled so that the respondents cannot change it, allowing the admin user to maintain ultimate control. Attributes, related inventories, and related personal data will be prepopulated on the assessment. The primary record metadata fields will be set to the selected record and made available for reporting.

When the template has been configured using the Respondent-Driven option, users are not required to set the Primary Record when creating or launching the assessment, as the Primary Record will be populated according to the response provided by the respondent.

Relationships and personal data will not be prepopulated on the assessment if the template is respondent-driven and the primary record is chosen after launch.

Yes, just turn off the Allow User to Launch Without Setting a Primary Record setting on the template's details or use Respondent-Driven setting.

• If you want to require the user to set primary record from SSP, turn off the template setting Allow User to Launch w/o Setting Primary Record on the template's details or use the Respondent-Driven setting to allow respondents to select their own Primary Record.

When using the Admin-Driven setting, the checkbox can be configured to show or hide at the template level. The Allow Users to Launch Assessment Without Setting a Primary Record under the Settings section of the Template Details screen is where the setting can be turned Off. Creators will be required to set a primary record when launching an assessment with that template.

Yes, but only if the primary record question has the Allow Other option enabled in the template. The user can enter a new record on the Primary Record field on the Enter Assessment Details screen when launching an assessment.

No, an assessment can have only one primary record. It can also be linked to additional inventory or engagement records.

Yes, as long as the template has a primary record-enabled inventory question of the desired type.

• While the primary record should be set upon launching the assessment, it can be changed in the Details Pane by an Admin before the assessment is not completed.

• If the assessment was launched without a primary record, but contains a primary record-enabled question, the primary record can be added retroactively.

• The primary record can only be completely removed from an assessment by removing the assessment link directly from the inventory record.

1. Ensure that the assessment is using a template version that has the primary record setting enabled on the inventory question.

2. Open the assessment of the primary record you wish to add or edit.

3. Open the Assessment Details pane by clicking the Information icon on the assessment header. This will open the Details pane in read-only mode.

   
   
   

4. With the Details Pane in read-only mode, hover over the primary record field and click the Edit icon that appears. This will open a modal allowing you to retroactively add or edit the primary record of your assessment.

   Note:

   The warning that appears on the modal lets you know what will be updated when you add/edit the primary record.

   
   
   

   This field cannot be edited with the rest of the assessment details, as there is a lot of logic that is driven by the primary record and therefore it needs a protected save.

   Primary record cannot be edited on an assessment that is using a template version that does not have an inventory question without the Primary Record setting enabled.

These steps should help you resolve the issue:

1. Create a new version of the template.

2. Click the Edit icon on the inventory question you wish to enable for primary record.

3. Enable the Primary Record setting.

4. Save the updates and publish the new template version. This will automatically enable the primary record fields when users launch new assessments with this template.

   Note:

   For any open assessments, an admin will need to go back and retroactively add the primary record to those assessments via the Assessment Details.

5. Enable the Apply changes to all open assessments setting and select the confirmation checkmarks to push updates to open assessments.

6. Click the Confirm button.

Assessments that have been manually linked to an inventory record will not absorb the Primary Record. Primary Records can be set retroactively to assessments on the assessment details pane if there is an existing primary record inventory question on the template.

When an assessment is approved, the primary record drives updates like risk inheritance. If the primary record is updated later, risk inheritance is not retro-actively updated and activity tracking will be missed.

When there is no linked inventory and no primary record, the risk type remains on the assessment and does not inherit onto any inventory.

Primary records can only be edited on assessments that contain a primary record-enabled question and are not in a completed state.

Template Inventory Question.

No. Questions are added in sequential order and display aligned. If questions are only relevant in certain scenarios depending on the response to another question, consider using Skip/Show logic to hide the questions unless specific conditions are met.

No. You can create another version and re-publish it once you have manually reverted the changes. If you want to compare the content prior to your changes with the new version, click the Context Menu icon on your template and select Show/Hide Versions.

If you have over 200 inventory records, you will need to type to search for the correct one. There is a 200 record limit to manage performance and usability.

No. While some attributes exist for multiple inventory types, they cannot be used to populate each other. For example, an asset attribute cannot be used to populate a Processing Activity attribute of the same name. They are two separate attribute lists.

The Inventory items are fetched based on Assessment Organization, not the user’s organization.

The question was not set up with an inventory relationship. Ensure that a relationship has been configured on one of the inventory questions via the chain-link icon.

The specific question types are:

• Yes/No

• Multi-Choice

• Multi-Choice/Location attribute questions where parent inventory question is single-select

• Multi-Choice inventory relationship attribute questions where the parent inventory relationship question is single-select

We do not allow users to add skip logic from non-attribute questions to attribute questions. This is because attribute questions are hidden by default until an associated inventory record is selected. Users can only skip to attribute questions from other attribute questions with the same parent inventory question.

No. If a user alters or removes skip logic or rules from a template, that activity is not tracked or recorded.

While you can configure show logic on any question type, only certain question types can be used as a condition in show logic:

• Yes/No

• Multi-Choice

• Multi-Choice/Location attribute questions where parent inventory question is single-select

• Multi-Choice inventory relationship attribute questions where the parent inventory relationship question is single-select

Verify if the parent inventory question of all of these attribute questions is a multi-select inventory question. If Yes, this is not currently supported.

No. If a user alters or removes show logic or rules from a template, that activity is not tracked or recorded.

Attribute values and related risks are updated when the assessment is approved and moves to the Completed stage.

Yes, if the question response is an inventory object attribute, and it is visible in the assessment, the inventory will be updated.

If the question is not visible (hidden by template logic) and Preserve or Delete Hidden Data is set to Delete, the question and response are deleted from the assessment, and the corresponding inventory attribute value is cleared.

