Keeping inventories up-to-date and accurate is an important part of privacy regulation compliance. Updating different inventory records is one of the first steps you can take to ensure you have the most reliable information on your processing activities, assets, vendors, and entities. You can directly collect information needed for your inventory records by sending assessments and including specialized questions that will give you detailed insight on your inventories and the information they contain.
About Data Mapping Automation Assessment Templates
The module has everything you need to document your records of processing activities as well as contextually understand how data is handled across your organization. OneTrust allows you to add questions to your assessments that directly update inventories. OneTrust offers a full template gallery based on regulations and frameworks from around the world. The built-in assessment templates are designed by our legal and product teams to help you easily capture information and are fully translated into our supported languages. Templates are customizable, but you can also build your own to fit your specific needs. The Template Builder allows you to fully configure template-based or original assessments, and you can edit, add, or delete questions as needed.
Assessments can be built from templates, which are pre-configured to help you achieve detailed and accurate responses. Once an assessment has been assembled, it can be launched and sent out to respondents. Upon completion and approval, the assessment will populate your inventories with the up-to-date information from your respondent's answers.
Begin by choosing a template from the template gallery in or by creating your own. When using templates, OneTrust recommends the Processing Activity Template for capturing information about processing activities. You can also use a CCPA Processing Activity Inventory, GDPR Record of Processing (Controller), or GDPR Record of Processing (Processor) template depending on your specific needs. If you want to gather information on assets, OneTrust recommends the Asset Discovery Template. These pre-configured templates can be customized or effectively used as-is.
Assessments are divided into sections, which can be edited or deleted. Sections help organize an assessment and keep related questions grouped together. Add sections to your questionnaire template using the Add Section button in the Template Builder.
Sections often contain realted questions of various types. Templates are pre-populated with questions that can be edited or deleted. OneTrust offers templates that are tailored to different needs, whether you're assessing compliance with a privacy law, collecting information on a specific type of inventory record, or making sure your data processing meets an industry standard. As you configure the assessment, use the Template Builder to add, edit, or delete questions.
Best Practices and Expert Advice
When building assessments that are designed to update a specific record, it is important to specify which record the questions will update. Use the Primary Record setting to indicate which inventory record your assessment is primarily designed to update. Using this feature pre-populates the assessment with any linked data elements and attributes. When Primary Record is setting is enabled, any changes the assessment respondent makes to related inventory or personal data questions will overwrite and update the record.
Three question types are key to updating your inventory records: Inventory Questions, Attribute Questions, and Personal Data Questions.
An inventory is a list of the processing activities, assets, entities, or vendors to which your data is linked or related. Inventory questions capture information on items from any inventory type involved in processing activities. When building an inventory question, you select the type of inventory record you're collecting information on. Respondents will be able to choose a specific inventory record from a selection menu that best answers the question. The list of response options for these questions is based on the records present in your processing activity, asset, vendor, or entity inventory. For example, to capture information about a third-party vendor, use a vendor inventory question. When a respondent makes a selection, their answer options will show items from the vendor inventory.
Attributes are descriptors of the processing activities, assets, entities, and vendors that interact with your data. Attribute questions can be used to track information on an attribute for any inventory record. Attribute questions are always linked to previous inventory questions in the assessment. When building an attribute question, you select the inventory that the response will update and the attribute it applies to. Respondents will type a response that best answers the question. The response options for these questions are based on available attributes, configured in the Attribute Manager. Once approved, the responses to these questions will update specific fields on the details page for an inventory record. For example, if you wanted your assessment responses to update an attribute for a source asset, you would link to a source asset inventory record question and select an attribute from the selection menu in the Template Builder.
Personal data is any information collected on an individual, known as a data subject. Personal data questions collect information on the types of data subjects and pieces of data present in your organization's inventory. The response options for these questions are determined by the types of data subjects, categories, classifications, and elements present on the Personal Data Configuration screen. Personal data questions are always linked to an inventory question in the assessment. For example, if you wanted a response to indicate what type of personal data is involved in a processing activity, you would place the question after a processing activity inventory question. When assembling the personal data question, you would choose the question name and number from the selection menu.
|
1.
|
What is an assessment?
|
|
Assessments can be thought of as a "moment in time," a snapshot, or a receipt of what a processing activity or asset looked like at a given time. They are used as a way to gather information to populate the inventory records.
|
|
1.
|
What is an inventory?
|
|
An inventory is always the most up to date information about a processing activity or asset or vendor. It is your evergreen record. The data stored in the inventory is used to create visuals and reports for regulators, so keeping it up-to-date is important.
|
|
1.
|
What is an attribute?
|
|
An attribute is a descriptor or descriptive component of an inventory record. Attributes can provide specific information about how data is handled.
|
|
1.
|
What is personal data?
|
|
Personal data is any information related to an identified or identifiable natural person. It is the information on individuals that can be collected, stored, or shared.
|
