Commitments

A commitment is a privacy promise — a measure, condition, undertaking, or control your organization agrees to. It hangs off the record it comes from, so commitments appear in several places:

• An assessment or audit — the Commitments card on its Details tab (an audit calls them management actions), and a finding's Add action item.
• An incident — the Remediation tab.
• A complaint — the Outcome tab, where the regulator's recommendations are tracked.
• A privacy subject — its Commitments tab. A promise about the whole program hangs on the organization-wide Privacy program subject.

Commitments start life as advisory recommendations and are tracked to completion so nothing is forgotten. Requests have no Commitments card: an undertaking given in a response is part of the response, and a regulator's recommendations on an access appeal go on the complaint or appeal. Commitments recorded on a request before October 2026 are kept, and still appear in the Commitments report, Report Builder and My Day. The commitment panel shows the definition and an action-driven status, and each commitment carries its own Discussion thread.

Who Can See and Change Them

A commitment follows its record: you see it if you can open that record, and you add or change it if you can edit that record (assessment modify, incident manage, complaint manage). A commitment on a privacy subject needs the assessment permissions, as editing the subject does. The owner is reminded in My Day when a one-time commitment falls due or a recurring one needs a check-in (complaint recommendations remind the complaint's assignee instead). Commitments stay editable after an assessment takes effect or a case closes — that is when recommendations arrive and check-ins are recorded.

The Commitment Definition

The panel shows the definition — title, description, type (measure, condition, undertaking, or control), owner, cadence, and evidence notes — with a coordinator-only pencil to edit. The title, description, and evidence notes support optional per-language translations, on both the assessment and complaint anchors.

Recommendations: Who Made It and Your Decision

A proposed commitment is a recommendation awaiting the organization's decision. Record who made it — an internal review, a reviewer, the privacy officer, a regulator or an auditor — with their reference, when it arrived and when a response is due. Then Accept it, and it becomes a commitment with an owner and a due date, or Decline it with the reasons. A declined recommendation is final and stays on the record with who decided and when; to reconsider, record a new one.

The Commitments card groups Recommendations, Commitments and Resolved. My Day reminds the owner (or, for an unowned recommendation on an assessment, its coordinator) as the response date approaches, and the assessment PDF adds a Response to recommendations table. Save and add another keeps the source, reference and dates filled in, for entering a batch of recommendations from one report, and the closure tab of an assessment, complaint or incident warns when recommendations are still awaiting a decision.

Status Is Action-Driven

Status is driven by header actions rather than a free dropdown:

• Proposed → Mark accepted. Delete is offered only at this advisory stage.
• Accepted → Mark done or Retire.
• Done and Retired are terminal.
• Declined is a recommendation that was not adopted; it stays on the record.

Discharging a Requirement

A commitment on a privacy subject or an assessment can name the compliance requirement it discharges — one of the subject's documentation and notice requirements, such as defining a retention period or updating a privacy notice. Keeping the commitment ticks the requirement on the subject, so a mitigation that recurs across assessments is counted once, as the program-level requirement it is. An assessment template can pre-set it: in the question editor, Compliance requirement an action discharges links every action raised from that question's finding to the requirement. See Privacy Subject Details.

Reporting

Reports → Commitments summarizes the whole register, and can be filtered to one type — see Commitments Report. Report Builder offers Commitments and Findings as subjects.

One-Time and Recurring Commitments

Every commitment has a cadence type:

• A One-time commitment carries a due date and flags as overdue when past due.
• A Recurring commitment carries a recurring cadence — monthly, quarterly, semi-annual, annual, or ad-hoc — and shows a check-in history table plus an inline Record check-in form.

Recording a Check-In

For a recurring commitment:

1. Pick an outcome — Met / Partially met / At risk / Not met.
2. Set the check-in date and add a note.
3. Record it.

The card then shows the last outcome and the next check-in date. A layered Discussion thread anchors to each commitment for context and follow-up.