PIA workflow

A Privacy Impact Assessment, or PIA, must be conducted if a processing activity is likely to result in a high risk to the rights and freedoms of natural persons.

The PIA provided in the GDPR software offers all the features available in the PIA software provided by the CNIL (French data protection authority) plus additional features, such as those that facilitate collaborative work between drafter(s), appraiser(s) and validator(s).

This article explains the PIA workflow, from drafting to validation. It also lists the permissions required at each stage of the process, and explains how to import/export PIAs.

 

Table of contents

• Permissions
• Creating a PIA
• Workflow
• Archiving a PIA
• Importing a PIA
• Exporting a PIA
• Duplicating a PIA

Permissions

The following table lists the permissions required to work on each aspect of a PIA.

Creating a PIA

A PIA can be created before or after its related processing activity. The two approaches differ somewhat.

Creating a PIA before a processing activity

The idea here is to create a PIA in order to assess a processing activity that is still under consideration. The PIA can then be used to guide you in creating the processing activity and help you ensure it is GDPR-compliant. The PIA may lead you to modify the originally planned processing activity, or even to decide not to implement it. In any event, the goal is to ensure an GDPR-compliant processing activity.

 

To create a PIA before the processing activity:

1. In the sidebar, click Impact Assessment > Add an impact assessment.

2. In the Add new impact assessment dialog box, enter the required information:

• Give the PIA a name

• Select a Drafter, Appraiser and Validator. They can be the same person. You can also select more than one of each.

3. Click Add PIA. The PIA is added to the list of PIAs.

Linking the PIA to a processing activity

You can link the PIA to one or more processing activities at any point, regardless of PIA or processing activity status.

 

To link a PIA to a processing activity:

1. In the sidebar, click Impact Assessment.

2. On the Impact assessment page, click the name of the PIA to open it.

3. Click the Details button.

4. Click the Related processing field and select a processing activity from the dropdown menu.

Creating a PIA after a processing activity

You can create a processing activity and create the PIA afterwards. The advantage of this approach is that the PIA is automatically populated with the information retrieved from the processing activity.

 

To create a PIA after the processing activity:

1. In the sidebar, click Processing, find the processing activity and open it.

2. In the Processing menu, click Impact assessment.

3. To the question Has the entity considered carrying out an impact assessment?, answer Yes.

4. Then answer the resulting question Has the entity conducted an impact assessment?

5. Scroll to the bottom of the page and select the criteria (which are based on the WG29 guidelines) that you consider apply to the processing activity. If you select more than one criterion, a PIA is required.

6. To create the PIA, click the Add an impact assessment button.

7. In the Add new impact assessment dialog box, enter the required information:

• Give the PIA a name

• Select a Drafter, Appraiser and Validator. They can be the same person. You can also select more than one of each. They can be changed (using the Details button) up until the PIA is validated.

• The Related processing activity is selected by default.

 

8. Click Add PIA. The PIA opens.

Workflow

A PIA goes through a number of stages or statuses, from creation to the moment it is validated – or rejected.

Each time the PIA changes status, a message notifies the person who will be working on the PIA in the new status.

The following table summarizes the conditions required for a status change.

Drafting a PIA

When a PIA is first created, its status is Being drafted. It is ready to be completed by the drafter(s).

 

To draft a PIA:

1. In the sidebar, click Impact assessment.

2. On the Impact assessment page, click the name of a PIA to open it.

3. Select one of the sections and answer the questions. You can answer the questions in any order. You do not have to complete all the questions in a section to move to another section.

4. Optionally you can:

• Click Comment(s), add a comment and click the Add comment button. You can add multiple comments.

• Click the Documents tab and add documents to support any of your answers.

• Click Risks overview (under Risks) for a graphic view of the risks.

 

5. When you have answered all the questions, the Ask for evaluation button is enabled (red). Click the button to end the drafting phase and notify the appraiser(s) that the PIA is ready for evaluation.

Evaluating a PIA

When the status of a PIA switches to Being appraised, it is ready to be reviewed by the appraiser(s).

The appraiser(s) cannot modify the answers provided by the drafter(s). They can only review them using the evaluation buttons provided after each answer, or in some cases at the end of a section.

To evaluate a PIA:

1. Review each answer and/or section and click one of the three Evaluation buttons:

• Acceptable: The data is adequately protected.

• Improvable: Additional measures are advisable to improve data protection. You must describe the action plan and/or corrective actions to be performed in the text field below.

