Invited Users FAQ

Invited users are created when their email addresses are added as respondents on an assessment.

When an invited user is created with an email address that is already associated with user identity information in another OneTrust account in the same environment, the platform may use the existing first- and last-name values for that user. Account data remains separate, but identity information associated with the email address may be available across the associated accounts. If first- and last-name values are not available for the email address, the platform uses the available username or email address according to the account’s user-creation behavior.

Before deleting an inactive invited user, coordinate with the administrators of every associated OneTrust account. Confirm which user record is being removed, whether the user is still needed in another account, and whether the selected deletion option preserves or anonymizes the user’s name for audit purposes.

Invited users have minimal access to the platform. They can only access assessments for which they have been assigned as respondents. Invited users can also be assigned subtasks, tasks, and risks.

Invited users receive a unique dynamic link via email when they are assigned an assessment. They use this link to access the assessment without having to log in to OneTrust.

Invited users will be redirected to the OneTrust Platform and required to complete a CAPTCHA security measure. If the Turn on OTP verification for invited users setting is enabled for the account, they will then be prompted to enter a One-Time Password (OTP). The OTP will be sent to the email address specified in the Respondent(s) field for that assessment. For more information, see One-Time Password for Invited Users.

The unique link expires after 365 days. If the assessment moves to the Under Review stage, it is no longer accessible through the unique link.

The assessment link should not be forwarded. To include additional respondents, the creator of the assessment should explicitly add any additional individuals as a respondent on the assessment by editing the Respondent(s) field for that assessment within the platform. If the User Respondent Delegation setting is enabled for the related assessment template, then existing respondents can also explicitly add any additional individuals as a respondent on the assessment by editing the Respondent(s) field for that assessment within the platform.

Yes, you can share assessments with invited users, but the assessment will be available as read-only.

No, invited users cannot log in via SSO or using a OneTrust username and password. They do not have OneTrust accounts.

No, verifying an invited user's email domain in your SSO settings does not affect invited users. They can still access the assessments assigned to them using the unique links they received via email and will not be prompted to log in via SSO.

No. A username and password is required to access reports. Because an invited user does not have a username or password to log in, they cannot receive reports.

Complete the following steps to reconfigure an existing user to solely have the Invited User role:

1. Within Global Settings, navigate to the Users screen, and delete the existing user to remove any existing roles assigned to them. Then navigate to the User settings screen and ensure that the Allow Creating Invited Users setting is enabled.

   
   
   

2. Within PIA & DPIA Automation, navigate to the necessary assessment, click the Context Menu button, and select Edit Details. In the Respondent(s) section, enter the user's email address, and click the Save button.

3. On the Unrecognized Respondents modal that appears, select the Send the link (no sign-in required) option, and click the Confirm button. This will create the user as an invited user in the platform.

   
   
   

The metadata visible to invited users depends on their permissions.

With a standard invited user role, the user will have basic access. If you want to give the invited user expanded access to your assessments metadata, you can create a custom copy of the Invited User role and add the Advanced Assessment Metadata permission to the role.

For more information, see Creating and Editing Custom Roles.

Metadata Visibility for Invited Users

Metadata	Basic access	Advanced access
Assessment Metadata Pane
Basic Information
Name
Organization
Template
Workflows
Description
Deadline
Reminder
Send Email to
Primary record
Tags
Workflow approvers
Approver(s)
Comments
Participants
Respondent(s) Only respondent is editable via invited user based on setting (Respondent delegation)
Comments
Additional information
ID
Stage
Stage details (workflow status bar)
Result
Result Comments
Date Created
Creator
Template Version
Question Labels
Residual Risk Score
Open Risk Count
Open Info Request Count
Inherent Risk Score
Target Risk Score
Assessments list screen
ID	Invited users do not have access to the Assessments list screen.
Name
Stage
Result
Residual risk score
Organization
Respondent
Approver
Deadline
Open info request count
Open risk count
Tags
Open issue count
Workflows
Template
Creator
Date created
Date completed
Date submitted
Primary record name
Primary record id
Pending reviews
Template version
Approval stage
Inherent risk score
Target risk score

Yes. Admins can enable the Access control override for invited user inventory drop-down visibility setting to prevent invited users from accessing inventory drop-down data in assessments.

When the setting is disabled, which is the default behavior, invited users can continue to view and select inventory records from drop-down fields in assessments.

When the setting is enabled, invited users can still answer assessment questions, but inventory drop-down questions that require selecting inventory records from a list are not available to them. This applies to Processing activities, Assets, Vendors, and Entities.