05 OneTrust

Modern organizations process enormous amounts of personal, confidential, regulated, and business-sensitive information.

This information may exist across:

Websites

Mobile Applications

Cloud Platforms

SaaS Applications

Databases

Employee Systems

Marketing Platforms

Third-Party Vendors

Customer Applications

Analytics Platforms

At the same time, organizations may need to comply with multiple privacy and regulatory requirements.

Examples include:

GDPR

CCPA / CPRA

India DPDP Act

HIPAA

PCI DSS

Industry Requirements

Contractual Obligations

Internal Policies

Managing these requirements through spreadsheets, emails, shared folders, and disconnected assessment processes quickly becomes difficult.

OneTrust provides a platform with capabilities across areas such as privacy, data governance, consent, third-party risk, ethics, and broader governance and compliance activities.

From a GRC perspective, the important relationship is:

Data
      ↓
Processing Activity
      ↓
Business Purpose
      ↓
Privacy Requirement
      ↓
Risk
      ↓
Control
      ↓
Assessment
      ↓
Evidence
      ↓
Remediation
      ↓
Monitoring

The objective of this lesson is not to memorize every OneTrust screen.

The objective is to understand how an enterprise platform can operationalize privacy, data governance, third-party risk, and compliance processes.

Learning Objectives

By the end of this lesson, you will be able to:

• Explain the purpose of OneTrust.

• understand OneTrust from a GRC perspective.

• understand privacy program management.

• understand data inventories.

• understand data mapping.

• understand Records of Processing Activities.

• understand privacy impact assessments.

• understand Data Protection Impact Assessments.

• understand privacy risk assessments.

• understand data subject rights workflows.

• understand consent management.

• understand preference management.

• understand cookie governance.

• understand third-party privacy risk.

• understand vendor assessments.

• understand regulatory compliance management.

• understand control mapping.

• understand policy management.

• understand privacy incidents.

• understand evidence management.

• understand remediation workflows.

• understand risk registers.

• understand dashboards and reporting.

• understand privacy metrics and KRIs.

• understand workflow automation.

• understand integrations.

• design an enterprise privacy operating model.

• connect privacy operations with enterprise GRC.

1. What Is OneTrust?

OneTrust provides technology capabilities that organizations can use across areas such as:

Privacy Management

Data Governance

Consent & Preferences

Third-Party Risk

Compliance

Risk Management

Policy Management

Ethics

Exact capabilities depend on the organization’s subscribed products, configuration, and platform version.

For a GRC professional, OneTrust can be viewed conceptually as:

Privacy Requirements
        +
Enterprise Data
        +
Business Processes
        +
Third Parties
        +
Risk
        ↓
Governance Platform
        ↓
Assess
        ↓
Control
        ↓
Monitor
        ↓
Evidence
        ↓
Report

2. Why Organizations Need Privacy Platforms

Consider a global organization with:

100 Business Applications

500 Vendors

50 Websites

Millions of Customers

Thousands of Employees

Multiple Countries

Personal data may exist everywhere.

Without structured governance, organizations may struggle to answer:

What Personal Data
Do We Have?

Where Is It?

Why Are We
Processing It?

Who Owns It?

Who Has
Access?

Which Vendors
Receive It?

How Long
Do We Keep It?

Which Laws
Apply?

What Happens
When Someone
Requests Their Data?

3. Privacy Governance Model

A mature privacy program connects:

Data
      ↓
Purpose
      ↓
Processing
      ↓
Legal / Regulatory Basis
      ↓
Risk
      ↓
Controls
      ↓
Monitoring
      ↓
Accountability

4. Privacy Program Stakeholders

Privacy governance usually requires collaboration between:

Privacy

Legal

GRC

Security

IT

Data Governance

HR

Marketing

Procurement

Business Owners

Privacy is not solely the responsibility of the privacy team.

5. Data Inventory

One of the foundations of privacy management is understanding the organization’s data.

A data inventory may capture:

Field	Example
Data Category	Customer Information
Data Subject	Customer
System	CRM
Owner	Sales Operations
Purpose	Customer Management
Classification	Confidential
Retention	Defined Schedule
Third Party	CRM Provider
Location	Cloud

6. Why Data Inventory Matters

Without an inventory, the organization may not know:

Where Personal
Data Exists

which makes it difficult to:

Protect It

Delete It

Respond to Requests

Assess Risk

Apply Retention

Demonstrate Compliance

7. Data Mapping

Data mapping identifies how information moves through the organization.