Those sections are now “part of the assessment” and open / active sections. Assigned respondents are automatically notified, and each section must be submitted to submit the assessment.

The user can hover over the question to reveal a tool tip error message: "Only one incident can be authorized in this assessment. Delete all duplicates."

The user can hover over it to reveal a tool tip error message: "Only one attribute question per attribute type can be tied to a parent inventory question. Delete the attribute question to resolve this issue."

The user can hover over it to reveal a tool tip error message: “Only one contract question can be tied to a vendor question. Delete or link the contract question to a different vendor question.”

The user can hover over it to reveal a tool tip error message: “This contract/control question is tied to a multi-select vendor question. Delete or link the contract/control question to a different vendor question.”

The user can hover over it to reveal a tool tip error message: “Attribute/contract/control questions cannot be above their parent question. Move this question underneath its reference question.“

The user can hover over it to reveal a tool tip error message: “This is an invalid data element attribute question. Delete this question or link the personal data question to a primary asset or processing activity question.”

Users attempting to publish, if there are any errors in the destination template, the compromised questions will be highlighted.

Each error will show individually and must be resolved one at a time.

Yes. Templates that have been archived can have their sections and questions copied to another draft template.

No. You can create another version of that published template and copy your questions to that newly created version.

No. Once completed, the copy actions can not be undone.

Templates

• Default template language selection.

• Adding new translations and validating if there are any missing translations.

• Updating translations.

Assessments

• Showing assessment questions and responses based on translations.

• PDF report support.

All 31 languages that the OneTrust platform currently supports are configurable.

Yes: French, German, Italian, Japanese, Spanish, and Portuguese (Brazil).

No. You can configure gallery template translations manually or work with account management to provide translation via request.

Other than the size limit of 64 megabytes of the import file, there are no other limitations to the number of questions or items within the template.

Only static items that the user adds to the template itself are translatable. Attributes can be translated using the Attribute Manager. Translating attributes via multilingual templates is not available.

Attributes can be translated using the Attribute Manager. Translating attributes via multilingual templates is not available.

No, you will only be able to import one language per file, but can upload multiple language files at once.

Currently, users will only be able to import and export translations using an Excel spreadsheet. However, it adding input and output of translations via the user interface is up for future consideration.

Yes, you can configure multiple translations for a published template. But translations are tied to template version, so the translations will be applicable only for that version. When a new version is created, translations for old versions are still available, but will not include any new questions added to the template.

No, you will need to generate an import file for each tenant to avoid errors.

Yes, the import process allows users to navigate to other modules and continue other work on the OneTrust platform.

In the Self-Service Portal, anywhere an assessment can be launched, translations will be available. The Employee Portal does not currently support multilingual templates.

No, the OT tool cannot open or launch assessments in a given language based on a user’s browser settings.

Since they are not part of the translations, users will continue to see OneTrust application content translated based on the language selected in Global Settings.

Yes, from the inventory screen, use the check box to select multiple inventories or multiple inventories across pages to bulk launch assessments.

Users can enter the external respondent's email address in the Respondent field on the Assessment Details screen. The respondent will receive an email with a link to the assessment and will be able to complete the assessment without a password needed.

For Internal (Or any non invited) Users, there is no expiration to the Assessment Notification email links.

For Invited Users, here are a few things to consider:

• The Assessment Notification email link is valid until the assessment is completed.

• If Assessment is not completed for more than 365 days, then it expires after 365 days of the first email sent.

When a respondent is deleted, the system automatically replaces them with the default approver for that assessment's organization. This ensures that the Respondent field, which is required, always has a user assigned.

The employees will need to have a login to access, but they can be given Project Owner roles with the Restrict Assessment Creation To SSP setting enabled.

The Self-Service Portal does not yet support translated template names. This functionality is being considered for a future enhancement. For more information on the feature and it's availability please see Translate SSP Template Names in the OneTrust Ideas Portal.

Invited users are created when their email addresses are added as respondents on an assessment.

Invited users have minimal access to the platform. They can only access assessments for which they have been assigned as respondents. Invited users can also be assigned subtasks, tasks, and risks.

Invited users receive a unique dynamic link via email when they are assigned an assessment. They use this link to access the assessment without having to log in to OneTrust.

Invited users will be redirected to the OneTrust Platform and required to complete a CAPTCHA security measure. If the Turn on OTP verification for invited users setting is enabled for the account, they will then be prompted to enter a One-Time Password (OTP). The OTP will be sent to the email address specified in the Respondent(s) field for that assessment. For more information, see One-Time Password for Invited Users.

The unique link expires after 365 days. If the assessment moves to the Under Review stage, it is no longer accessible through the unique link.

The assessment link should not be forwarded. To include additional respondents, the creator of the assessment should explicitly add any additional individuals as a respondent on the assessment by editing the Respondent(s) field for that assessment within the platform. If the User Respondent Delegation setting is enabled for the related assessment template, then existing respondents can also explicitly add any additional individuals as a respondent on the assessment by editing the Respondent(s) field for that assessment within the platform.

Yes, you can share assessments with invited users, but the assessment will be available as read-only.

No, invited users cannot log in via SSO or using a OneTrust username and password. They do not have OneTrust accounts.

No, verifying an invited user's email domain in your SSO settings does not affect invited users. They can still access the assessments assigned to them using the unique links they received via email and will not be prompted to log in via SSO.

No. A username and password is required to access reports. Because an invited user does not have a username or password to log in, they cannot receive reports.

The metadata visible to invited users depends on their permissions.

With a standard invited user role, the user will have basic access. If you want to give the invited user expanded access to your assessments metadata, you can create a custom copy of the Invited User role and add the Advanced Assessment Metadata permission to the role.

For more information, see Creating and Editing Custom Roles.

