Legal Entities in Third-Party Risk Management: Feature Guide

About Legal Entities

Legal entities are a type of inventory in the OneTrust application. Legal entities can be used to provide more granular, structured information about the parties involved in transfers of data. Legal entity records can be used in conjunction with assets, processing activities, and vendors to create a full view of your organization's processes and relationships.

Types of Legal Entity

In OneTrust, you can create legal entities to represent various types of groups with which your organization may share data. There are a few common use cases where organizations may want to use legal entities as part of their data maps and records.

Subsidiary Relationships

Many large organizations have subsidiaries which are either partially or wholly owned by the parent organization. Subsidiary organizations often have their own corporate structure and practices. If data is passed between parent and subsidiary organizations or amongst subsidiaries, these transfers should be shown in the data map.

Processor-Controller Relationships

Some organizations function as a processor on behalf of multiple controllers of data. Because processors and controllers have different responsibilities, it's important for both the processor and controller to keep records that accurately reflect the relationship between each party and the relevant data.

Business Partner Relationships

Some organizations may share data with external third party organizations as part of a strategic business partnership or affiliate relationship. Whenever data is shared with an external party, it should be recorded in the data map in order to track the transfers of data across organizations and borders.

How Legal Entities Relate

In many cases, legal entities will be described using information that may already be stored in your processing activity records.

The attributes used to describe legal entities include information about operating location, representative, Data Protection Officer, and contact details. By storing this information in its own record, separate from the processing activity record, you can leverage the structured data to create reports and gain visibility into the entities with which you have relationships.

When you create a link or relationship between a processing activity and a legal entity, you can select from the following types of relationship to describe how a legal entity interacts with the data involved:

  • Recipient

  • Processor

  • Controller

  • Joint Controller

Legal Entities Overview and Third-Party Risk Management Use-Cases

The legal entities inventory provides a structured way to capture, store, and report on the details (location, DPO details, contact info etc.) of the entities which exist within an organizations legal structure.



Legal entities play a crucial role in ensuring compliance with the Digital Operational Resilience Act (DORA) by helping to accurately complete the Register of Information requirements. For more information about how Legal Entities fit into DORA Register of Information reports, refer to the DORA section of the Third-Party Risk Management knowledge base.

Capturing information and storing it in a structured manner by using the entities inventory and the entity relationships will reduce manual effort, improve reporting and visualization capabilities, and allow you to get the most value out of your data.

Structured data for visuals and reports:

  • Capture data flows between various legal entities for a given processing activity by linking them to the process using the 'collection/source' 'storage/processing' and 'destination/access' link types to visualize the entities on the lineage diagram.

Reduce maintenance, manual effort, and questions for business owners:

  • Capture information such as the LEI of the entity, the type of entity, contact details, and the country of a legal entity.