Risks - Revision history

Cbisso: /* Privileges */

2018-10-10T10:28:10Z

‎Privileges

Sottini at 21:17, 14 September 2018

2018-09-14T21:17:53Z

Sottini at 21:12, 14 September 2018

2018-09-14T21:12:18Z

Sottini at 21:06, 14 September 2018

2018-09-14T21:06:23Z

Sottini at 21:05, 14 September 2018

2018-09-14T21:05:31Z

Sottini: /* Workflow */

2018-09-14T21:04:51Z

‎Workflow

Sottini at 21:01, 14 September 2018

2018-09-14T21:01:55Z

Sottini: Created page with " == Introduction to Risks == ''Risks'' provide the mean for data subjects to exercise their right to access information about the processing of their ''personal data'' (e.g...."

2018-09-14T21:00:15Z

Created page with " == Introduction to Risks == ''Risks'' provide the mean for data subjects to exercise their right to access information about the processing of their ''personal data'' (e.g...."

New page

== Introduction to Risks ==
''Risks'' provide the mean for data subjects to exercise their right to access information about the processing of their
''personal data'' (e.g. according to section 2, article 13 of ''GDPR Regulation'').

The process enables to record ''access requests'' and to support their fulfilment.

== Workflow ==
A new ''access request'' can be created using the '''Add New''' functionality and choosing "New Access Request".

A workflow enables to move ''access requests" in several statuses as shown in the following picture.

[[File:Access_Requests_Workflow_ENG_v1.0.JPG|centre|thumb|800x800px|Access Requests workflow and statuses.]]

The following table explains the meaning of each status:

{| class="wikitable"
! Status !! Description
|-
|Default || A temporary status when the ''access request'' is initially created before the first save.
|-
|Opened || An ''access request'' in this status is draft and it is not actioned.
|-
|Requested || An ''access request'' in this status is confirmed and it is waiting to be actioned.
|-
|In charge || In this status, the ''access request'' has been taken in charge and it is being actioned.
|-
|Cancelled || ''Access request'' cancelled. This is an end of life status.
|-
|Completed || In this status, all activities related to the ''access request'' were completed and closure is expected after confirmation.
|-
|Suspended || Activities concerning the ''access request'' are temporarily suspended, meaning no further status transitions are allowed.
|-
|Closed || In this status, all activities related to the ''access request'' are completed and confirmed. This is an end of life status, meaning no further status transitions are allowed.
|-
|}

== Information ==
''Access request'' records are organized in five sections:

* ''Identification'', where identification data of the ''access request'' are recorded,
* ''Ownership & Organization'', containing the assignment of the key roles enabled to manage the ''access request'';
* ''Access Request Details'', with the details of the ''access request'';
* ''Data Subject Details'', with the details of the ''data subject'' issuing the ''access request'';
* ''Data Subject Representative'', containing the details of the representative of the ''data subject'', if any.

Detailed information on the meaning and use of every field can be found by pointing the mouse on the (i) next to each field. This will activate a tooltip with a brief description of the field.

Additional information can be found in the secondary forms of the record: attachments, related items, messages and history. See [[How To]] for more information.

== Privileges ==
''Access request'' can be created by the ''users'' to whom the corresponding privilege is granted (see [[Users & Groups]] for more information on how to set this privilege).

The lifecycle of the ''access request'' is managed by the roles described in the table below. ''Groups'' are pre assigned to the roles according to the ''settings'' (see [[Settings]] for more information on how to set these defaults). Initial assignments can be modified according to privileges choosing among the enabled ''groups'' (see once again [[Settings]] for more information on how to enable ''groups'').

{| class="wikitable"
! Role !! Description
|-
|DPO Group || Members of the ''group'' assigned to this role have full privileges. They can:
* transition records to any compatible status,
* update fields when possible,
* update ''data sources'' directly in record management.
|-
|Data Controller Group || Members of the ''group'' assigned to this role have view (read) privileges.
|-
|Data Processor Group || Members of the ''group'' assigned to this role have view (read) privileges.
|-
|Working Team || Members of this ''group'' have several privileges. They can manage the entire lifecycle, being enabled to:
* transition records to any compatible status,
* update fields when possible.
|-
|Audit Team || Members of the ''group'' assigned to this role have view (read) privileges.
|-
|Owner || This role can be assigned to a single user among members of the ''groups'' previously described. The Owner has several privileges:
* transition to any compatible status,
* update fields when possible.
|}

== Warning and alerts ==
TBC

== Reports ==
The list of ''access requests'' can be filtered and exported to excel format from the ''view'' '''''Access Requests'''''.