Metadata Visibility for Invited Users

Metadata	Basic access	Advanced access
Assessment Metadata Pane
Basic Information
Name
Organization
Template
Workflows
Description
Deadline
Reminder
Send Email to
Primary record
Tags
Workflow approvers
Approver(s)
Comments
Participants
Respondent(s) Only respondent is editable via invited user based on setting (Respondent delegation)
Comments
Additional information
ID
Stage
Stage details (workflow status bar)
Result
Result Comments
Date Created
Creator
Template Version
Question Labels
Residual Risk Score
Open Risk Count
Open Info Request Count
Inherent Risk Score
Target Risk Score
Assessments list screen
ID	Invited users do not have access to the Assessments list screen.
Name
Stage
Result
Residual risk score
Organization
Respondent
Approver
Deadline
Open info request count
Open risk count
Tags
Open issue count
Workflows
Template
Creator
Date created
Date completed
Date submitted
Primary record name
Primary record id
Pending reviews
Template version
Approval stage
Inherent risk score
Target risk score

Yes. Admins can enable the Access control override for invited user inventory drop-down visibility setting to prevent invited users from accessing inventory drop-down data in assessments.

When the setting is disabled, which is the default behavior, invited users can continue to view and select inventory records from drop-down fields in assessments.

When the setting is enabled, invited users can still answer assessment questions, but inventory drop-down questions that require selecting inventory records from a list are not available to them. This applies to Processing activities, Assets, Vendors, and Entities.

Complete the following steps to reconfigure an existing user to solely have the Invited User role:

1. Within Global Settings, navigate to the Users screen, and delete the existing user to remove any existing roles assigned to them. Then navigate to the User settings screen and ensure that the Allow Creating Invited Users setting is enabled.

   
   
   

2. Within PIA & DPIA Automation, navigate to the necessary assessment, click the Context Menu button, and select Edit Details. In the Respondent(s) section, enter the user's email address, and click the Save button.

3. On the Unrecognized Respondents modal that appears, select the Send the link (no sign-in required) option, and click the Confirm button. This will create the user as an invited user in the platform.

   
   
   

When an invited user is created with an email address that is already associated with user identity information in another OneTrust account in the same environment, the platform may use the existing first- and last-name values for that user. Account data remains separate, but identity information associated with the email address may be available across the associated accounts. If first- and last-name values are not available for the email address, the platform uses the available username or email address according to the account’s user-creation behavior.

Before deleting an inactive invited user, coordinate with the administrators of every associated OneTrust account. Confirm which user record is being removed, whether the user is still needed in another account, and whether the selected deletion option preserves or anonymizes the user’s name for audit purposes.

Section Assignment allows users to assign respondent(s) access to specific sections within an assessment without giving the respondent full access to every section.

Associated Idea: OneTrust Ideas

Section Assignment is available when an assessment is launched from the PIA & DPIA Automation module. It is also available when an assessment is copied or reassessed.

The permission: ManageAllSectionAssignmentWorkflow.

• Site Admins

• PIA & DPIA Automation Managers

• Data Mapping Automation Managers

• Vendor Managers

• Incident Managers

This permission allows a user to submit all sections within an assessment with section assignment enabled. It also allows a user to view all sections within the section summary. It will also allow a user to reopen any submitted sections while the assessment is in In Progress state.

Standard users such as Project Respondents wouldn’t be able to, they would just be able to answer the questions within their assigned section. Users with elevated permissions (such as a Privacy Officer or Site Admin) would have the option to answer all questions regardless of their assigned assessment section.

The assessment moves to Under Review when all sections have been submitted. It will also move to Under Review, if a user with ManageAllSectionAssignmentWorkflow bypasses any sections

Bypassing allows user with elevated permissions to bypass a section without any respondent submitting it. This excludes bypassing sections which have required questions, attachments, or justifications.

If the user does not have access to any sections they are assigned due to skip or show logic within the assessment, they will see the notification below.

You can view the current submission status of each section by accessing the context menu within the top right side of the assessment. Click on View Section Assignment Summary to access the details view:

Yes - You will be able to see the respondents assigned to each section as well as the respondent who submitted that section.

• If RepondentViewAllRiskEnabled permission is enabled, section assignment respondent will see all risks in their section, even risks they are not assigned.

• Users will see risks in other sections they are not assigned to if they are assigned to the risk owner.

  Note:

  If they are assigned as risk owner for a risk in that section, they will automatically be assigned as a respondent of that section.

• If the user has ManageAllSectionAssignmentWorkflow then they will see all sections/risks.

Make sure the assessment setting for this feature is enabled. If its enabled, check to see if the assessment has section assignment enabled. We do not currently support import/export for section assignment assessments.

All sections configured as approver-only can be accessed by anyone designated as a section approver when launching the assessment. Approver-only sections are only visible to approvers, regardless of the assessment's section visibility configuration.

Upon assessment launch, section approvers can complete only the sections to which they are assigned.

No. Section approvers can be assigned automatically at launch using template rules, inventory-based values, or the default section approver configured on the template.

Section approvers are assigned at assessment launch based on template configuration. If template rules are configured and apply, they are used to assign approvers. If any approver-only sections remain unassigned, the system assigns the default section approver configured on the template.

Section approvers are assigned when the assessment is launched.

All questions types can be added to approver-only sections.

Yes, skip and show conditional logic is available for approver-only sections.

Yes, the feature will work with the Section completion and notifications setting is configured as Consecutive or Any Order.

Template changes that introduce a new approver-only section cannot be pushed to assessments created with earlier template versions. Those assessments do not include configuration for the new section.

When launching new assessments, section approvers are assigned automatically using template configuration (either via rules or default section approver).

Yes. When launching assessments via the Self-Service Portal, section approvers are assigned automatically. They cannot be configured during launch.

