Looker Integration

Transcend’s Looker integration provides a low-code or no-code option to setting up data access requests for internal data and configuring data subject identity enrichment to supplement DSRs with additional identifiers stored in internal databases and warehouses.

Transcend’s Looker integration can be set up to fulfill access requests for your organization’s internal data. If your organization uses Looker as a data warehouse or data visualization tool, you can connect Transcend directly to Looker to action access/right to know requests for all internal data through one integration. This is a great option if you don't want to connect an internal database directly to Transcend, have limited engineering resources, or if your organization stores data in many systems that can be aggregated into a single Looker instance.

The integration works by looking for a specifically named folder in Looker and running the "Looks" in the folder. In this way, you can set up the queries needed to fulfill an access request specific to your organization's data directly in Looker and the integration will execute those queries when a DSAR is received.

Create a folder named Transcend DSR Automation. The naming for this folder is important, as the integration will look for this specific folder name.

Create a "Look" inside this folder for each query you would like executed for an access request. Note: You can create as many "Looks" as needed to fulfill a complete access request for a data subject. The integration will run every look in this folder.

Add a filter to each query generated with the template variable {{endUserEmail}}. The integration will replace the template variable with the identifier from the request. This ensures that the integration will only return data filtered to the correct user. Any "looks" that do not have this parameter will not be run by the integration. As an example, let's say the data to query contains a field called consumer_email. A filter for the query may look like: model.consumer_email": "{{endUserEmail}}.

After the "look" is configured to return all the data needed for an access request, use the steps listed below to connect the Looker integration in Transcend. From there, you can manage the datapoints for access requests and ensure the data silo is configured to allow requests from the desired data subjects.

The Looker integration can be used to set up Identity Enrichment for DSRs. This feature allows teams to leverage their data warehouse via Looker to perform identity enrichment without any coding or engineering support. The other options to perform identity enrichment include setting up a webhook or a manual process to retrieve additional user identifiers needed to fulfill a DSR. Check out the full guide on Identity Enrichment for more information.

Using Looker for identity enrichment is a great option for teams when engineering bandwidth is limited, as it can be set up without engineering support while still automating the enrichment process.

Setting up a webhook using the Webhook Integration to perform identity enrichment is still the preferred method of integration because It's better to enrich from a live production database. A data warehouse is a replica of the production database, as such it’s possible to see a delay in data arrival during the time when data is copied over from the production database. However, for engineering strapped legal teams Looker enrichment will be a great option, and can even be implemented as a first step and a webhook can be added later.

Similar to how The Looker integration can be set up for data access requests, setting up Looker for enrichment starts with creating a folder named Transcend DSR Automation.

Create a “Look” in the specific Transcend folder. This “Look” should contain a filter variable for the identifier that needs to be enriched on, for example {{email}}, or {{phone}}. Next, you'll define the query for the look. Be sure to include any pieces of data you want to use as an identifier in Transcend.

When the integration runs the “Look”, the filter parameter will be replaced with the user identifiers, the query gets called, and the resulting columns are mapped back into Transcend as additional identifiers.

Once the enrichment "look" is set up in Looker, you'll need to connect the Looker integration to Transcend using the steps listed in the next section. Then you'll configure the Looker Enricher in Transcend to map the output of the "look" to the desired identifiers in Transcend.

To complete setup of the Looker Enricher in Transcend, navigate to the Identifiers page in the Admin Dashboard, and scroll down to "Preflight & Identity Enrichment". Select the "+" button to create a new preflight check.

When adding the new preflight checks, select the "Looker Enricher" type. You'll be prompted to select the Looker integration - please ensure that the Looker integration is connected before this stage to proceed with the identifier mapping. From here you can configure the input and output identifiers for enrichment and map the correct "look" and fields to the identifiers selected.

Once Looker is set up with the specific folder and looks defined for access DSRs or DSR identity enrichment, you can connect the integration in Transcend and start actioning requests.

  1. [Best practice] Create a dedicated user for the integration.

    • From your Looker dashboard, navigate to Admin > Users
    • Create a new user. The new user should have access to only the Transcend DSR Automation folder. This security practice ensures that Transcend can only access looks and queries necessary to fulfill data subject requests. For tips on how to manage access to content in Looker, please see this article.

  2. Obtain Client ID and Client Secret integration credentials.

    • Select the dedicated Transcend user.
    • Navigate down to API3 Keys and select the button to Edit.
    • Create a new set of keys and copy them into the integration connection form.

  3. Obtain the domain and port integration credentials.

    • You only need to enter this information if your Looker instance is self-hosted.
      • Use your Looker URL to determine the domain and port (not all domains will include a port). For example, if you host a looker instance at lookerInstance.companyName.com:9090, your domain is companyName.com:9090.
    • If your instance of Looker is not self-hosted, please leave the default value.

  4. Find the subdomain for your instance.

    • The subdomain can be found using your Looker instance URL when logged in. For example, if your company is not self-hosting, and the URL for your company's Looker is https://myCompany.looker.com the subdomain is myCompany.
    • If your company is self-hosting and the URL is lookerInstance.companyName.com:9090, the subdomain is lookerInstance.

  5. Connect the integration. We recommend submitting a few test DSRs to ensure the queries are configured properly and returning the information you expect.