Onetrust

---
name: onetrust
description: "Expert agent for OneTrust GRC and privacy management. Covers privacy program management (GDPR, CCPA, DSAR automation, consent management, data mapping/RoPA), tech risk management, third-party risk, AI governance, and ethics and compliance. WHEN: \"OneTrust\", \"consent management\", \"DSAR automation\", \"data mapping\", \"RoPA\", \"OneTrust privacy\", \"OneTrust vendor risk\", \"AI governance OneTrust\", \"OneTrust GRC\"."
license: MIT
---

# OneTrust

This skill covers OneTrust's platform covering privacy management, GRC, third-party risk, and AI governance, with particular depth in GDPR/CCPA compliance, consent management, and data subject rights automation.

## How to Approach Tasks

1. **Identify the OneTrust module** — Privacy (consent, DSAR, data mapping), Tech Risk, Third-Party Risk, Ethics & Compliance, or AI Governance
2. **Classify the request:**
   - **GDPR/Privacy program** — Apply privacy management and data mapping guidance
   - **Consent management** — Apply consent banner and preference center guidance
   - **DSAR automation** — Apply data subject request workflow guidance
   - **IT/Tech risk** — Apply GRC risk management guidance
   - **Vendor risk** — Apply TPRM workflow guidance
   - **AI governance** — Apply AI inventory and risk assessment guidance
3. **Apply platform context** — OneTrust has a modular architecture; identify which module handles the request

## Platform Overview

OneTrust is a broad platform spanning privacy, risk, compliance, and trust. It is the market leader in privacy management and increasingly covers enterprise GRC.

**Strengths:**
- Privacy-first (GDPR, CCPA, global privacy laws)
- Consent management (cookie banners, preference centers)
- Data mapping and Records of Processing Activities (RoPA)
- DSAR (Data Subject Access Request) automation
- AI governance (AI inventory, risk assessment, EU AI Act)

**300+ integrations including:**
- Cloud providers: AWS, Azure, GCP
- CRM: Salesforce, HubSpot
- Analytics: Google Analytics, Adobe Analytics, Mixpanel
- CDPs: Segment, mParticle
- HR: Workday, BambooHR, SAP SuccessFactors
- Identity: Okta, Entra ID

## Privacy Management Module

### GDPR Program Setup

**Key GDPR requirements OneTrust automates:**

```
Article 13/14: Privacy notices
  → OneTrust policy center: create layered privacy notices
  → Version control; publish to website automatically
  → Automatic update notifications to affected users

Article 30: Records of Processing Activities (RoPA)
  → Data mapping tool: catalog all data processing activities
  → System of record for: what data, which systems, what purpose,
    legal basis, retention period, third-party transfers

Article 35: Data Protection Impact Assessments (DPIAs)
  → DPIA assessment workflow: risk identification, evaluation, treatment
  → Template library (OneTrust pre-built + custom templates)
  → Automated trigger: flag when new processing activity requires DPIA

Articles 15-22: Data Subject Rights (DSARs)
  → Request intake: web form, email, API
  → Automated workflow: identity verification, data discovery, response
  → Deadline tracking (30-day GDPR deadline)

Article 7: Consent Management
  → Cookie banners with IAB TCF 2.2 support
  → Preference center: granular consent capture
  → Consent record storage and audit log
```

### Data Mapping (Records of Processing Activities)

The RoPA is the foundation of a GDPR compliance program.

**Data inventory structure:**

```
Asset → Processing Activity → Data Flow → Legal Basis → Risk

Asset example: "Salesforce CRM"
  Processing Activities linked:
    → "Customer Marketing" (Purpose)
      Data elements: Name, Email, Company, Purchase history
      Data subjects: Customers, Prospects
      Legal basis: Legitimate interest (marketing to existing customers)
      Retention: 3 years post last purchase
      Processors: Salesforce Inc. (US) — SCCs in place
      Recipients: Marketing team, Sales team
      Cross-border transfer: US (EU → US; SCCs cover)
      Risk level: Medium
    
    → "Customer Support" (Purpose)
      Data elements: Name, Email, Support ticket content, Device info
      Legal basis: Contract performance
      Retention: 2 years
      ...
```

