Third Party Disclosure Requests

With the passage of Oregon Consumer Privacy Act and the Minnesota Consumer Data and Privacy Act, businesses in those states must provide consumers with a list of third parties with whom they share consumer data starting July 1st, 2024

Definition of a Third Party

A third party is a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller. Vendors with a data processing agreement, such as a third-party SaaS tool, are exempt from third-party disclosure.

EXAMPLES

Public agencies, public authorities, business partners, social media networks, advertising companies (behavioral advertising), and entities during a merger, acquisition, or insolvency.

Managing Third Parties in DataGrail

DataGrail is able to help you manage a list of third parties. This list can be governed on the application's settings page and used in DataGrail's email templates for third-party disclosures.

1. Navigate to Settings

2. Select Third-Party Disclosures

3. Add third parties in the text box. Each line will be a new bullet point.

TIP

Customers can also add a list of systems (if LDM is configured) or a list of Integrations to their list by utilizing the buttons below the text box

4. Once the list of third parties has been added, click Save List. This information will be utilized in a variable as part of the custom email template, triggered when a request is processed.

The Custom Email Template for processing a third-party disclosure request is named "Third Party Disclosure Request Results."

TIP

The third Party Email Template will utilize the variable %third_party_disclosure_list% within the custom email template, which can be found in email templates.

Adding a Third Party to the List

The Third Party Disclosures page can be used to manually add third parties to the list by typing in an entry. Each entry should be added as a new line, and the formatting will automatically add a bullet point to each line. The list will update every time it is saved, and the custom email template sent to the requestor will dynamically pull the variable at the time of processing.

There is also an option to add a list of integrations connected to the platform or systems from Live Data Map (note: if you have not purchased Live Data Map, this option will not appear). This should be used as a starting point but may not constitute a comprehensive list. Third-party lists should be reviewed by legal counsel.

Third-Party Disclosure Requests Ticket Cycle

Configuring Policies with Third-Party Disclosures

DataGrail has added a new privacy right called "Third-Party Disclosures." This privacy right can be added similarly to any other privacy right to any policy. To have a policy with this privacy right added or the privacy right added to an existing policy, contact support@datagrail.io.

Ticket Creation in Request Manager

Once the privacy right is configured as part of a request policy, consumers can request the third-party disclosure via the intake form or any other configured intake method in DataGrail. Requests will be processed like any other request in DataGrail and will follow all the platform configurations.

Third Party Disclosure ticket processing

Third-party disclosures do run access on connected integrations in the Extraction Phase. Requests will move through the configured settings. For example, if verification is required, the request will only move to the Pending Action phase once verification is complete. When the request is processed in the Pending Action phase, confirm the email to be sent (which will be based on what is configured on the Third Party Disclosures page), and proceed.

Custom Email Templates and Third-Party Disclosure Variable

Custom email templates can be managed in Settings. There, you can customize messaging to the requestor and utilize the %third_party_disclosure% Variable to send the list.