Example:

Customer
      ↓
Website
      ↓
CRM
      ↓
Marketing Platform
      ↓
Analytics
      ↓
Cloud Data Warehouse

8. Privacy Data Flow

A stronger map identifies:

Source

Data Type

Purpose

System

Recipient

Third Party

Location

Retention

Protection

9. Example Data Flow

Customer
      ↓
Email Address
      ↓
E-Commerce Platform
      ↓
CRM
      ↓
Marketing Provider
      ↓
Campaign

A privacy analyst should ask:

Why Is It
Collected?

What Purpose?

What Basis?

Who Receives It?

How Long
Is It Kept?

Can the
Individual Exercise
Applicable Rights?

10. Processing Activity

Privacy governance focuses heavily on processing activities.

Examples:

Employee Recruitment

Customer Registration

Marketing

Payroll

Fraud Detection

Customer Support

Website Analytics

11. Processing Activity Record

Example:

Activity:
Customer Marketing

Owner:
Marketing

Data Subjects:
Customers

Data:
Name
Email
Preferences

Purpose:
Marketing Communications

Systems:
CRM
Marketing Platform

Recipients:
Marketing Provider

12. Records of Processing Activities

Organizations subject to certain privacy obligations may maintain formal Records of Processing Activities — commonly called ROPA.

Conceptually:

Business Process
      ↓
Processing Activity
      ↓
Personal Data
      ↓
Purpose
      ↓
Recipients
      ↓
Retention
      ↓
Safeguards

13. ROPA Information

Depending on applicable requirements, records may include information such as:

Processing Purpose

Data Categories

Data Subjects

Recipients

Transfers

Retention

Security Measures

14. ROPA Is Not Just a Spreadsheet

Weak approach:

ROPA.xlsx
      ↓
Updated Once
a Year

Better:

Business Process
      ↓
System
      ↓
Data
      ↓
Vendor
      ↓
Processing Activity
      ↓
ROPA

where changes can feed privacy governance.

15. Data Ownership

Every important processing activity should have accountable ownership.

Example:

Recruitment
→ HR

Customer Marketing
→ Marketing

Payment Processing
→ Finance / Commerce

Security Monitoring
→ Security

16. Privacy Assessment

Organizations need mechanisms for assessing privacy risks associated with:

New Systems

New Vendors

New Data

New Processing

New Technologies

Major Changes

17. Privacy Impact Assessment

A Privacy Impact Assessment — PIA — helps identify privacy implications of a project, system, or processing activity.

Conceptually:

New Initiative
      ↓
Privacy Screening
      ↓
Data Analysis
      ↓
Risk Assessment
      ↓
Controls
      ↓
Approval

18. PIA Questions

A PIA may ask:

What Data
Is Collected?

Whose Data?

Why?

Where Is It
Stored?

Who Receives It?

How Long
Is It Retained?

What Security
Exists?

What Privacy
Risks Exist?

19. PIA Example

Project:

New Employee
Analytics Platform

Data:

Employee Name

Performance Data

Usage Data

Location Information

Privacy assessment identifies:

Purpose Risk

Transparency Risk

Access Risk

Retention Risk

Vendor Risk

20. Privacy Screening

Not every project requires the same level of assessment.

A screening workflow can determine:

Personal Data?
      ↓
Sensitive Data?
      ↓
Large Scale?
      ↓
New Technology?
      ↓
High-Risk Processing?
      ↓
Enhanced Assessment?

21. Data Protection Impact Assessment

A DPIA provides a structured assessment for processing that meets applicable criteria requiring deeper privacy-risk evaluation.

Conceptually:

Processing
      ↓
Necessity
      ↓
Proportionality
      ↓
Privacy Risk
      ↓
Controls
      ↓
Residual Risk
      ↓
Approval

22. DPIA Questions

A DPIA may evaluate:

Nature of Processing

Scope

Context

Purpose

Necessity

Proportionality

Risks to Individuals

Mitigation Measures

23. Privacy Risk Is About Individuals

Traditional cybersecurity often asks:

What Is
the Risk
to the
Organization?

Privacy also asks:

What Is
the Risk
to the
Individual?

This distinction is important.

24. Example

A breach of employee information may create organizational risk:

Regulatory Penalty

Reputation Damage

Legal Cost

but individual impacts might include:

Identity Theft

Discrimination

Financial Harm

Loss of Confidentiality

Personal Distress

25. Privacy Risk Register

Example:

Risk	Processing	Owner	Inherent	Residual
Excessive Collection	Marketing	Marketing	High	Medium
Unauthorized Access	HR Data	HR	Critical	Medium
Excessive Retention	Customer Data	Operations	High	Low
Vendor Disclosure	Analytics	Digital	High	Medium

26. Privacy Risk Lifecycle

Identify
      ↓
Assess
      ↓
Treat
      ↓
Monitor
      ↓
Review

27. Privacy Controls

Controls may include:

Data Minimization

Access Control

Encryption

Retention

Consent

Transparency

DLP

Vendor Controls

Deletion

Monitoring

28. Privacy by Design

Privacy should be considered:

Before

a system is launched.

