DPIA Validation

A data protection impact assessment (DPIA) — or a privacy impact assessment where the law asks for the same steps — is not finished when its questionnaire is complete. Someone gives advice (often the data protection officer), the people concerned may be asked for their views, the organization decides whether the processing goes ahead, and sometimes the regulator has to be consulted or sent a copy. The Validation tab records each of these steps, with who did it, when, and the documents behind it.

When an assessment's questionnaire (or its assessment type) configures these steps, the assessment shows a Validation tab after Review. An assessment whose questionnaire configures none of this has no Validation tab and works exactly as before. The questionnaires of the jurisdiction packs listed below come configured; your administrator can configure your own (see Assessment Templates).

The Path of a DPIA

1. Screener. When you create the assessment, the screener can show the regulator's own list of processing that needs an assessment, or is exempt from one (see The Screener and the Regulators' Lists below).
2. Questionnaire and risks. Complete the sections and rate the risks. The risk map on the Risks tab shows each risk before and after the corrective measures.
3. Opinions. Ask for the opinions the questionnaire names, such as the data protection officer's advice and the views of the people concerned, early, while the work is still open to change.
4. Review. Start the review. Where the questionnaire asks for it, the reviewer rates each section (see Section Evaluation).
5. Regulator. Where the law or the residual risk requires it, record the submission to the regulator and its answer on the Closure tab (see Regulator Consultation).
6. Decision. The senior official records the decision of the organization on the Validation tab.
7. In effect. Mark in effect on the Closure tab runs every check. Ready to approve? on the Validation tab shows the same checks before you try.
8. Afterwards. Follow-ups remind you of the regulator's reply and of the periodic check-in, and a material change starts a new assessment.

Who Sees What

Anyone who can open the whole assessment sees the Validation tab and its records. A colleague who works only on a delegated section does not; the tab says You can see this once you can open the whole assessment, not only your section.

• Requesting an opinion, recording one on someone's behalf, recording not sought and saving how an opinion was taken into account need Modify assessments. The person asked records their own opinion without it.
• Recording the decision needs Act as senior official.
• Resubmitting after a refusal needs Activate / transition assessments.
• Readers can read the records but change nothing.

Once the assessment is In Effect or Closed, its opinions and decision are part of the record and no longer change.

Ready to Approve?

The right-hand side of the Validation tab lists what is still missing before the assessment can take effect: required sections, open reviews, section evaluations, the submission to the regulator, an order of the regulator in force, the opinions, the responses and the decision. Each item links to the tab or section where it is done.

Under Worth knowing the list shows what does not stop the approval but deserves a look: an opinion given before later changes, a regulator's reply still awaited, a consultation paused for information, a waiting period still open. The list is the same set of checks Mark in effect runs, so it can never say ready while the approval would be refused.

Opinions

Each opinion the questionnaire configures has its own card, in order. An advice step (for example the data protection officer's advice) records one person's opinion. A views step records what the people concerned or their representatives said, or why they were not asked.

• Request opinion. Pick the person (only people who can open the whole assessment are offered), a due date and a note. They get a My Day item, Give your opinion '…' on assessment …, and a notice, Opinion requested on an assessment. Remind sends one reminder a day at most. Withdraw request cancels it.
• Record opinion. The person asked records their position (Favourable, Favourable with reservations, Unfavourable, Mixed or No position; the step offers only the ones its rules allow), their opinion, the date it was given and, where the step asks for one, the document.
• Record on their behalf. When the advice arrived on paper or by e-mail, someone with Modify assessments records it for the person who gave it: their name and capacity, the position and the date, with the signed document (their advice, or the record of the views), which is required. An open request for the step is withdrawn.
• Views of the people concerned. Say who was consulted (groups or their representatives, never named individuals), how, the number of participants and what they said, and attach an aggregated summary, not the raw responses. If the views were not sought, choose Record "not sought" with one of the step's reasons (it would harm commercial interests, the public interest or the security of the processing; it would be disproportionate; it is not appropriate in this case; another reason) and the justification.
• How it was taken into account. When a position calls for it, usually Favourable with reservations or Unfavourable, choose Add how it was taken into account and record how the organization took it into account. The decision waits for it.
• Changes after an opinion. If the assessment changes after an opinion was given, the card says so and Ready to approve? mentions it under Worth knowing. The opinion still stands; ask again if the change matters.

The Decision

Record decision on the decision card records the decision of the organization. Only someone who holds Act as senior official and can open the whole assessment may record it. When the assessment names a senior official, only that person, or someone covering for them under a delegation that includes Act as senior official, may. A person who gave advice on the assessment cannot also decide on it, unless the questionnaire allows it. The card says why the button is unavailable when it is.

