This foundation step provided Esme with a clear framework that she could then build upon with other privacy information such as Data Protection Impact Assessments (DPIAs) and Legitimate Interest Assessments (LIAs), and this could in turn be used to inform the content of the Museum’s public facing Privacy Notice.  

A clear and accurate Privacy Notice is of course important in helping to build and maintain consumer trust. “We know that what we tell people in our Privacy Notice about how we process personal data is true and accurate, and the reporting functionality of the OneTrust tools helps us to demonstrate that,” said Esme. 

A privacy program for the ages

For the Natural History Museum team, the most significant benefit of their OneTrust implementation has been the ability to seamlessly coordinate data privacy tasks. It also provides Esme and her team with centralized and long-term visibility of their privacy management obligations, for example with data incidents. A centralized tool means being able to easily keep track of data incidents, track and manage remediation tasks, and record notification decisions and outcomes. 

This efficiency has also been noticeable when it comes to data protection impact assessments (DPIAs) and legitimate interest assessments (LIAs), with employees being able to complete them more easily and with greater understanding than previous ‘paper’ forms. This helps ensure there are sufficient and accurate records, providing greater accountability as to how the Museum is meeting the legal requirements set out in data protection law. 

“OneTrust has quickly become an important part of our information space,” said Richard. 

With individuals being at the heart of any strong privacy program, the Natural History Museum takes pride in the fact that they prioritize transparency and accountability. OneTrust’s Assessment Automation and Data Mapping tools have helped them build a clear understanding of the data they are processing and makes it easier to check that the appropriate risk assessments and legal basis are being used.

“OneTrust has given us confidence that we can evidence how we are accountable to both the law and to the expectations of the individual’s whose information we hold,” said Esme.