Not:

After

the system is already processing millions of records.

29. Privacy-by-Design Workflow

Idea
      ↓
Architecture
      ↓
Privacy Assessment
      ↓
Controls
      ↓
Testing
      ↓
Approval
      ↓
Launch

30. Data Minimization

Ask:

Do we genuinely need this information for the stated purpose?

Example:

A newsletter signup requests:

Name

Email

Date of Birth

Home Address

Passport Number

Privacy review should challenge unnecessary collection.

31. Purpose Limitation

Information collected for:

Purpose A

should not automatically be reused for:

Purpose B

without appropriate governance and a valid basis.

32. Retention Governance

Privacy programs should define:

What Data?

Why Retained?

How Long?

Retention Trigger?

Deletion Method?

Legal Hold?

33. Retention Workflow

Data Created
      ↓
Business Use
      ↓
Retention Period
      ↓
Review
      ↓
Delete / Archive

34. Consent Management

Consent can be relevant for certain processing activities depending on the applicable legal and business context.

A consent record should provide evidence of:

Who?

What?

When?

Purpose?

Method?

Status?

35. Consent Lifecycle

Notice
      ↓
Choice
      ↓
Consent
      ↓
Record
      ↓
Preference
      ↓
Withdrawal

36. Consent Evidence

Example:

Subject:
Customer-001

Purpose:
Marketing Email

Status:
Consented

Date:
12 May

Source:
Website

Notice Version:
v3.2

37. Consent Must Be Governed

Avoid treating:

Checkbox

as the entire consent program.

Organizations may need to consider:

Purpose

Transparency

Choice

Recordkeeping

Withdrawal

Downstream Enforcement

38. Preference Management

Preferences may include:

Email

SMS

Phone

Personalization

Marketing Topics

39. Preference Center

Conceptually:

Customer
      ↓
Preference Center
      ↓
Email = Yes

SMS = No

Product Updates = Yes
      ↓
Connected Systems

40. Synchronization Matters

A customer may withdraw:

Marketing Email

but if:

CRM = Opt Out

Marketing Platform = Opt In

the organization has a governance problem.

41. Preference Architecture

User Preference
      ↓
Central Record
      ↓
CRM
      ↓
Marketing
      ↓
Other Systems

42. Cookie Governance

Websites may use technologies for:

Essential Functions

Analytics

Advertising

Personalization

Privacy teams need visibility into these technologies and applicable consent requirements.

43. Cookie Lifecycle

Website
      ↓
Scan
      ↓
Identify Technologies
      ↓
Categorize
      ↓
Consent Experience
      ↓
Preference
      ↓
Enforcement

44. Cookie Categories

Example:

Strictly Necessary

Functional

Analytics

Advertising

Actual classification should reflect the technologies and applicable requirements.

45. Cookie Inventory

Useful information includes:

Name

Provider

Purpose

Category

Duration

Domain

46. Consent Banner Governance

Avoid designing banners purely around:

How Do We
Get More Users
to Click Accept?

Governance should consider:

Transparency

Choice

Applicable Law

User Preference

Evidence

47. Data Subject Rights

Privacy laws may provide individuals with various rights depending on jurisdiction and context.

Examples may include:

Access

Correction

Deletion

Restriction

Portability

Objection

48. Rights Request Workflow

Request
      ↓
Identity Verification
      ↓
Scope
      ↓
Data Discovery
      ↓
Legal Review
      ↓
Fulfillment
      ↓
Response
      ↓
Evidence

49. Request Intake

Requests may arrive through:

Privacy Portal

Email

Customer Support

Mail

Other Approved Channels

50. Identity Verification

Before releasing personal information:

Verify
the Requester

Otherwise a privacy-rights process could itself create a data breach.

51. Request Discovery

The organization may need to search:

CRM

Email

HR Systems

Databases

Cloud Storage

SaaS Applications

Archives

depending on the request and applicable requirements.

52. Request Tracking

A platform can track:

Request ID

Request Type

Jurisdiction

Received Date

Due Date

Identity Status

Systems Searched

Owner

Response Status

53. SLA Management

Privacy rights often have legally defined response periods.

A workflow should therefore track:

Received
      ↓
Deadline
      ↓
Reminders
      ↓
Escalation

according to applicable law.

54. Request Evidence

Maintain appropriate evidence showing:

Request Received

Identity Verified

Systems Searched

Decision

Response

Completion Date

55. Third-Party Privacy Risk

Organizations frequently share personal data with:

Cloud Providers

Payroll Providers

Marketing Providers

Analytics Vendors

Support Providers

This creates third-party privacy risk.