• Outcome. Accepted, Accepted with conditions, Consult the regulator first or Refused. The questionnaire offers the ones its regime uses.
• Attestations. The statements the questionnaire asks the decider to confirm (for example that they understand the risks that remain). Each one must be ticked, except for a refusal.
• Reasons. Required for a refusal and for an acceptance with conditions, and whenever the decision goes against an Unfavourable opinion or an unfavourable written advice from the regulator. The decision then records which position it departs from.
• Conditions. An acceptance with conditions lists them, each with an owner and a due date. Each becomes a commitment on the Commitments card.
• Signature. Recorded directly, or Signed report attached with the signed document. The questionnaire may fix which one.
• Opinions first. An acceptance (and Consult the regulator first) needs every required opinion and every required response in place. A refusal can always be recorded.
• Consult the regulator first. Records that the regulator must be consulted before the organization decides. Record the consultation on the Closure tab, then record a new decision once the regulator has answered.
• Refused. Choose the next step. Rework the assessment sends it back to Active: the opinions are set aside (they are asked for again on the revised assessment) and the refusal stays on the card until you Resubmit. Say what was changed, and the assessment goes back to In Review for a new decision. Abandon the processing closes the assessment as discontinued; the usual closing checks still apply.

The decision must come last: recorded after every current opinion and after the regulator's answer to a prior consultation or a review. If the assessment changes after the decision, the card says The assessment has changed since this decision and the decision must be recorded again before approving. A copy sent to the regulator for information (a notification) is not advice and never has to come before the decision.

When the assessment goes back to Active, whether from In Review, after it took effect, or when it is reopened, the current opinions, decision and section evaluations are set aside and the earlier records stay listed under Earlier records. The senior official named on the assessment (else its coordinator) gets Assessment … is ready for your decision on My Day, with the notice Assessment ready for your decision, once everything but the decision is in place.

When the Regulator Must Have the Assessment

Some regimes require the assessment to be provided to the regulator before the processing starts. The rule sits on the questionnaire (or the assessment type) and the approval enforces it. Until the submission is recorded, on the Regulator consultation card or as the Submitted to regulator date in the sidebar, Mark in effect is refused and Ready to approve? reads The assessment must be provided to the regulator before it takes effect.

• Always. The submission is required whatever the risk, even with no risk rated, or no risk at all. The Canada federal and Alberta HIA questionnaires use this rule.
• When the residual risk reaches the regulator's threshold. The overall residual risk (the highest of the assessment's risks after their measures) decides: at the threshold the submission is required, below it it is not. When the risks rated so far do not reach the threshold and the register is empty or still holds a risk without a residual rating, AccessPoint cannot know the answer, so it refuses with Rate the risks first… and a link to the Risks tab. Rate every risk, or record the submission anyway. The EU GDPR, Ireland, UK and France DPIA questionnaires use this rule, so in those packs the risks (the CNIL's three feared events included) must be rated before the DPIA takes effect.
• Other conditions (before implementation, on request…) never require the submission on their own.

When an administrator changes the rule of an assessment type or a questionnaire in Settings, the open assessments of that type or questionnaire follow it at once. An assessment in effect or closed keeps the rule it took effect with.

The Canada federal flow. The head of the institution (or the section 10 delegate) records the approval on the Validation tab. The approved PIA is then provided to the Office of the Privacy Commissioner and to the Treasury Board of Canada Secretariat, as two notifications on the Regulator consultation card, each concluded as Notified when recorded, and the assessment is marked in effect. No risk rating is needed for this. While only those copies are missing, My Day keeps showing the official the decision as ready.

The Screener and the Regulators' Lists

Many regulators publish a list of the kinds of processing that require an assessment, and some a list of processing that does not. When a questionnaire's screener asks about such a list, the screener step shows the list itself in one question: tick each entry that applies, or None of these. Each entry wraps in full, with Details for its explanation, and the list names its source and the date it was adopted.

• Entries that apply alone make the assessment required by themselves. Criteria count toward a threshold (Tick every criterion that applies. 2 or more make an assessment required.).
• An exemption list screens the assessment out, but only when no mandatory entry applies. If both apply, the assessment is required and the screening record says the exemption was overridden.
• Whose list? The question can name an authority. Otherwise the questionnaire's legal authority's list is used, then the default authority set under Settings → Screening lists, then the only authority whose lists are installed. Use another authority's list lets an organization working across borders pick another one for this assessment. When no list is installed, the question falls back to Yes / No.
• The Screening record on the Overview tab keeps which list (and which edition) was used, what was ticked and the rule that decided. An exemption shows as Screened out by an exemption list.