Unless they have been given special permissions by the organization, the Default Approvers are:

• Site Admins

• Privacy Officers

• Managers - Assessment, Vendor, Data Mapping Automation, IT Risk, and Incidents

No, there is not a system role specifically for approving assessments. User roles with the following permissions can approve assessments:

• Assessment Approve

• Assessment Can Be Approver

Project Viewer is not a role that allows you to view all records. Instead, it is a read-only role for the user's assignments. In other words, you assign records to the Project Viewer and then they will have read-only access to that content. Project Viewers cannot see beyond their assignments.To allow read-only access to all of the module content and inventory records, you need a custom role with more permissions. Use Project Viewer as a base, create a copy, and add permissions as needed to provide access to all of the module content.

For more information, see Creating and Editing Custom Roles and Using System Default Roles.

All the functionalities such as responding to an assessment, submitting an assessment, approval, risk flagging, requesting more information, comments, attachments, etc, that are supported today for respondents or approvers will be supported for any users that are part of a user group assigned as respondents or approvers, respectively.

Approver: The user group is removed from all assessments.

Respondent: If there is at least one other respondent assigned, the user group is removed from the assessment. If the deleted user group is the only assigned respondent, default approver of the organization becomes the respondent.

If the user is added as an approver and also belongs to the user group added as an approver to a given stage, any review by the user will mark both the individual and the user group assignments with their review responses.

If the user is added as a respondent and also belongs to the user group assigned as a respondent to a whole assessment or a section:

• In the case of section assignment, when the user submits the section, the section is locked for further response.

• In the case of full assessment assignment, when the user submits the assessment, the assessment moves to next stage.

A user's name displays for any actions they take.

Example: If a user from a user group submits an assessment, the name of the user who submitted the assessment displays for the Submit activity.

If an assignment is given to a user group, the user group name displays for the assignment activity.

Example: If a user Group at stage X gets assigned as the approver, the applicable activity will show the user group name.

When one of the user from a user group approves a stage and then another user rejects the stage, the stage is considered as rejected.

the timestamp will always display based on first approval or first rejection.

Scenario A

• First approver approves. Approval timestamp is shown.

• Second approver rejects. Rejection timestamp is shown.

• Third approver approves. Rejection timestamp above is shown.

• Fourth approver approves and bypasses all other approvals. Approval timestamp is shown.

Scenario B

• First approver approves. Approval timestamp is shown.

• Second approver approves. Approval from first user's timestamp is shown.

• Third approver approves. Approval from first user's timestamp is shown.

• Fourth approver rejects and bypasses all other approvals. Rejection timestamp is shown.

When a respondent responds to an information request, the notification can be sent to:

• Respondents assigned to the assessment or relevant section

• All approvers assigned to the assessment, including members of an approver user group

• The user who created the information request

As a result, approvers may receive notifications for information requests created by other approvers on the same assessment. If the request creator is also an approver or member of the approver group, they may be included through more than one recipient role.

This is not allowed. Users are prompted with a modal indicating the assessment needs to be submitted before skipping review stages or moving to Completed.

Yes, you can skip to previous or future stages. You will be prompted to reset reviews of all stages or reset only the selected stage reviews.

In this case, the review stage from which the user started will remain incomplete.

For example, if a user is on Stage A and skips to Stage D, no review result will be applied to Stage A unless it has been reviewed through the Finish Review process by the approvers. Approvers for stages A–D will be notified of the stage change.

Yes. You will be prompted to select a result for the assessment and add comments.

Approvers of the applicable review stages and respondents will be notified about the completion of the assessment.

Yes. If you reopen an assessment and move it to a review stage, you will be prompted to Reset all reviews or Reset only selected stage reviews.

If you reopen an assessment and move it to In progress, you will be prompted to Edit all responses and Reset all reviews.

There are a couple of possible causes:

• The selected workflow is different. The Skip to Stage rule only functions within the same workflow. It cannot move an assessment to a different workflow.

• The selected stage change would bypass the assessment submission or approval process. Currently, it is not possible to automatically submit or approve an assessment using the Skip to Stage rule.

• The rule executes when the assessment is submitted. It does not execute when a user submits an individual response while actively completing or reviewing the assessment.

• The rule is intended for custom workflows that include multiple review stages within the same workflow. When the rule conditions are met on submission, the assessment can move forward to a later applicable review stage in that workflow.

To access the custom result feature, select the Assessment Results side menu tab in the PIA & DPIA Automation module. For a in-depth breakdown, reference Customize Assessment Results.

The custom assessment results list can be viewed in the Assessment Results menu item within the PIA & DPIA Automation module. Upon creation, the custom results will be displayed for approvers in the Result selection menu while completing an assessment.

Yes. Users can edit custom results by selecting the Context menu of the custom result that needs editing. All fields can be edited for custom results. As for the system source Approved and Rejected options, only the Option Hint field can be edited.

If selected, the checkbox will update inventory records, launch follow-up assessment, and act as if the assessment approved.

Checking this option will make the result behave like Approved. If selected, this option will update inventories and incidents, add risks and attachments to inventories, and launch applicable follow-up assessments. If unchecked, the result will function like Rejected.

Deactivated Custom Results: Deactivated (Inactive) results will no longer show as an option for assessments. Assessments already completed with this result will retain the result.

Reactivated Custom Results: Reactivated (Active) results will be displayed as options for assessment results.

Yes. Select the Context menu, select the Translate name or Translate option hint option. This will allow users to write in a translation in multiple languages.

The Option hint will give a description, provided by the creator, of the behavior of that custom result. Option hints will be displayed when a user hovers over the option when completing an assessment. This field is optional and can be used to help guide the approver in selecting the appropriate result.

No, system results cannot be deactivated.

The answer all depends on the scenario. View the table below and find the applicable scenario.