56. Vendor Data Mapping

For each vendor understand:

What Data?

Whose Data?

Why Shared?

Where Processed?

Subprocessors?

Retention?

Security?

Contract?

57. Vendor Privacy Assessment

Assessment may evaluate:

Privacy Program

Security Controls

Data Locations

Subprocessors

Retention

Incident Response

Data Subject Support

Contractual Commitments

58. Vendor Risk Workflow

Vendor Request
      ↓
Privacy Screening
      ↓
Assessment
      ↓
Risk
      ↓
Contract Controls
      ↓
Approval
      ↓
Monitoring

59. Data Processing Agreements

Where applicable, organizations may need contractual provisions governing processing.

A DPA may address areas such as:

Processing Instructions

Confidentiality

Security

Subprocessors

Incident Notification

Deletion

Assistance

Audit Rights

Legal teams should determine required contractual language.

60. Vendor Monitoring

Privacy risk does not end after onboarding.

Onboard
      ↓
Monitor
      ↓
Reassess
      ↓
Incident?
      ↓
Contract Change?
      ↓
Offboard

61. Regulatory Compliance

Privacy programs may operate across multiple jurisdictions.

Example:

European Customers
      ↓
GDPR

California Consumers
      ↓
CCPA / CPRA

India
      ↓
DPDP Act

Actual applicability requires legal analysis.

62. Regulatory Library

A platform may help organize:

Regulations

Requirements

Policies

Controls

Assessments

Evidence

63. Requirement Mapping

Instead of maintaining separate controls for every regulation:

Privacy Control
      ↓
Multiple Requirements

where appropriate.

64. Example Control

PRV-001

Personal data must
be retained only for
approved periods.

Potential mappings may include:

Privacy Regulations

Internal Retention Policy

Contractual Requirements

65. Privacy Control Library

Example:

PRV-001
Data Minimization

PRV-002
Retention

PRV-003
Data Subject Rights

PRV-004
Privacy Notice

PRV-005
Vendor Privacy Assessment

PRV-006
Privacy Incident Management

66. Control Assessment

Control
      ↓
Evidence
      ↓
Testing
      ↓
Result
      ↓
Finding

67. Privacy Evidence

Evidence may include:

ROPA

PIA

DPIA

Consent Records

Privacy Notices

Vendor Assessments

Retention Records

Rights Request Logs

Training Records

Policies

68. Policy Management

Privacy policies may include:

Privacy Policy

Data Retention Policy

Cookie Policy

Data Subject Rights Procedure

Privacy Incident Procedure

Vendor Privacy Standard

69. Policy Lifecycle

Draft
      ↓
Legal Review
      ↓
Approval
      ↓
Publish
      ↓
Implement
      ↓
Review
      ↓
Update

70. Regulatory Change

Privacy regulations evolve.

Organizations need a process:

Regulatory Change
      ↓
Impact Assessment
      ↓
Affected Policies
      ↓
Affected Controls
      ↓
Affected Processes
      ↓
Remediation

71. Privacy Incident Management

A privacy incident may involve:

Unauthorized Disclosure

Loss of Personal Data

Incorrect Recipient

Excessive Access

Unauthorized Processing

72. Privacy Incident Workflow

Incident
      ↓
Triage
      ↓
Data Involved
      ↓
Individuals Affected
      ↓
Risk Assessment
      ↓
Legal Analysis
      ↓
Notification Decision
      ↓
Remediation

73. Security Incident vs Privacy Incident

A security incident:

Compromised Server

may become a privacy incident if:

Personal Data
Was Affected

74. Security-to-Privacy Integration

SOC Incident
      ↓
Personal Data?
      ↓
Privacy Team
      ↓
Privacy Assessment
      ↓
Legal / Regulatory Decision

75. Incident Evidence

Track:

What Happened?

When?

What Data?

How Many Individuals?

Which Countries?

What Protection?

What Impact?

What Actions?

76. Risk Treatment

Privacy risks may be:

Mitigated

Accepted

Avoided

Transferred

depending on organizational policy.