Lists installed by the jurisdiction packs: the CNIL's lists of processing that require a DPIA (14) and that need none (12, exemptions); in Germany the federal commissioner's list (9 criteria, two or more, and 3 that apply alone) and the supervisory authorities' joint list for the private sector (17); the Netherlands (17); Spain's AEPD list (11 criteria, two or more) and its exemptions (7); Italy (12); Ireland (10); the UK ICO's list (10); Québec's situations in which the law requires a privacy impact assessment (public bodies, the same list for health and social services, and the private sector); and the indicators of a high privacy risk project under the Australian Government Agencies Privacy Code (13). The EU GDPR questionnaire reads the lists of your organization's own supervisory authority. Administrators manage the lists under Screening Lists.

Answers Filled From the Validation Tab

A questionnaire can link a question to the Validation tab, such as Was the data protection officer's advice sought?, the decision, or the date of the submission to the regulator. Such an answer is filled from the records, in your organization's default language, and is read-only in the questionnaire (Recorded on the Validation tab, with Open the Validation tab). An answer typed before the question was linked is kept as it was. Once the assessment takes effect, the answers stay as they were approved.

The Assessment PDF

The assessment PDF and every summary layout print a Validation block when there is something to print: each opinion (or why it was not sought) and how it was taken into account, the decision with its attestations, conditions, reasons and signed report, and the regulator consultations. The GDPR summary names the data protection officer from the advice actually recorded.

The CNIL PIA report. An assessment whose questionnaire uses the France — CNIL PIA report layout (the France pack's CNIL questionnaire does) prints its summary the way the CNIL method sets it out, in the language you choose:

• 1 Context, 2 Fundamental principles, 3 Risks. Each part has its questionnaire sections, every question and its answer (the feared events from the risk register, tables and diagrams included). A section belongs to the part its title's number names (1.1, 2.2, 3.2 to 3.4); a section without a number follows the one before it.
• 4 Validation. The risk map before and after the corrective measures, with the table that says the same in words and your comments on the map; the action plan (the corrective measures the evaluation asked for, each with its section, the rating that asked for it, the person responsible and the due date, then your comments and any other measures and commitments); the data protection officer's advice and the views of the people concerned; and the validation itself (the decision, who took it and in what capacity, when, the attestations ticked, the signed report, the conditions and the reasons), with the consultations of the CNIL.

The report prints these records itself, so it carries no separate Validation block, and a question filled from the Validation tab is not printed twice. The printed risk maps are described under Risk Map and Risk Overview.

Follow-Ups, the Annual Check-In and Re-Assessment

The jurisdiction packs bring follow-up rules for this work, all switched off until an administrator reviews and switches them on (Settings → Follow-up rules):

• The regulator's reply to a prior consultation (EU GDPR, UK, France): a follow-up for the coordinator, with the senior official told, on the date the reply is due. It moves with an extension, pauses while the regulator waits for information, completes itself when the outcome is recorded, and warns on approval while the reply period runs.
• The annual DPIA check-in (France, GDPR Art. 35(11)): a notice to the coordinator twelve months after the DPIA took effect, to check that the processing still matches it.

A rule of your own can start from the new assessment dates (Regulator's reply due, Regulator consultation concluded, Opinion requested, All required opinions recorded and Decision recorded) and can warn on Approve (the assessment goes in effect). The usual Re-assessment due reminder and Re-assess (a new assessment of the same subject) bring a DPIA back when the processing changes.

Which Jurisdiction Packs Configure It

Fifteen jurisdiction packs configure validation or install screening lists. They are a starting point built from public information about the legislation, not legal advice. Your legal counsel validates and adjusts them.

Assessments started before a pack was re-applied keep the questionnaire version they started on.

Worked Examples in Train Mode

To see a finished DPIA before writing one, open train mode. Its training copy of your organization holds two worked examples, prepared again each time your setup is copied into the training copy or the training cases are reset. They are fictional cases, never in your real register.

• Worked PIA: an account-based fare system. On the universal PIA questionnaire, in all eleven languages: the description, the inventory and flows, necessity, compliance, three risks rated before and after treatment, the action plan, a review by the data protection authority and the sign-off.
• Worked DPIA: remote reading of water meters (CNIL method). With the France pack, in French and English: the context, the fundamental principles, the three feared events before and after the measures, the evaluation of each part, the data protection officer's advice, the users' views, a prior consultation and the controller's decision.

Each opens with a guide that points to the tabs worth reading. The example is recorded under the same rules as real work, so some of its steps carry the name of a real colleague. Every such record says so, for example Recorded by the training example.

Related Pages

• Section Evaluation — how the reviewer rates each section.
• Regulator Consultation — the card on the Closure tab.
• Risk Map and Risk Overview — before and after the corrective measures.
• Assessment Details — the assessment panel and its tabs.
• Screening Lists — administering the regulators' lists.
• Assessment Templates — where the validation steps are configured.