== Related processes ==
''Access Requests'' can be related to ''processing activities''.

@@ Line 63: / Line 63: @@
 * update fields when possible.
 |-
-|<u>Audit Team</u> || Members of the ''group'' assigned to this role have view (read) privileges.
+|<u>Auditors Team</u> || Members of the ''group'' assigned to this role have view (read) privileges.
 |-
 |<u>Owner</u> || This role can be assigned to a single user among members of the ''groups'' previously described. The <u>Owner</u> has several privileges:

@@ Line 33: / Line 33: @@
 ''Risks'' records are organized in four sections:
-* <u>''Identification''</u>, where identification data of the ''access request'' are recorded,
+* <u>''Identification''</u>, where identification data of the ''risk'' are recorded,
-* <u>''Ownership & Organization''</u>, containing the assignment of the key roles enabled to manage the ''access request'';
+* <u>''Ownership & Organization''</u>, containing the assignment of the key roles enabled to manage the ''risk'';
-* <u>''Pre-mitigation Assessment''</u>, with the details of the ''access request'';
+* <u>''Pre-mitigation Assessment''</u>, with the assessment details of the ''risk'' before mitigation actions;
-* <u>''Post-mitigation Assessment''</u>, with the details of the ''data subject'' issuing the ''access request''.
+* <u>''Post-mitigation Assessment''</u>, with the details of the ''risk'' after mitigation actions.
 Detailed information on the meaning and use of every field can be found by pointing the mouse on the (i) next to each field. This will activate a tooltip with a brief description of the field.
@@ Line 43: / Line 43: @@
 == Privileges ==
-''Access request'' can be created by the ''users'' to whom the corresponding privilege is granted (see [[Users & Groups]] for more information on how to set this privilege).
+''Risks'' can be created by the ''users'' to whom the corresponding privilege is granted (see [[Users & Groups]] for more information on how to set this privilege).
-The lifecycle of the ''access request'' is managed by the roles described in the table below. ''Groups'' are pre assigned to the roles according to the ''settings'' (see [[Settings]] for more information on how to set these defaults). Initial assignments can be modified according to privileges choosing among the enabled ''groups'' (see once again [[Settings]] for more information on how to enable ''groups'').
+The lifecycle of the ''risk'' is managed by the roles described in the table below. ''Groups'' are pre assigned to the roles according to the ''settings'' (see [[Settings]] for more information on how to set these defaults). Initial assignments can be modified according to privileges choosing among the enabled ''groups'' (see once again [[Settings]] for more information on how to enable ''groups'').
 {| class="wikitable"
@@ Line 59: / Line 59: @@
 |<u>Data Processor Group</u> || Members of the ''group'' assigned to this role have view (read) privileges.
 |-
-|<u>Working Team</u> || Members of this ''group'' have several privileges. They can manage the entire lifecycle, being enabled to:
+|<u>Risk Assessment Team</u> || Members of this ''group'' have several privileges. They can manage the entire lifecycle, being enabled to:
 * transition records to any compatible status,
 * update fields when possible.
@@ Line 69: / Line 69: @@
 * update fields when possible.
 |}
 == Reports ==
-The list of ''access requests'' can be filtered and exported to excel format from the ''view'' '''''Access Requests'''''.
+The list of ''risks'' can be filtered and exported to excel format from the ''view'' '''''Risks'''''.
 == Related processes ==
-''Access Requests'' can be related to ''processing activities''.
+''Risks'' can be related to ''actions'', ''audits'', ''data breaches'', ''issues / non conformities'', ''privacy impact assessments'' and ''processing activities''.