77. Privacy Risk Acceptance

A documented acceptance should include:

Risk

Impact

Controls

Residual Risk

Owner

Justification

Approval

Expiry / Review

78. Findings Management

Privacy assessments may identify:

Missing Notice

Excessive Collection

Missing DPA

Retention Gap

Unapproved Vendor

Weak Access Control

79. Finding Lifecycle

Finding
      ↓
Severity
      ↓
Owner
      ↓
Remediation
      ↓
Evidence
      ↓
Retest
      ↓
Closure

80. Example

Finding:

Customer Data
Retained Indefinitely

Root cause:

No Automated
Deletion Process

Remediation:

Define Retention
      ↓
Configure Deletion
      ↓
Test
      ↓
Monitor

81. Privacy Exceptions

Example:

Business Requests
Extended Retention

Workflow:

Request
      ↓
Business Need
      ↓
Legal Review
      ↓
Privacy Risk
      ↓
Approval
      ↓
Expiry

82. Privacy Metrics

Useful metrics may include:

Open PIAs

DPIAs Overdue

Rights Requests

Average Response Time

Requests Near SLA

High Privacy Risks

Vendor Assessments Overdue

Open Privacy Findings

Consent Withdrawal Rate

83. Privacy KRI

Example:

Rights Requests
Past Legal Deadline

could be a significant KRI.

84. Vendor KRI

Critical Vendors
Without Current
Privacy Assessment

85. Retention KRI

Systems Holding
Personal Data
Without Approved
Retention Rules

86. Privacy Dashboard

A privacy management dashboard might include:

ROPA Completion

PIA Status

DPIA Status

Rights Requests

Vendor Privacy Risk

Privacy Findings

Regulatory Changes

Retention Gaps

87. Executive Privacy Dashboard

Executives typically need:

Top Privacy Risks

Material Incidents

Regulatory Exposure

Critical Vendor Risk

Overdue Remediation

Privacy Program Trend

88. Workflow Automation

Privacy programs contain many repeatable workflows.

Examples:

PIA Assignment

DPIA Escalation

Rights Request Routing

Vendor Assessment

Evidence Request

Finding Remediation

Policy Review

Risk Approval

89. PIA Automation

Project Created
      ↓
Privacy Screening
      ↓
Low Risk
      ├── Standard Approval
      ↓
High Risk
      ↓
DPIA
      ↓
Privacy Review

90. Rights Request Automation

Request
      ↓
Identity Verification
      ↓
System Search Tasks
      ↓
Owner Assignment
      ↓
Response

91. Vendor Automation

New Vendor
      ↓
Data Screening
      ↓
Personal Data?
      ↓
Privacy Assessment
      ↓
Risk Tier
      ↓
Approval

92. Integration

A privacy platform becomes more valuable when connected with enterprise systems.

Conceptually:

CMDB

HR

CRM

Security Platforms

Procurement

Vendor Systems

Data Platforms
      ↓
OneTrust

93. CMDB Integration

Application
      ↓
Owner
      ↓
Business Process
      ↓
Privacy Record

94. HR Integration

Employee changes may affect:

Data Ownership

Assessment Ownership

Workflow Assignment

95. Procurement Integration

Vendor Request
      ↓
Procurement
      ↓
Privacy Screening
      ↓
Security Review
      ↓
Contract

96. Security Integration

Security Incident
      ↓
Personal Data
      ↓
Privacy Incident
      ↓
Assessment

97. Data Discovery Integration

Data discovery can help identify:

Personal Data

Sensitive Data

Locations

Data Owners

and feed privacy governance.

98. Privacy + GRC Integration

Privacy should not operate as an isolated program.

Privacy Risk
      ↓
Enterprise Risk

Privacy Control
      ↓
Enterprise Control

Privacy Finding
      ↓
Issue Management

Privacy Vendor Risk
      ↓
TPRM

99. Example Integrated Risk

Privacy assessment identifies:

Customer Data
Stored Without
Retention Limit

This may connect to:

Privacy Risk

Compliance Risk

Security Risk

Legal Risk

100. Privacy + TPRM

Avoid separate assessments where possible:

Vendor
      ↓
Security Assessment

Vendor
      ↓
Privacy Assessment

Vendor
      ↓
Business Continuity

A mature TPRM model can combine relevant risk domains:

Vendor
      ↓
Integrated Assessment
      ↓
Security

Privacy

Compliance

Resilience

101. Common Mistake — Treating OneTrust as a Privacy Spreadsheet

The value comes from:

Relationships

Workflow

Automation

Accountability

Monitoring

not simply storing records.

102. Common Mistake — ROPA Once Per Year

A processing inventory becomes stale quickly.

Better:

Business Change
      ↓
System Change
      ↓
Vendor Change
      ↓
Privacy Record Update

103. Common Mistake — Every Project Gets the Same Assessment

Use risk-based screening.

Project
      ↓
Screening
      ↓
Assessment Level

104. Common Mistake — Privacy Team Owns Everything

Privacy teams provide governance and expertise.

Business owners should remain accountable for their processing activities.

105. Common Mistake — Consent Everywhere

Consent is not automatically the correct basis or mechanism for every processing activity.