• To correct: The information provided is not sufficient to ensure that the data is adequately protected. Explain the changes that are required in the Evaluation comment field. By selecting this option, the PIA will be sent back the drafter(s) to be corrected.

2. When you have evaluated each answer, click the Validate the evaluation button.

Correcting a PIA

If at least one evaluation is To correct, the PIA switches back to Being drafted status. A notification is sent to the drafter(s). This begins the correction cycle.

 

To correct a PIA:

1. The Drafter opens the PIA.

2. The drafter makes the changes requested by the appraiser in each section. The drafter can also edit any Improvable answers, but this is not required.

 

3. When all the edits have been made, the drafter clicks the Ask for evaluation button. The PIA status switches back to Being appraised and the appraiser is notified.

 

4. The Appraiser reviews the changes made by the drafter(s). If they are acceptable, they click the Acceptable button for each one.

• Changes made by the drafter are indicated by a red counter.

• The appraiser can also click Action plan (under Validation) to obtain an overview of the sections requiring a re-evaluation.

 

5. The appraiser clicks the Validate the evaluation button. The PIA status changes to Being validated and the validator is notified that the PIA is ready for validation.

Validating a PIA

When the status of a PIA is Being validated, the validator(s) takes over. Their role is to determine whether to validate each answer written by the drafter(s) and evaluated by the appraiser(s). The validator(s) cannot edit the drafter’s answers. However, they can change the evaluations made by the appraiser(s).

 

To validate a PIA:

1. Review all questions in all sections.

 

2. If you wish to change any of the appraiser’s evaluations, click the evaluation buttons and enter any necessary comments.

3. Click DPO and data subjects' opinions and complete the section. Explanations must be provided in all the text boxes.

4. The Validate PIA button is enabled (red). Click the button.

 

5. Click Validate PIA.

6. You have the following options:

• If you confirm all 4 statements, the Validate PIA and Need correction buttons are enabled. Clicking Validate PIA will switch the status to Validated. However, if you changed evaluations or made comments in the PIA and you wish to see changes implemented before validating the PIA, click Need correction. This switches the PIA back to Being evaluated status and the appraiser is notified. They re-evaluate the PIA, send it back to the drafter for changes, and the cycle resumes.

• If you do not confirm all 4 statements you must reject the PIA. Click Refuse PIA. The status switches to Rejected.

Archiving a PIA

In the event of changes to GDPR requirements or to the risk levels of your organization, a validated PIA may eventually become obsolete. In this case, you can archive it for your records and create a new PIA.

 

To archive a PIA:

Click the Archive PIA button.

Importing a PIA

Importing a CNIL PIA

A PIA generated by the DLD GDPR software is fully compatible with a PIA generated by the CNIL (French Data Protection Authority) PIA software. A PIA started or completed using the CNIL software can therefore be imported into the DLD solution.

 

To import a CNIL PIA:

1. In the CNIL PIA software, export the PIA as a .json file.

2. In the DLD GDPR software, in the sidebar, click Impact assessment. Then click the Import PIA button.

3. Select one or more Drafter(s), Appraiser(s) and Validator(s).

 

4. Click Select your PIA, locate the file and click Open. The PIA is added to the list of PIAs in the GDPR software. It can now follow the standard PIA workflow described in this article.

Updating a DLD PIA with a CNIL PIA

When the PIA status is Being drafted, you can update it with a newer PIA created using the CNIL PIA software. When you do this, all the information in the original PIA is overwritten with the information in the CNIL PIA. Only the drafter(s), appraiser(s) and validator(s) remain unchanged.

 

To update a DLD PIA with a CNIL PIA:

1. In the CNIL PIA software, export the PIA as a .json file.

2. In the DLD GDPR software, in the sidebar, click Impact assessment and open the PIA you want to update.

3. Click the Update the PIA button.

 

4. In the Update the PIA dialog box, click Select your PIA, locate the CNIL PIA, and click the Update button.

Importing another PIA format

If you import a PIA that is not in the CNIL format, it is added to the document database, in the category called Impact assessments other than the CNIL's.

Exporting a PIA

DLD PIAs can be exported in two formats:

• pdf for reading and sharing

• json for reimporting into the CNIL PIA software.

 

To export a PIA:

1. In the DLD GDPR software, in the sidebar, click Impact assessment.

2. Click the name of the PIA to open it.

3. Click the “More” button and select either .json format or .pdf format.

 

To export all the PIAs of an entity:

1. In the DLD GDPR software, in the sidebar, click Impact assessment.

2. Click the “More” button and select Global export. All the PIAs are exported in json format.