Yes. The Complete Assessment API can be used for completing assessments with custom results.

No. We do not, as of this moment, support this functionality. Users will have to re-open those completed assessments and complete them again with the desired custom result.

Assessment approvers and respondents.

Yes. You can manually send a reminder email by clicking "Send Reminder" from context menu or selecting multiple assessments in the assessment list. For information, see Sending Reminder Emails.

Utilizing the Bulk Send Reminders feature will assist you in this task. For more information, see Sending Reminder Emails.

Yes. When sending a reminder, the user can choose to include a custom message which will be appended in the reminder email.

Users can send reminders for up to 1000 assessments at a time.

No. Users can only send reminder emails for assessments in the Not Started, In Progress, and Under Review stages.

The reminder email is accounted for and can be viewed in your Assessment Activity.

No. Each respondent and approver will receive their own individual email.

No. Reminders scheduled in the assessment details will continue to send.

Assessment Reminder Email Rules. This permission controls the ability to view the Email Rules options within settings.

Yes. The feature applies to all assessments across various modules:

• PIA & DPIA Automation

• Third-Party Risk Management

• IT & Security Risk Management

• Data Mapping Automation

Assessment Reminder Email (Manual + Automated Rule) and Assessment Reminder (Assessment Past Due) are the email templates used for this feature.

Yes, respondents assigned sections will still receive automated reminder emails. If the respondents of the section have already submitted their section (and have no other open section assigned), then they will NOT receive an automated reminder email since they have submitted their portions already.

Yes. If the Summary Email is enabled, any triggered emails (via rules or via bulk send actions/manual reminder) will be sent along with the summary.

The subject message will read: One or more assessment are awaiting your input for completion.

No. This feature does not support mulitple conditions and/or actions currently.

There will be a 2nd Condition for if user has not set deadline. If no deadline has been set, we will send automated reminder email at the frequency set in the rule until the assessment moves to Under Review.

No, they send in addition to the regularly scheduled emails.

Continue to send reminder emails at the same frequency until assessment moves to Under Review.

Both rules will be triggered and both emails will be sent.

The assessment's organization.

Yes.

If the same attribute questions are included, the attribute values will still pull through in a different assessment template (given that the pre-populated attribute values setting is enabled in the assessment template.) Any assessment questions that are not attribute question types will not pull through from one assessment template to another.

Yes. When reassessing, you are pulling the latest information from the inventory record, Not Applicable / Not Sure responses do not update the attribute on the inventory record.

No. Not Sure or Not Applicable will not override previous responses to an attribute question upon reassessment. The response from the previous assessment will be retained on the inventory record.

To allow respondents to update an inventory attribute with a Not Sure or Not Applicable response, you can create a Not Sure or Not Applicable option for the attribute. When that attribute option is selected as a question response, the response will update the inventory record upon assessment approval.

In this scenario, the follow-up assessment will be assigned to the first assessment's approver. If there is no approver on the first assessment, the follow-up will be assigned to the original assessment's respondent.

No, automation rules can only be configured to send reports to internal, OneTrust users. Instead, create and download the report to send to the DPO.

No, only to an internal user that has a user profile in OneTrust can be assigned to a risk.

You can use the \Localization Editor to replace the Skipped value with -.

No, it it is not possible. An assessment copy does not have a distinctive field or marker that distinguishes it from newly created assessments. The individual assessment's activity history will confirm if the assessment is a copy, but it is not a reportable field.

After being imported, the assessments will be in the In Process stage.

We do not allow Data Subject Elements (DSE) or Risk Attribute Control questions in the import.

New inventory is created when assessment is moved to the Under Review stage.

Attribute values of inventory are updated when an assessment moves to the Completed stage.

Yes/No

Text

Date

Statement

Multi-Choice

Inventory

Attributes

All available answer options will show within the Second Tab of the Excel file you download.

Go to the Second Tab of the Excel file.

Locate the corresponding column to the question you are answering.

Review the options in the column.

Copy/paste the option you want into the First Tab of the Excel file.

Each option should be separated by a comma.

Each option should be separated by a comma.

Yes. Required Attachments can be added on questions in OneTrust, but not in Excel.

Yes. Comments can be added on questions in OneTrust, but not in Excel.

Yes - The answers generated from the import will show in the activity. The user who performed the import would be attributed as the user who answered that question.

Yes - The relevant templates are Bulk Insert Import Assessments Complete and Assessment Assigned.

No - Users are unable to create new primary or inventory records through the bulk import assessments feature.

No. Read-only questions display existing inventory values. During bulk import, inventory attributes are updated via the assessment, which is not possible with read-only fields.

An inventory is always the most up to date information about a processing activity or asset or vendor. It is your evergreen record. The data stored in the inventory is used to create visuals and reports for regulators, so keeping it up-to-date is important.

An attribute is a descriptor or descriptive component of an inventory record. Attributes can provide specific information about how data is handled.

Personal data is any information related to an identified or identifiable natural person. It is the information on individuals that can be collected, stored, or shared.

Inventory records (such as processing activities, Assets, Vendors, and Entities) are used to document and manage your organization’s data landscape. These records are designed to capture detailed information, support reporting, and be populated and updated through assessments.

Object records (such as Projects or AI Systems) are used to organize and provide context for related records across modules. For example, a Project can group together multiple inventory records and link them to assessments and workflows.

Object records do not behave the same as inventory records. For example:

• Object records are not used as primary records of processing or data mapping.

• Object records do not support the same level of data capture and reporting as inventory records.

• Object records may require object-specific question types in assessment templates rather than inventory question types.

You should use inventory records to capture and maintain your data (for example, Processing activities, Assets, or Vendors) and object records to provide context, group related items, or track initiatives (such as projects), rather than as a replacement for inventory records.