Legal and privacy teams must determine appropriate requirements based on the applicable context.

106. Common Mistake — No Downstream Consent Enforcement

Weak:

Website:
Opt Out

while:

Marketing Platform:
Still Sends Email

Consent and preference decisions must reach downstream systems where required.

107. Common Mistake — Privacy = Security

Security is essential.

But privacy also includes:

Purpose

Transparency

Choice

Rights

Minimization

Retention

Accountability

108. Common Mistake — Security Assessment Replaces Privacy Assessment

A vendor can have:

Excellent Security

while still creating:

High Privacy Risk

through excessive collection, inappropriate processing, poor retention, or other privacy concerns.

109. Common Mistake — No Identity Verification

Responding to a rights request without appropriate identity verification may disclose personal information to the wrong person.

110. Common Mistake — Retaining Everything

Storage Is Cheap

is not a privacy retention strategy.

111. Common Mistake — Dashboard = Compliance

A green dashboard does not automatically prove compliance.

Compliance requires:

Applicable Requirements

Evidence

Control Effectiveness

Legal Interpretation

Assessment

112. Implementation Roadmap

A practical OneTrust implementation might proceed through:

Phase 1
Governance

Phase 2
Data Inventory

Phase 3
Privacy Assessments

Phase 4
Rights Requests

Phase 5
Consent

Phase 6
Third Parties

Phase 7
Compliance

Phase 8
Risk & Findings

Phase 9
Automation

Phase 10
Reporting

113. Phase 1 — Governance

Define:

Privacy Roles

Business Owners

Data Owners

Policies

Taxonomies

Access

Approval Model

114. Phase 2 — Data Inventory

Establish:

Systems

Data

Processing Activities

Owners

Recipients

Locations

Retention

115. Phase 3 — Assessments

Implement:

Privacy Screening

PIA

DPIA

Risk Assessment

Approval

116. Phase 4 — Rights Requests

Implement:

Intake

Identity Verification

Discovery

Fulfillment

SLA

Evidence

117. Phase 5 — Consent

Establish:

Notice

Consent

Preference

Withdrawal

Evidence

Downstream Enforcement

118. Phase 6 — Third Parties

Integrate:

Vendor Inventory

Privacy Screening

Assessments

Contracts

Monitoring

119. Phase 7 — Compliance

Map:

Requirements
      ↓
Controls
      ↓
Evidence

120. Phase 8 — Risk & Findings

Implement:

Risk Register

Findings

Remediation

Exceptions

Retesting

121. Phase 9 — Automation

Automate appropriate:

Assignments

Reminders

Escalations

Evidence Requests

Approvals

122. Phase 10 — Reporting

Build:

Operational

Privacy Management

GRC

Executive

dashboards.

123. End-to-End Scenario — New SaaS Platform

Business requests:

New HR
Analytics SaaS

Screening:

Personal Data?
Yes

Employee Data?
Yes

Sensitive Data?
Potentially

Third Party?
Yes

Workflow:

Request
      ↓
Privacy Screening
      ↓
PIA / DPIA
      ↓
Vendor Assessment
      ↓
Security Review
      ↓
Contract Review
      ↓
Risk Treatment
      ↓
Approval
      ↓
Implementation

124. End-to-End Scenario — Data Subject Request

Customer submits:

Access Request

Workflow:

Request
      ↓
Identity Verification
      ↓
Jurisdiction
      ↓
Systems Identified
      ↓
Data Collected
      ↓
Legal Review
      ↓
Response
      ↓
Evidence
      ↓
Closure

125. End-to-End Scenario — Vendor Privacy Risk

Vendor processes:

Customer
Contact Data

Assessment identifies:

No Defined
Deletion Process

Workflow:

Finding
      ↓
Privacy Risk
      ↓
Vendor Owner
      ↓
Remediation
      ↓
Contract Requirement
      ↓
Evidence
      ↓
Retest

126. End-to-End Scenario — Privacy Incident

Security detects:

Customer Database
Downloaded by
Unauthorized Account

Workflow:

Security Incident
      ↓
Personal Data?
      ↓
Yes
      ↓
Privacy Incident
      ↓
Impact Assessment
      ↓
Legal Review
      ↓
Notification Decision
      ↓
Remediation
      ↓
Lessons Learned

127. End-to-End Scenario — Consent

Customer chooses:

Email Marketing:
No

SMS:
Yes

Workflow:

Preference
      ↓
Central Record
      ↓
CRM
      ↓
Marketing Systems
      ↓
Enforcement
      ↓
Audit Evidence

OneTrust Operational Checklist

Governance

• privacy governance model established.

• privacy roles defined.

• processing owners identified.

• data owners identified.

• policies established.

• escalation model defined.