**Populating the data map:**
```
Method 1: IT/business questionnaire
  → OneTrust sends questionnaire to system owners
  → They describe: what data, for what purpose, what legal basis
  → OneTrust imports responses into data map

Method 2: API auto-discovery
  → Connect OneTrust to cloud providers
  → Auto-discovers data stores (S3 buckets, databases, SaaS apps)
  → Flags for manual classification and processing activity documentation

Method 3: Data scanning
  → OneTrust Privacy Scanner crawls websites/applications
  → Identifies cookies, trackers, and data collection points
  → Auto-populates cookie inventory in consent management
```

### Consent Management

**Cookie Banner Configuration:**

```
OneTrust Cookie Compliance → Properties → Create property
  → Website URL
  → Law: GDPR, CCPA, LGPD, etc. (selects applicable requirements)
  → Cookie scan: auto-discovers cookies on website
  → Categorize cookies:
      Strictly Necessary: Cannot be blocked (no consent required)
      Performance: Analytics, monitoring (consent required under GDPR)
      Functional: Personalization, chat widgets (consent required)
      Targeting/Advertising: Ad tracking, retargeting (consent required)
  → Banner design: customize appearance to match brand
  → Language: multi-language support (OneTrust auto-translates to 40+ languages)
```

**Consent Record Storage:**

```
Every consent event stored:
  user_id or anonymous_id (hashed)
  timestamp: ISO 8601
  consent_version: which version of the banner was shown
  purposes_consented: [analytics, advertising]
  purposes_declined: [targeting]
  signal: explicit_consent / implicit / opt_out
  ip_address: for jurisdiction determination
  user_agent: browser fingerprint
  
Consent audit log:
  → Immutable record; cannot be edited
  → Exportable for regulatory inquiry
  → Searchable by: user, date, consent version, purpose
  → Retention: configurable (recommend 3+ years)
```

**IAB TCF 2.2 (for advertising-heavy sites):**
- OneTrust is a certified Consent Management Platform (CMP) for IAB TCF
- TCF consent strings propagate to ad tech vendors automatically
- Required for: programmatic advertising with Google, The Trade Desk, etc.
- Configure: OneTrust → Cookie Compliance → TCF Settings → Enable IAB TCF 2.2

### DSAR Automation

Data Subject Access Requests require response within 30 days (GDPR) or 45 days (CCPA).

**DSAR intake methods:**
```
1. Web form (OneTrust-hosted or embedded on your site)
   → Auto-detects request type (access, deletion, portability, correction)
   → Captures: requester identity, contact info, request details
   → Confirmation email sent automatically

2. Email intake
   → Configurable email address (privacy@company.com)
   → OneTrust reads inbox, creates DSAR ticket

3. API
   → REST API for programmatic DSAR intake
   → For: mobile apps, customer portals with native request forms
```

**DSAR workflow:**
```
Stage 1: Intake (Day 0)
  → DSAR created in OneTrust queue
  → Assigned to privacy team or auto-assigned by request type
  → 30-day clock starts

Stage 2: Identity Verification (Days 1-5)
  → Send verification request to requester
  → Options: email verification, ID document upload, knowledge-based auth
  → Unverified requests: hold clock until verified (GDPR allows reasonable verification)

Stage 3: Data Discovery (Days 5-20)
  → Send discovery tasks to data owners (HR, marketing, IT, product)
  → Task: "Do you have data about this person? Collect and return by [date]."
  → OneTrust tracks task completion; sends reminders
  → Auto-discovery: if integrated with CRM/CDPs, pull records automatically

Stage 4: Data Review and Compile (Days 20-25)
  → Privacy team reviews collected data
  → Remove: third-party data, legally exempt data, security-sensitive data
  → Compile: into a single response package

Stage 5: Response (by Day 30)
  → Send response to requester via secure OneTrust portal
  → Access request: data package delivered
  → Deletion request: confirm deletion completed across all systems
  → Portability: structured machine-readable format (CSV, JSON)

Deadline tracking:
  → Dashboard shows: overdue, due today, due this week, on track
  → Escalation: auto-alert if < 5 days to deadline with no action
  → Clock extension: document if additional 30-day extension used (GDPR allows 1 extension)
```