No, the organization of the user does not need to be the same as the managing organization of the record. However, the user would need to be in the same hierarchy to be able to view the record and to answer assessment questions on it, unless the Access Control Override for Inventory Selection setting is enabled.

Managing attribute visibility is possible by organization level, but not by individual inventory record. Child organizations can inherit the visible attributes from parent organizations or selectively by enabling the Override feature. This allows organizations to customize the visible attributes for Processing Activities, Assets, Legal Entities, and Vendors based on child organizations or reflect regional differences within an account.

For more information, see Managing Attribute Visibility Based on Organization.

The attribute value will still be available when the attribute visibility is enabled.

Yes. When creating a new inventory, all possible attributes that can be tied to the inventory are included on the Create modal under Show more details.

Assets and Processing Activities.

Currently, advanced attribute tracking is only supported for related personal data, but you can vote for the idea to track advanced attributes for other inventory relationships here: https://ideas.onetrust.com/ideas/OT-I-2502

Currently, configuring ‘advanced’ attributes to be tracked per related data element is an enterprise level Data Mapping Automation feature and would require an enterprise license. Any user with the DataMappingAdvancedAttributeConfiguration permission can add custom relationship attributes.

This is not yet available but you can vote for the enhancement idea here: https://ideas.onetrust.com/ideas/OT-I-4014

Yes, any record can be setup as a master as long as the user has permission to create masters and has access to that record (the record’s managing org must belong to the users organization or sub-organization.

Yes, there are two ways to approach this:

Consider the following Org Hierarchy.

• Set up a master at the “US” org.

• Option 1: User at the “Global Corp” organization can click ‘copy’ on the master, toggle ‘create as local version’ and select “EMEA” as the organization for the local version.

• Option 2: User in “Global Corp” organization could select an existing inventory record that belongs to “EMEA” and link it to the master “US” record.

No. Inheritance settings must be configured separately for each master record.

No. Automatic inheritance does not currently include inheriting related inventories.

For your master records to appear, ensure the attributes Is Parent and Is Master are activated in the Inventory Manger.

Customize the inventory view to include the Master Record and/or Is Master attribute value.

Vendors represent the third party service providers whereas legal entities could represent either internal organizations or external organizations that aren’t necessarily service providers/vendors but could be involved in data processing activities.

For capturing third party vendors/service providers, we recommend using the vendors module and linking vendors to your processing activity records as the vendor module has very specific functionality designed for handling contracts and identifying risks associated with third parties.

Legal entities can be linked to or associated with processing activities, assets, or other legal entities.

When legal entities are linked to processing activities as ‘source/collection’ ‘storage/processing’ or ‘destination/access’, they will be shown on the lineage diagram.

Not yet, but you can vote for the idea.

The lineage diagram displays data subject types linked to a processing activity. It also shows swim lanes for assets, vendors, and entities linked to the processing activity as source/collection, storage/processing, or destination/access. Parties with access are populated by the processing activity attribute.

On the diagram, connecting lines appear between sources and storage/processing objects. Storage/processing objects then connect to destination/access objects.

No. Manual updates to the diagram will not update the underlying data or relationships. Relationships and data must be modified directly on the processing activity itself.

Editing an inventory or submitting an assessment does not automatically refresh the diagram. You can generate an updated diagram by clicking the Auto Draw button, which will reflect the most recent changes.

The Cross-Border Map will show the cross-border transfers of data based on information from your related inventories. For more information on the Cross-Border Map, review this article.

Yes, Projects can be related to all four existing inventory types: Assets, Entities, Vendors, and Processing Activities.

Yes. On the bulk import template, you will need a separate line for each relationship and relationship type.

OneTrust generally refreshes every 30 minutes for all Dashboards & Reporting features, including column reports, PDF reports, and dashboards. Most data should appear in approximately 30 minutes, but it could take up to 90 minutes in certain situations based on volume. However, please expect larger times for updates to reporting services in case of bulk imports, updates, or deletion of data.

In the OneTrust application, Site Administrator users configure web forms that contain custom branding and styling for a particular organization. Once configured, an HTML link is generated that organizations can embedded on their privacy policy pages, making the web form available for data subjects to submit requests.

Web forms are hosted by the OneTrust application, meaning web form submission is performed directly in the OneTrust platform. Requests can also be created using the Asynchronous Request Creation API, which is secured by safelisted URLs, an API token, and an expected payload. On Premises clients will need host this on their own infrastructure.

Indefinitely until they are manually deleted from the application. For more information, see Deleting a Request Permanently.

Yes, OneTrust offers a Toll-Free Number add-on for the Privacy Rights Automation module. If you are interested in adding this offering, please contact your Account Executive.

For more information, see OneTrust Toll-Free Number Solution FAQs.

Yes, importing historic requests is possible via the Import Historic Data Subject Request bulk import template.

For more information, see Importing Historic Requests Into OneTrust.

It is ultimately up to your organization to choose where to make your shareable link accessible to requestors. However, organizations commonly publish their web form via a hyperlink in their privacy policy or the footer of their public-facing website.

Yes, you can customize the web form URL to reflect your custom subdomain. This customization can also extended to the Privacy Portal URL. Please contact your OneTrust Team with more details to make a request for a fully qualified domain.

For more information, see Customizing OneTrust with a Custom Domain.

Yes, you can export existing web form configurations as JSON files to import into different organizations and accounts. For more information, see Migrating Web Form and Workflow Templates.

No, you cannot change form field IDs.

Yes, OneTrust web forms allow for custom validation with regular expression (ReGex) that can limit the acceptance criteria for input fields. For more information, see Custom Validation for Web Form Fields.

Yes, the setting Mask Entry in Web Form in the Web Form Customization screen will allow you to mask personal information and prevent unauthorized users from viewing that data. This setting also masks sensitive data on request details and in the Privacy Portal.