@@ Line 8: / Line 8: @@
 The workflow enables to move ''risks" in several statuses as shown in the following picture.
-[[File:Risks_Workflow_ENG_v1.0.JPG|centre|thumb|800x800px|Access Requests workflow and statuses.]]
+[[File:Risks_Workflow_ENG_v1.0.JPG|centre|thumb|800x800px|Risks workflow and statuses.]]
@@ Line 16: / Line 16: @@
 ! Status !! Description
 |-
-|Default || A temporary status when the ''access request'' is initially created before the first save.
+|Default || A temporary status when the ''risk'' is initially created before the first save.
 |-
-|Opened || An ''access request'' in this status is draft and it is not actioned.
+|Draft || A ''risk'' in this status is draft and is not confirmed nor actioned yet.
 |-
-|Requested || An ''access request'' in this status is confirmed and it is waiting to be actioned.
+|Potential || A ''risk'' in this status is confirmed and shall be actioned.
 |-
-|In charge || In this status, the ''access request'' has been taken in charge and it is being actioned.
+|Mitigated || In this status, the ''risk'' has been actioned and mitigated.
 |-
-|Cancelled || ''Access request'' cancelled. This is an end of life status.
+|Cancelled || ''Risk'' cancelled. This is an end of life status.
 |-
-|Completed || In this status, all activities related to the ''access request'' were completed and closure is expected after confirmation.
+|Closed || In this status, risk has been threated successfully and no more actions are needed. This is an end of life status, meaning no further status transitions are allowed.
 |-
 |}
 == Information ==
-''Access request'' records are organized in five sections:
+''Risks'' records are organized in four sections:
 * <u>''Identification''</u>, where identification data of the ''access request'' are recorded,
 * <u>''Ownership & Organization''</u>, containing the assignment of the key roles enabled to manage the ''access request'';
-* <u>''Access Request Details''</u>, with the details of the ''access request'';
+* <u>''Pre-mitigation Assessment''</u>, with the details of the ''access request'';
-* <u>''Data Subject Details''</u>, with the details of the ''data subject'' issuing the ''access request'';
+* <u>''Post-mitigation Assessment''</u>, with the details of the ''data subject'' issuing the ''access request''.
 Detailed information on the meaning and use of every field can be found by pointing the mouse on the (i) next to each field. This will activate a tooltip with a brief description of the field.

← Older revision		Revision as of 21:06, 14 September 2018
Line 8:		Line 8:
	The workflow enables to move ''risks" in several statuses as shown in the following picture.		The workflow enables to move ''risks" in several statuses as shown in the following picture.

−	[[File:~~Risks_workflow_ENG_v1~~.0.JPG\|centre\|thumb\|800x800px\|Access Requests workflow and statuses.]]	+	[[File:Risks_Workflow_ENG_v1.0.JPG\|centre\|thumb\|800x800px\|Access Requests workflow and statuses.]]

← Older revision		Revision as of 21:05, 14 September 2018
Line 8:		Line 8:
	The workflow enables to move ''risks" in several statuses as shown in the following picture.		The workflow enables to move ''risks" in several statuses as shown in the following picture.

−	[[File:~~Risks_Workflow_ENG_v1~~.0.JPG\|centre\|thumb\|800x800px\|Access Requests workflow and statuses.]]	+	[[File:Risks_workflow_ENG_v1.0.JPG\|centre\|thumb\|800x800px\|Access Requests workflow and statuses.]]

@@ Line 4: / Line 4: @@
 == Workflow ==
-A new ''access request'' can be created using the '''Add New''' functionality and choosing "New Access Request".
+A new ''risk'' can be created using the '''Add New''' functionality and choosing "New Risk".
-A workflow enables to move ''access requests" in several statuses as shown in the following picture.
+The workflow enables to move ''risks" in several statuses as shown in the following picture.
-[[File:Access_Requests_Workflow_ENG_v1.0.JPG|centre|thumb|800x800px|Access Requests workflow and statuses.]]
+[[File:Risks_Workflow_ENG_v1.0.JPG|centre|thumb|800x800px|Access Requests workflow and statuses.]]

@@ Line 1: / Line 1: @@
 == Introduction to Risks ==
-''Risks'' provide the mean for data subjects to exercise their right to access information about the processing of their
+This workflow provides the mean to manage the lifecycle of ''risks'' related to ''personal data'' management.
 == Workflow ==