## Tech Risk Management

### IT Risk Assessment

OneTrust Tech Risk covers traditional IT risk management:

```
Risk module capabilities:
  → Risk register: create, score, assign, track risks
  → Risk assessment templates: IT risk, cyber risk, vendor risk, cloud risk
  → Risk scoring: configurable likelihood × impact matrix
  → Control library: link controls to risks
  → Control testing: test design effectiveness + operating effectiveness
  → Risk dashboards: heat maps, trend analysis, executive reporting
  → Regulatory mapping: link risks to regulatory requirements
```

**Risk assessment workflow:**
```
1. Create risk assessment
   → Assessment type: IT Risk Assessment, GDPR DPIA, Cloud Risk, etc.
   → Scope: specific system, process, or business unit
   → Assessor assigned

2. Complete assessment questionnaire
   → OneTrust pre-built questionnaires or custom
   → Each question maps to a risk domain
   → Responses drive risk score calculation

3. Review and treatment
   → Review inherent risk scores by domain
   → Define controls to mitigate
   → Calculate residual risk
   → Assign remediation tasks with owners and due dates

4. Approve and publish
   → Risk owner approves final assessment
   → Assessment stored with version history
   → Links to RoPA if privacy risk (DPIA)
```

### Policy and Compliance Management

```
OneTrust Policy Center:
  → Policy library: create, version, approve policies
  → Distribution: push to employees
  → Attestation: annual acknowledgment campaigns
  → Gap management: map policies to controls and frameworks
  → Regulatory change monitoring: alerts when laws affecting your policies change
```

## Third-Party Risk Management (TPRM)

### Vendor Risk Workflow

```
1. Vendor Intake
   → Submit vendor via OneTrust intake form
   → Classify: data types shared, access level, operational criticality
   → OneTrust auto-assigns risk tier (Critical/High/Medium/Low)

2. Assessment Assignment
   → Auto-assign questionnaire based on risk tier
   → Critical: full SIG questionnaire + follow-up
   → Medium: abbreviated questionnaire
   → Low: self-attestation

3. Questionnaire Delivery
   → Vendor receives email with OneTrust portal link
   → Self-service: vendor completes questionnaire in portal
   → OneTrust tracks progress; sends reminders
   → Reviewer notified when complete

4. Review and Scoring
   → OneTrust auto-scores responses (configurable scoring rubric)
   → Highlights high-risk answers for human review
   → Reviewer adds findings and recommendations
   → Risk rating assigned: Low / Medium / High / Critical

5. Approval or Remediation
   → Approve: vendor approved with documentation
   → Conditional: approved with required remediation plan
   → Reject: escalate to procurement

6. Ongoing Monitoring
   → Annual reassessment schedule
   → BitSight/SecurityScorecard integration for continuous rating
   → Breach news monitoring
   → Contract renewal triggers reassessment
```

**GDPR-specific vendor requirements:**
```
For any vendor processing EU personal data:
  → Data Processing Agreement (DPA): upload and track execution
  → Transfer mechanism: SCC, adequacy decision, BCR
  → OneTrust generates: DPA based on processing activities
  → Tracks: DPA expiry, SCCs version (Standard Contractual Clauses 2021)
  → Risk: vendor in non-adequate country without SCC = high risk flag
```

## AI Governance Module

### AI Use Case Inventory

Organizations face increasing requirements to inventory AI systems (EU AI Act, NIST AI RMF).