• access controls established.

Data Inventory

• systems inventoried.

• personal-data categories identified.

• data subjects identified.

• processing purposes documented.

• owners assigned.

• recipients identified.

• retention recorded.

• data locations understood.

ROPA

• processing activities documented.

• owners assigned.

• purposes documented.

• data categories maintained.

• recipients recorded.

• transfers evaluated.

• retention documented.

• periodic review established.

Assessments

• privacy screening implemented.

• PIA workflow established.

• DPIA criteria defined.

• risk methodology approved.

• mitigation tracked.

• approvals documented.

• reassessment triggers established.

Rights Requests

• intake channels established.

• identity verification defined.

• request types configured.

• applicable deadlines tracked.

• system owners assigned.

• response evidence retained.

• escalation configured.

Consent & Preferences

• purposes defined.

• notices governed.

• consent records maintained where applicable.

• withdrawal supported.

• preferences synchronized.

• downstream enforcement validated.

Cookies

• website technologies inventoried.

• categories established.

• purposes documented.

• consent requirements evaluated.

• preferences enforced.

• periodic scanning established.

Third Parties

• vendor inventory maintained.

• privacy screening implemented.

• assessments performed.

• data sharing documented.

• contractual requirements addressed.

• subprocessors evaluated where required.

• monitoring established.

Compliance

• applicable regulations identified.

• requirements mapped.

• privacy controls maintained.

• evidence requirements defined.

• assessments scheduled.

• regulatory changes monitored.

Risk & Findings

• privacy risk register established.

• findings classified.

• remediation owners assigned.

• due dates established.

• exceptions governed.

• retesting required.

• residual risk documented.

Reporting

• privacy KPIs defined.

• KRIs defined.

• operational dashboards established.

• management reporting established.

• executive reporting established.

• trend reporting implemented.

OneTrust Deliverables

After completing this lesson, you should be able to design:

01 Enterprise Privacy Governance Model

02 Personal Data Inventory

03 Data Flow Map

04 Processing Activity Register

05 ROPA Register

06 Privacy Screening Questionnaire

07 PIA Template

08 DPIA Workflow

09 Privacy Risk Register

10 Privacy Control Library

11 Data Subject Rights Workflow

12 Consent Governance Model

13 Preference Management Model

14 Cookie Governance Model

15 Vendor Privacy Assessment

16 Privacy Incident Workflow

17 Privacy Finding Register

18 Privacy Exception Workflow

19 Privacy KPI / KRI Register

20 Executive Privacy Dashboard

Practical Activity — Build a Processing Inventory

Create records for:

Customer Marketing

Employee Recruitment

Payment Processing

Customer Support

Security Monitoring

For each identify:

Owner

Purpose

Data Subjects

Data Categories

Systems

Recipients

Third Parties

Retention

Risk

Practical Activity — Conduct Privacy Screening

Scenario:

Marketing Wants
a New AI-Based
Customer Analytics
Platform

Determine:

Personal Data?

Sensitive Data?

Automated Analysis?

Third Party?

Cross-Border Processing?

Large Scale?

Privacy Assessment?

DPIA?

Do not determine legal applicability from the technology alone; document where privacy or legal review is required.

Practical Activity — Design a Rights Request Workflow

Create:

Request
      ↓
Identity Verification
      ↓
Jurisdiction
      ↓
Request Type
      ↓
Systems
      ↓
Data Collection
      ↓
Review
      ↓
Response
      ↓
Evidence

Define:

Owner

SLA

Escalation

Evidence

Approval

Practical Activity — Vendor Privacy Assessment

Scenario:

Vendor:
Marketing Analytics Provider

Data:
Customer Email
Purchase History
Browsing Behaviour

Assess:

Purpose

Data Minimization

Security

Retention

Location

Subprocessors

Rights Support

Incident Management

Contract

Residual Risk

Practical Activity — Privacy Risk Register

Create five risks involving:

Excessive Collection

Excessive Retention

Unauthorized Access

Vendor Disclosure

Rights Request Failure

For each define:

Risk

Processing Activity

Owner

Individuals Affected

Inherent Risk

Controls

Residual Risk

Treatment

Practical Activity — Build an Executive Dashboard

Include:

Top Privacy Risks

High-Risk Processing

Open DPIAs

Rights Requests Near Deadline

Critical Vendor Risks

Privacy Incidents

Overdue Findings

Retention Gaps

OneTrust GRC Mindset

When working with OneTrust, ask:

What Personal
Data Exists?

Whose Data
Is It?

Where Is
It Stored?

Who Owns
the Processing?

Why Are
We Processing It?

What Is
the Purpose?

What Requirements
Apply?

Is the Data
Necessary?

