Getting started with third parties

What are third parties?

In TerraTrue, a third party is anyone outside of your team with whom you exchange data. This can be a separate team within your organization or an external unit. 

What can I do with third parties?

TerraTrue allows you to send third parties customizable questionnaires called assessments to understand how each third party’s data practices will impact your organization. 

These assessments and corresponding responses are cataloged and can be tracked and discussed internally from Workflows > Third Party Assessments.

You can also track, report, and search third parties with a single easy-to-use dashboard. 

New third parties can be created in your taxonomies. Once a third party is created, you can assign it a risk level, status, visibility rule, and category type.

• Risk level (low, medium, high) is directly assigned by your privacy manager. This is a manual process based on the privacy manager’s assessment of the risk level of that third party based on the responses in their assessment. When creating a new third party, the risk level defaults to “low.”
• Status (active, prospective, archived, rejected) provides clarity on the current and historical level of engagement between you and the third party. Status is not required to be added at the time a third party is created, but third parties without a status will not appear in the third party dashboard. 
• Visibility indicates whether or not the third party is available for assignment or selection in the Data Spec.
• Categories are manually created by the privacy manager to provide more context and organization to third parties within the Data Spec and the dashboard.  At least one category must be assigned at the time a third party is created.
• Contract allows you to add links or attachments you have for data controller(s)
• Contact document any contact information you have for any representatives of the data controller(s)

How do I create third parties and manage their categories and attributes?

Third parties, categories, and attributes are added from Settings > Customization > Third Parties by clicking the Create New button within each tab.

All categories and attributes are maintained here within the org settings. 
Categories allow you to control which third parties are visible in the Data Spec.
The attributes and their values created are automatically available within the dashboard to track elements of third parties (for example, location, business model, etc…).
You can create the attribute names you want, add your own values, and assign them to any third party.

How do I assign categories and attributes to third parties?

Categories are assigned to third parties from Settings > Customization > Third Parties.

1. Click the three dots to the left of the third party
2. Click Edit
   
   
   

You can also assign categories in bulk.

1. Tick the checkbox to the left of every third party you wish to assign to that category
2. Click Bulk Edit
   
   

Attributes are assigned to third parties from Workflows > Third Party Management.

1. Click on a third party. 
2. From the Attributes column, select which attribute values you’d like to assign to that third party. 
3. Click Save
   
   
   

Third Party Contacts and Contracts

When leveraging TerraTrue’s processor review, you may want to provide additional third party details that will be referenced in the processor privacy worksheet and in your processing records. In your third party settings, we give you the ability to add relevant contracts and contacts to your third parties.

1. Navigate to Settings > Customization > Third Parties
2. Click the three-dot menu icon to the left of the third party
3. Click on Edit
4. Navigate to the “Contracts” and “Contacts” tab

Contracts can either be linked or uploaded in TerraTrue. Note, contracts must have unique titles per Third party.

Contacts allow you to provide the Name, Email, Phone, Notes, and Primary designation for third parties with multiple contacts. Note, contacts must have unique names, emails and phone numbers for a Third Party (i.e. no two contacts can have the same name, or email or phone number).