**AI inventory structure:**
```
AI System: "Customer Churn Prediction Model"
  Type: ML classification model
  Purpose: Predict customer churn probability for retention outreach
  Risk tier: Medium (EU AI Act: not high-risk category)
  
  Technical details:
    → Algorithm: Gradient boosting (XGBoost)
    → Training data: 3 years purchase history, support tickets
    → Data subjects: Customers
    → Output: Churn probability score (0-100)
  
  Data handling:
    → Input data: Name, purchase history, support ticket sentiment
    → PII involved: Yes — linked to customer profiles
    → Data retention: Model retrained quarterly; training data retained 3 years
  
  Risk assessment:
    → Bias risk: potential disparate impact on customer segments
    → Accuracy risk: false positives → unnecessary retention spend
    → Privacy risk: processing behavioral data for automated decision
  
  Accountability:
    → Model owner: Data Science team
    → Business owner: Customer Success VP
    → Governance review: quarterly
    → EU AI Act: not prohibited; not high-risk — no notified body required
```

**EU AI Act risk categories in OneTrust:**
```
Prohibited AI (Article 5 — not allowed):
  → Social scoring by public authorities
  → Real-time remote biometric surveillance in public spaces (with exceptions)
  → OneTrust flags these automatically if discovered in inventory

High-Risk AI (Annex III — significant obligations):
  → Biometric ID and categorization
  → Critical infrastructure management
  → Education and vocational training
  → Employment/HR decisions
  → Essential private services (credit scoring, insurance)
  → Law enforcement
  → Migration and border control
  → Administration of justice
  → OneTrust requirements: conformity assessment, technical documentation, 
    human oversight, accuracy/robustness requirements, registration in EU database

Limited and Minimal Risk AI:
  → Reduced requirements; transparency obligations only
```

**AI risk assessment workflow:**
```
1. Register AI system in inventory (manual or via API)
2. Complete AI risk questionnaire
   → Automated EU AI Act tier classification based on responses
   → Identifies applicable requirements (technical doc, human oversight, etc.)
3. Review risk findings
   → Privacy risks (DPA trigger if processes personal data)
   → Bias and fairness risks
   → Security risks (adversarial attack vulnerability)
4. Create risk treatment plan
5. Link to DPA/processing activity (GDPR link)
6. Ongoing governance
   → Quarterly review schedule
   → Model performance monitoring
   → Incident reporting if AI system causes harm
```

## Ethics and Compliance Module

### Policy Management and Regulatory Change

```
Regulatory change monitoring:
  → OneTrust monitors: 2,000+ regulatory sources across 100+ jurisdictions
  → Alert: "GDPR guidance updated by DPA in Germany — review your cookie practices"
  → Link to: affected policies and controls
  → Task: assigned to policy owner to review and update

Ethics and compliance use cases:
  → Conflict of interest management
  → Code of conduct distribution and attestation
  → Whistleblower hotline integration
  → Training management (ethics training completion tracking)
  → Investigation management (for ethics complaints)
```

## Reporting and Dashboards

**Privacy dashboard:**
- DSAR queue status (on-track, overdue, counts by type)
- Consent rates by banner and jurisdiction
- Cookie scan results (compliant/non-compliant properties)
- Data processing activities by risk level
- Vendor compliance status

**GRC dashboard:**
- Risk heat map
- Control effectiveness (% controls passing)
- Audit findings and remediation status
- Policy attestation rates

**AI governance dashboard:**
- AI system inventory by risk tier
- EU AI Act compliance status
- Open AI risk findings

## Common Issues and Troubleshooting

**Cookie banner not loading on website:**
1. Verify the OneTrust script is correctly placed in the `<head>` section
2. Check for JavaScript errors in browser console blocking OneTrust script
3. Verify domain is correctly added in OneTrust properties settings
4. Test in incognito mode (cached consent can hide issues)

**DSAR not routing to correct assignee:**
1. Review assignment rules: OneTrust → DSAR → Settings → Assignment rules
2. Verify request type mapping (access vs. deletion → different queues)
3. Check if assignee email is active and receiving notifications

**Data map not populating automatically:**
1. Verify cloud integrations are authorized (OAuth tokens may expire)
2. Check privacy scan is scheduled and running
3. Manual import: use CSV import for legacy systems not integrable

**AI risk tier classified incorrectly:**
1. Review questionnaire responses — EU AI Act tier is driven by use case answers
2. Reclassify manually if auto-classification is wrong
3. Document the manual classification reasoning for audit trail