Managing privacy rules

Privacy rules define the consent type and decision of a data usage approval request based on a set of conditions.

Before you begin

  • You must have administrative permission to complete this task.
  • Log in to the IBM® Security Verify administration console.

About this task

You can perform the following tasks.

Procedure

  1. Select Data privacy & consent > Data privacy policy > Rules.
    The rules are displayed with their name, description, consent type and decision, policy status, rule lifetime, and last modified. You can use the search function to find a specific rule.
    Note: If you are accessing Rules for the first time, the Create data privacy rules page is displayed. Select Create rule and skip to step 2b.
  2. Create a rule.
    1. Select Create rule.
    2. Specify the following information for the rule.
      • A unique name for the rule.
      • Optionally, a description.
      • Optionally, tags to facilitate searching.
    3. Select Next.
    4. Specify the conditions that this rule applies.
      Purpose
      The purpose that triggers this rule.
      User attribute
      The user attribute that triggers this rule.
      Access type
      The access type that triggers this rule.
      Geography
      The geographical location of the data subject presentation request or data usage approval request that triggers this rule.
      Purpose tag
      The tag of the purposes that triggers this rule.
      External user
      Specifies whether this rule is triggered for users that are listed in the Cloud Directory or for external users.
      User group
      The group that the requester belongs to that triggers this rule.
    5. Optional: You can add more condition sets.
      All the conditions in a condition set, must be met to trigger the rule. Any one of the condition sets can trigger the rule. If no conditions are set, the rule is always triggered.
    6. Select Next.
    7. Specify the consent type and decision.
      Consent type
      The type of consent to present to the user.
      • A normal user consent.
      • An opt-in or opt-out consent.
      • A transparency to show the purpose to the user, but not to require the user to explicitly consent to it.
      • A do not show a consent prompt to the user.
      Disclose the purpose to the user when requesting consent.
      Specifies whether the purpose of this consent needs to be disclosed to the user.
      Opt-in consent is selected by default when presented to the user.
      Specifies whether the UI element for this consent such as a checkbox or dropdown menu, is set to an opt-in consent by default.
      Decision
      This decision is the decision that this rule returns.
      • Explicit consent requires that the user explicitly gives consent.
      • Implicit consent assumes that the user consents if they did not explicitly deny the consent.
      • Allow and Deny are explicit decisions that are made by this rule regardless of the user's consent.
    8. Select Next.
    9. Optional: Specify the activation and expiration time of the rule.
      If not set, the activation time is set to the current time and the expiration time is left blank and implies that the rule never expires.
    10. Select Create rule.
  3. Edit a privacy rule.
    1. Select a privacy rule.
    2. Make your changes and when you are finished, select Save changes.
  4. Activate an inactive privacy rule.
    If a rule's lifetime expired and the rule became inactive, you can activate it.
    1. Select the rule.
    2. Scroll to Rule lifetime.
    3. Reset the expiration date to a later time. You can also clear the expiration date so that the rule is always active.
    4. Select Save changes.
  5. Duplicate a privacy rule.
    1. Select a privacy rule.
    2. Select Duplicate rule to make a copy of the rule.
  6. Delete a privacy rule.
    1. Select a privacy rule.
    2. Select Delete rule to delete the rule.
    3. Alternatively, to delete multiple rules, select the checkboxes and select Delete.
  7. Add a privacy rule to the policy.
    1. Select a privacy rule.
    2. Select Add to policy to add the rule to the policy.
    3. Alternatively, to add multiple rules that are not in the policy, select the checkboxes, and select Add to policy.
    4. Select the sequence in which the rules are checked.
    5. Select Save changes.
  8. Remove a privacy rule from the policy.
    1. Select a privacy rule.
    2. Select Remove from policy to remove the rule from the policy.
    3. Alternatively, to remove multiple rules from the policy, select the checkboxes, and select Remove from policy.