Make-A-Wish Foundation International

Sharing the power of privacy: Make-A-Wish International streamlines assessments with OneTrust


Make-A-Wish is the largest wish-granting organization in the world, granting life-changing wishes of seriously ill children. Make-A-Wish Foundation International is a global charity founded in Phoenix, Arizona, serving children in more than 50 countries around the world. With the help of donors and more than 40,000 volunteers around the world, Make-A-Wish has granted more than 500,000 wishes worldwide.

At the heart of Make-A-Wish’s operations are the children and families they grant wishes to. This is why they run a lean team, dedicating as many of their resources and funding to wish granting. Given the nature of their work, there is a significant emphasis on protecting the data of their beneficiaries, including some sensitive data, as well as consideration for the personal data of the donors that is processed.

Maximizing impact with a lean team

To ensure maximum funds go towards their affiliates and beneficiaries, Make-A-Wish International runs a lean team, with under 20 people running the International office. Even prior to the GDPR coming into effect and the opening of their European operational office, Make-A-Wish International set a goal of achieving a GDPR standard privacy program. With such a small and global team, it’s difficult to get time together to talk about privacy, which is why they needed a central point to track, measure, report and action privacy processes. 

"With beneficiaries and donors from all around the world, OneTrust’s tools continue to help us work towards a gold standard of privacy."


Avril Lee, Data Protection Officer

Mapping the various data transfers across the world is a vital component of the Make-A-Wish privacy program, as well as broader risk, vendor and impact assessments both to monitor donations and the wish granting operations. This helps Make-A-Wish International understand how data is being used, what precautions are being taken to ensure it is appropriately protected, and highlight any risk areas that require additional attention.

Make-A-Wish International has two main focus areas which are their beneficiaries and their donors, so the assessments they need to carry out on a regular basis do not follow the typical industry layouts. One of their key needs from a solution was the ability to customize their assessment templates and streamline the completion process.

Customization was the key to success

In choosing a tool, it was important for Make-A-Wish International to find a more streamlined system compared to their previous excel spreadsheets, which were not user-friendly or efficient for record keeping. OneTrust’s Assessment Automation and Data Mapping modules were selected to modernize their record keeping and systematize their assessment process. 

Avril Lee, the organisation’s Data Protection Officer, is the sole team member managing the Make-A-Wish OneTrust data mapping implementation. She was responsible for carrying out the initial data mapping exercise and template customization, which took approximately five months.

"Handling our assessment through the OneTrust tool is very clear, people know what is needed of them and where to input the relevant information."


Avril Lee, Data Protection Officer

To build the necessary assessments, Avril leveraged OneTrust’s bank of customizable templates and was able to amend them to fit the needs specific to a charitable organization. The user-friendly interface meant that custom assessments could be quickly put together and shared with both internal users and third parties.

Having a central point to manage privacy operations has helped Avril stay on top of the Make-A-Wish privacy management and deliver the high standard of data protection they promise to their beneficiaries, donors, and affiliates.

“With beneficiaries and donors from all around the world, OneTrust’s tools continue to help us work towards a gold standard of privacy,” said Avril.

Saving valuable time and building confidence with automation

OneTrust increased the efficiency of the Make-A-Wish privacy program. The custom templates ensure assessments are fulfilling their needs and the automation capabilities save valuable time given the small team they operate with.

“Handling our assessments through the OneTrust tool is very clear, people know what is needed of them and where to input the relevant information,” said Avril. “One of the biggest successes of our OneTrust implementation is the confidence and assurance that it gives us.”

Avril has found that by streamlining their existing processes their program is better positioned to grow and develop, with awareness training and increased reporting next on the agenda. She also aims to leverage OneTrust’s reporting capabilities to produce an activity report for their next board meeting to showcase the work she has been doing.

"One of the biggest successes of our OneTrust implementation is the confidence and assurance that it gives us."


Avril Lee, Data Protection Officer

The success of Avril’s OneTrust implementation for privacy has helped inspire and encourage other departments to look at leveraging OneTrust in the future, leading to their investing in OneTrust’s risk management module and awareness training module.

You may also like


Responsible AI

Unpacking the EU AI Act

Prepare your business for EU AI Act and other AI regulations with this expert webinar. We explore the Act's key points and requirements, building an AI compliance program, and staying ahead of the rapidly changing AI regulatory landscape.

July 12, 2023

Learn more


Consent & Preferences

Live demo: How to automate consent and preference management with OneTrust

In this webinar, we demonstrate how OneTrust Consent and Preferences helps build stronger customer relationships by providing transparency, giving users control over their data use, and delivering personalized experiences.

June 29, 2023

Learn more


Privacy Management

Unpacking the EU-US DPF

In this webinar, we cover the new EU-US Data Privacy Framework (EU-US DPF) and what privacy program managers need to know for post-Schrems II data transfers.

June 28, 2023

Learn more