A Data Discovery Manager should create data stores for all data sources that need to be searched for personal data when a subject rights request is received.
Automated data stores connect the Osano Platform to over 100 third-party vendor data sources to enable automated data discovery. When the identity of a subject rights requestor is confirmed by a Data Discovery Manager, searches of these data sources are kicked off automatically and an action item is automatically assigned to a Datastore Owner to validate the completeness and accuracy of each search. Read more about automated data store creation.
Manual data stores serve as a mapping of a non-connected data source to enable manual data discovery. When the identity of a subject rights requestor is confirmed by a Data Discovery Manager, an action item is automatically assigned to a Datastore Owner to perform a manual search for personal data outside the Osano Platform and attach the results of that search to the action item once it has been completed. Read more about manual data store creation.
Automated Data Store Creation
On the Data Stores page click the green Add Data Store button at the bottom right of the page to create a new automated data store.
When creating an automated data store you will first be prompted to choose the third-party vendor you wish to connect to.
Once a third-party vendor has been selected you will be required to enter a Data Store Name, a Data Store Owner, and any other information required by the third-party vendor to make the connection.
Connection requirements differ depending on the vendor in question but often require a vendor-generated unique API key.
Visit Data Discovery - Connection Instructions to view vendor-specific information for setting up these connections.
As the data store is being created, all field mappings from the connected data source will populate automatically and A.I. will attempt to determine whether the data in each field contains personal data and, if so, what kind.
This automatic classification can be manually overridden at any time on the Fields tab of the Data Store by clicking the green Update Selected Field pencil icon located at the far right of each field listed in the Data Store.
Once a classification has been selected, you may also update the recommended action applied to this field for each subject rights request type (Correction, Deletion, Do Not Sell or Share to a 3rd Party, etc.).
The recommended action selected for each request type is responsible for determining the kind of action items generated for Datastore Owners assigned to this data store. As an example, when a Deletion request is received the action items generated for fields on a data store will depend on the recommended actions for Deletion requests for all classified fields at that data store; if a field has the recommended action of Delete for deletion requests then a Delete action item will be generated for Datastore Owners assigned to that data store to take action on. Unclassified fields will not generate action items so a data store filled entirely with unclassified fields will never generate action items for Datastore Owners to follow up on.
Once all fields have been appropriately classified your automated data store is ready to generate action items for assignees of the data store as requests come in.
Manual Data Store Creation
On the Data Stores page click the Add Data Store button at the bottom right of the screen to create a new manual data store.
When creating a manual data store you will be required to enter a Data Store Name, Description, and Data Store Owner.
Since this data store is serving as a data map for a non-connected data source you will need to manually add and classify each field on this data store so that action items based on these fields and classifications are created when a request is received that requires action at this non-connected data source.
On the Fields tab of a data store click the green Add New Field button at the bottom right of the screen to create a new field.
When creating a new field you will be required to enter a Field Name and Classification for the type of personal data stored in that field. Once a classification has been selected, you may also update the recommended action applied to this field for each subject rights request type (Correction, Deletion, Do Not Sell or Share to a 3rd Party, etc.).
Note: In order for a data store to be automatically assigned to new, incoming requests, there must be 1+ classified fields associated with the store. If no fields exist or if they are "unclassified", the data store will not be applied to new requests.
Just as with Automated Data Stores, the recommended action selected for each request type is responsible for determining the kind of action items generated for Datastore Owners assigned to this data store.
Once all fields have been added your manual data store is ready to generate action items.
Data Store Assignees
By default, the Data Store Owner of a data store is automatically an assignee of that data store and will receive action items generated for that data store. However, additional assignees can be added or removed who will also receive these generated action items.
On the Details tab of a data store click within the Assignees field and enter a new username to add assignees to a data store. Remove assignees by clicking the x next to their usernames after they have been added as an assignee.
Once your data stores have been created you can proceed to Forms setup.