Privacy Impact Assessments

Introduction to Privacy Impact Assessments

In Privacy-Now®, Privacy Impact assessments are focused to assess the risks associated with data processing activities (actually they are Data Protection Impact Assessments).

The process enables to record Privacy Impact Assessments and to support their fulfilment. Privacy Impact Assessments are typically related to one or more processing activities, those to which they refer to.

Workflow

A new Privacy Impact Assessment can be created using the Add New functionality and choosing "New Privacy Impact Assessment".

A workflow enables to move the Privacy Impact Assessment" in several statuses as shown in the following picture.

Privacy Impact Assessments workflow and statuses.

The following table explains the meaning of each status:

Status	Description
Default	A temporary status when the Privacy Impact Assessment is initially created before the first save.
Opened	A Privacy Impact Assessment in this status is draft.
Detailed Assessment	This status means that a detailed assessment needs to be executed. If a significant risk is found during the preliminary assessment, the transition through this status is required before closing the Privacy Impact Assessment.
Suspended	Activities concerning the Privacy Impact Assessment are temporarily suspended.
Closed	In this status, the assessment is completed.
Cancelled	Privacy Impact Assessment cancelled. This is an end of life status.

Information

Privacy Impact Assessment records are organized in four sections:

• Identification, where identification data of the Privacy Impact Assessment are recorded,
• Ownership & Organization, containing the assignment of the key roles enabled to manage the Privacy Impact Assessment;
• Risk Assessment Questions, containing the preliminary assessment questions;
• Impact Assessment Questions, if any significant risk is found in the Risk Assessment Questions section, it contains detailed impact assessment questions (DPIA);

Detailed information on the meaning and use of every field can be found by pointing the mouse on the (i) next to each field. This will activate a tooltip with a brief description of the field.

Additional information can be found in the secondary forms of the record: attachments, related items, messages and history. See How To for more information.

Privileges

Privacy Impact Assessments can be created by the users to whom the corresponding privilege is granted (see Users & Groups for more information on how to set this privilege).

The lifecycle of the Privacy Impact Assessment is managed by the roles described in the table below. Groups are pre assigned to the roles according to the settings (see Settings for more information on how to set these defaults). Initial assignments can be modified according to privileges choosing among the enabled groups (see once again Settings for more information on how to enable groups).

Role	Description
DPO Group	Members of the group assigned to this role have full privileges. They can: transition records to any compatible status, update fields when possible, update data sources directly in record management.
Data Controller Group	Members of the group assigned to this role have view (read) privileges.
Data Processor Group	Members of the group assigned to this role have view (read) privileges.
Assessment Team	Members of this group have several privileges. They can manage the entire lifecycle, being enabled to: transition records to any compatible status, update fields when possible.
Auditors Team	Members of the group assigned to this role have view (read) privileges.
PIA Owner	This role can be assigned to a single user among members of the groups previously described. The Owner has several privileges: transition to any compatible status, update fields when possible.

Reports

The list of Privacy Impact Assessments can be filtered and exported to excel format from the view Privacy Impact Assessments.

Related processes

Privacy Impact Assessments can be related to processing activities, risks and issues / non conformities.