It is open to all user input type fields.

OneTrust supports a number of common attachment types as part of request fulfillment. For more information, see Accepted File Types for Privacy Rights Automation.

Yes, with some exception. The web form does not support < or > characters to protect against possible malicious content.

OneTrust currently uses Google reCAPTCHA 2.0 for web forms.

OneTrust does not externally index web forms, so customers must provide links themselves. Customers that don't want their web form to be indexed should use rel="nofollow" when linking to the form from their site.

Yes, this ability is available to enterprise customers only. Contact support@onetrust.com to enable this feature for your account.

Each OneTrust web form template is pre-configured with a set number of supported languages. However, OneTrust does not support machine or auto-translation of the templates to meet custom translations. For more information, see Providing Translations on Web Forms.

Yes, in order to provide specific or ad hoc translations, you will need to provide them when configuring the web form. For more information, see Providing Translations on Web Forms.

No, you do not need to generate a new link to the web form as the URL is maintained.

No, previously published versions of web forms cannot be edited. In order to make changes, a new version must be published.

No, OneTrust does not currently support version reverting for web forms. You can however view version histories with supporting metadata. For more information, see Using Web Form Versioning.

The latest active version of the web form will be used when copying web forms.

Web forms must be published in order for new configurations to appear on live web forms.

The web form must be saved after changes are made in order to update the version label.

The Edit Request modal will display fields and option values based on the version the request was created against.

Yes, you can delete web forms. However, if at least 1 request has been submitted through that web form, and that request still exists, then deleting the web form will not be allowed at that time.

No, deleting a web form is permanent. This action cannot be undone.

Check if the Request Details field contains unsupported characters or HTML.

It depends on many factors and ultimately comes down to what makes the most sense for the organization. OneTrust recommends creating a workflow for each request’s internal fulfillment process that should be followed depending on the data subject’s web form input. Typically, this means configuring a workflow for each request type you support and/or any other unique request use-case.

Yes, if the workflow was previously activated. Requests submitted will be assigned to the previous version of the workflow. Changes to the draft workflow will not display until the draft is activated.

Any time you make updates to a workflow that is assigned to a web form, you must reactivate the workflow in order for the web form to update to the new workflow. Otherwise, any requests that are submitted will trigger the last published version of the workflow.

Currently, OneTrust doesn’t support customer stage creation through API integration.

Yes, this is possible. However, updating the request to the seeded Closed stage status is not a supported solution.

Yes, you can click on the workflow stage to move the rejected request to another stage. Also, any subtask in that stage won't be re-triggered as a result of this change.

As soon as there are less than 24 hours left on a day (after 12am in local time), the days left should decrease by 1. For example, if a request is created at 11:50pm with 30 days left, the count decreases to 29 when it turns 12:00 am.

Yes, you will need to enable the workflow stage setting Auto-calculate request deadline at this stage on the Unverified stage.

Ideally, it is recommended no more than two days with one day being the most practical use case. Users are more likely to verify their email right away as soon as they receive the initial email. This also minimizes the amount of time the email verification is idle in a user's inbox.

You can resend email confirmation notifications to unverified data subjects whose request is in held in the UNVERIFIED workflow stage. For more information, see Enabling Web Form Verification Settings.

Once a request expires because an email wasn't verified, the data subject must submit a new request to re-initiate the intake process. You can use the resend email verification feature to send reminders days in advance before expiration.

No, this message cannot be changed. You can customize the header and message sent to end-users when the request expires in the Request Expired Header and Request Expired Message fields, respectively, on the Web Form Customization screen, but these fields do not change the expired link message.

This action is restricted by design until email verification is complete. It is not recommended to send or share personal info with an unverified data subject until they have confirmed ownership of the email submitted on the request. If OneTrust customers elect to bypass this default security design, they can do so by manually moving the request to the next stage.

Yes, OneTrust supports partnerships with identity providers to assist with identity verification. When data subjects submit their request, Privacy Teams can add verification methods within the request workflow to process identity verification before honoring the request fulfillment. Privacy Team members can view the verification status, collect documentation, and track comments in the verification results.

Currently, OneTrust does not support encryption of the token in favor of encrypting the whole connection via TLS. OneTrust must be able to parse the claims from an unencrypted ID token in order to support auto-population of web form fields.

You can vote or comment on a product enhancement for JWE support in the Ideas Exchange here.

Yes, OneTrust will always validate the token signatures. Tokens that fail to validate will display "Failed" status for their verification method.

No, the token will be sent through a REST request.

Currently, OneTrust doesn't support custom ports as a configurable setting in the application at this time. Please contact OneTrust to inquire about support for custom ports and IdPs.

OneTrust does not charge the data subject for receiving the message, though, standard rates may apply depending on the data subject's phone provider. For more information, see Twilio's SMS FAQ.

OneTrust customers will not be charged for the verification text, though, standard rates may apply depending on the data subject's phone provider. For more information, see Twilio's SMS FAQ.

This is dependent on the languages supported by Twilio. Currently, OneTrust cannot offer language customization of text messages sent for phone verification.

OneTrust can ONLY send data to LexisNexis that is collected through the seeded web form fields, which includes the following:

1. First Name

2. Last Name

3. Address

4. City

5. State

6. Country

7. Zip Code

8. Date of Birth

9. National ID (used to collect full or last four digits of SSN)

Yes, but the custom fields will not be sent to LexisNexis.

No. You will need to replace (i.e. delete or disable) those fields and enable the seeded fields.

Yes. You can change the labels and descriptions on the seeded fields.

Custom fields will have a trash icon displayed in the editor. Seeded fields cannot be deleted from the form, only disabled.