Is the Processing
Proportionate?

Who Receives
the Data?

Which Vendors
Process It?

Where Is
It Processed?

How Long
Is It Retained?

How Is
It Protected?

Does a
Privacy Assessment
Apply?

Does Enhanced
Review Apply?

What Risk
Exists to
Individuals?

What Risk
Exists to
the Organization?

What Controls
Reduce the Risk?

What Residual
Risk Remains?

Who Accepts
the Risk?

What Rights
May Apply?

How Will
Requests Be
Handled?

What Consent
or Preference
Requirements Apply?

Can Preferences
Reach Downstream
Systems?

What Happens
During a
Privacy Incident?

What Evidence
Demonstrates
Compliance?

What Findings
Remain Open?

Which Vendors
Create Privacy
Risk?

What Metrics
Should Management
Monitor?

Can Workflows
Be Automated?

Can Privacy
Risk Connect
to Enterprise
GRC?

That is the mindset of a GRC professional using OneTrust as a privacy and governance platform rather than simply as a compliance questionnaire system.

Key Takeaways

• OneTrust can support privacy, data governance, consent, third-party risk, compliance, and related GRC activities.

• Privacy programs require visibility into personal data, processing activities, systems, vendors, purposes, and ownership.

• Data inventories and data maps provide foundations for privacy governance.

• Processing activities should have accountable business owners.

• ROPA should be treated as a maintained governance record rather than a once-a-year spreadsheet exercise.

• Privacy assessments help identify risks before new processing begins.

• DPIAs provide deeper evaluation where applicable criteria require enhanced assessment.

• Privacy risk includes potential impacts on individuals as well as organizational consequences.

• Privacy by design should begin during project design rather than after deployment.

• Data minimization challenges unnecessary collection.

• Retention should be based on defined business, legal, regulatory, and contractual requirements.

• Consent requires governance beyond simply presenting a checkbox.

• Preference changes must propagate to downstream systems where required.

• Privacy-rights requests require controlled intake, identity verification, discovery, review, response, and evidence.

• Third-party privacy risk should be integrated with broader vendor-risk management.

• Strong security does not automatically mean low privacy risk.

• Privacy incidents should integrate with security incident-management processes.

• Privacy findings require ownership, remediation, evidence, retesting, and closure.

• Privacy exceptions should be documented, risk-assessed, approved, and periodically reviewed.

• Privacy dashboards should focus on meaningful risks, deadlines, findings, incidents, and trends.

• Workflow automation can reduce manual privacy operations, but underlying governance must first be well designed.

• Privacy should connect to enterprise risk, compliance, security, data governance, and third-party risk rather than operating as an isolated function.

Knowledge Check

Before continuing, make sure you can answer:

1. What is OneTrust?

2. Why do organizations use privacy-management platforms?

3. What is a personal-data inventory?

4. What is data mapping?

5. What is a processing activity?

6. What is ROPA?

7. Why should ROPA be continuously maintained?

8. What is a Privacy Impact Assessment?

9. What is a DPIA?

10. What is privacy screening?

11. How does privacy risk differ from traditional enterprise risk?

12. What is privacy by design?

13. What is data minimization?

14. What is purpose limitation?

15. Why is retention governance important?

16. What information should a consent record contain?

17. Why must consent withdrawal reach downstream systems?

18. What is preference management?

19. What is cookie governance?

20. What is a data subject rights request?

21. Why is identity verification critical?

22. What information should be tracked for a rights request?

23. How does third-party privacy risk arise?

24. What should a vendor privacy assessment evaluate?

25. What is a Data Processing Agreement?

26. Why should vendor risk be continuously monitored?

27. How can privacy controls be mapped to regulations?

28. What constitutes privacy evidence?

29. What is a privacy incident?

30. How should security and privacy incident processes interact?

31. What is a privacy risk register?

32. How should privacy findings be remediated?

33. How should privacy exceptions be governed?

34. What privacy KRIs can management monitor?

35. How can OneTrust integrate with enterprise GRC?

What’s Next?

➡️ Next: 06 — Drata

In the next lesson, you will move from enterprise privacy and data-governance operations into compliance automation and continuous control monitoring.

You will explore how platforms such as Drata can connect:

Cloud Systems
      ↓
Identity Providers
      ↓
Endpoints
      ↓
Source Control
      ↓
HR Systems
      ↓
Security Controls
      ↓
Automated Tests
      ↓
Evidence
      ↓
Compliance Frameworks
      ↓
Continuous Monitoring

The focus will be on understanding how modern compliance automation platforms can reduce manual evidence collection, continuously monitor selected controls, identify compliance gaps, manage evidence, support audits, and provide ongoing visibility into compliance readiness.