OneTrust can ONLY send data to Experian that is collected through the seeded web form fields, which includes the following:

1. First Name

2. Last Name

3. Address

4. City

5. State

6. Country

7. Zip Code

8. Date of Birth

9. National ID (used to collect full or last four digits of SSN)

10. Phone Number

11. Contact Preference

Yes, but the custom fields will not be sent to Experian.

No. You will need to replace (i.e. delete or disable) those fields and enable the seeded fields.

Data subjects can access the Privacy Portal using a secure link that is provided whenever a member of your organization posts a public reply to the request. The link is not provided in the data subject request submission confirmation email. For more information, see Accessing the Privacy Portal and Accessing the Privacy Portal via Multi-Factor Authentication.

Remembering all the usernames and passwords they have for various accounts is challenging and cumbersome for users. OneTrust streamlines authentication by verifying a data subject’s email address, and then providing access via a link sent through email. Users will use this to request a one-time password and access the Privacy Portal for a secure session. By using this method, the data subject doesn’t have to remember any new information.

No. One-time passwords are enabled for all requests and data subjects accessing the Privacy Portal.

Yes, there is a setting option in Global Settings to have OneTrust remember a user when they log into the portal for a configurable number of days. OneTrust assigns a device ID after the ReCaptcha and one-time password are validated. The device ID is securely stored as a JSON Web Token (JWT).

The inactivity modal appears after 8 minutes of inactivity, with the session timing out after 10 minutes. Clicking Extend Session adds 10 more minutes to the session.

The portal will adopt the branding of the organization as defined in Global Settings.

Navigate to Global Settings > Privacy Rights Automation > Portal footer customization and use the text editor to craft a custom footer. For more information, see Setting Up the Privacy Portal.

Navigate to Global Settings > Privacy Rights Automation > Portal language and enable each of the languages you want to make available in the portal.

The Privacy Portal will populate in whichever language the data subject selected as their preferred language on the web form (given their language selection is also enabled in Global Settings). They can choose their preferred language in the Privacy Portal by selecting from the drop-down options.

In the event that a data subject selects their desired language preference on the web form and that same language is not enabled for the portal in Global Settings, then the Privacy Portal language will default to English (US). If a certain field or value does not have an available translation in their preferred language, the system will also default to English (U.S.).

Public comments and automated comments can be seen by data subjects in the portal.

No, this is currently not supported.

Calendar days. Under GDPR and ICO guidance, requests must be completed in calendar days, not business days.

No, the date format on the Privacy Portal cannot be changed. The default format is MM/DD/YYYY.

For more information on the using the Trust Center to process data subject requests, see Adding a Privacy Requests Section.

No, this is currently not a supported view selection.

Requests deleted from the queue are hard-deleted and cannot be recovered. Currently, OneTrust does not have an audit history in the UI to show who deleted a request.

It is not possible to search for free text in the Request Queue. Data recorded in free text fields on requests is not searchable.

Yes, summary email notifications can be enabled in the Notifications section of the User Preferences menu. Once you enable the setting you can select the frequency at which you want to receive email notification summaries.

For more information, see Enabling Notification Summary Emails.

This is the expected behavior. OneTrust considers the Country and State fields as encrypted personally identifiable information (PII). OneTrust does not currently allow the filtering of encrypted fields.

Yes, OneTrust provides public APIs for the Privacy Rights Automation module.

For more information, see the developer portal API reference to view the full list of APIs.

Enterprise customers only can use the request creation API perform client-to-client integrations. This is possible if customer A is authorized to use and has access to the API key for customer B’s tenant.

OneTrust encrypts its API calls using the Transport Layer Security (TLS) 1.2 protocol as a supported solution to securing communications. API calls are tied via an access token between the user session and their respective account. This ensures that communication to and from OneTrust during web form creation is secured over a network.

OneTrust requires customers have both a Privacy Rights Automation Advanced or Enterprise license and a Data Redaction license in order to use the redaction features. Contact your account executive to begin your implementation.

No, Data Redaction is not available for OneTrust Pro customers at this time.

Customers that have purchased Data Redaction will have the DSARDataRedaction permission enabled by default for the following user roles:

• Site Admin

• Privacy Rights Automation Manager

• Privacy Officer

• Project Owner (only on assigned requests)

• Project Viewer (only on assigned requests)

• Invited (only on assigned requests)

Data Redaction is currently limited to unstructured text and HTML (i.e. email body content in plain text or HTML). Support for additional text and document types is under future consideration. You can vote on these enhancements in the OneTrust Ideas Exchange.

No, but customers can redact documents outside of the OneTrust application and upload the file. This is still limited to unstructured text and HTML.

Currently, no. However, you can upload redacted files into the results summary and include in your response to the Data Subject. You can vote on these enhancements in the OneTrust Ideas Exchange.

Result summary data can be exported to .csv or .pdf files.

Data retrieved for redaction is held in a document service similar to DSAR request data in an encrypted format. For more information, see Encryption.

Athena scans the unstructured data and uses Natural Language Processing (NLP) technology to classify the content. This works by using context clues to classify words and phrases within the data.

No, Athena is able to autonomously detect the names of companies, people, and places using Named Entity Recognition (NER) technology.

Currently, you cannot edit or control the specific data categories that are available for redaction.

Confidence scores indicate the relative distance between the data sample being evaluated and the closest surrounding class labels. Athena will detect assumed data elements and classify text in its used context. Redacted results will populate an assigned data category and percentage indicating Athena's confidence of the match. For more detailed information on our classification service, see Using Classifiers for Data Discovery.

All templates created from the Incident Management module are considered an incident assessment type, as well as assessments launched from templates labeled as incident types and assessments with incident questions.

You can create an incident type template when creating templates from the Templates screen in the Incident Management module. Only incident type templates will be displayed here. The incident templates will not appear in the Assessment, Vendor Detail Assessment, or Inventory Detail Assessment screens.