Downloading an element

Documents & Policies

Assessments

Controls & Technical and Organizational Measures (TOMs)

Legitimate Interest Documentations

Assigning Audiences to Elements

Microsoft Entra ID Setup

Tasks

IT Settings

Compliance Settings

Roles, responsibilities and notifications

What to do when encountering a White Screen?

Process Risk Overview

The process risk model

Projects

Incidents & Breaches

How to disable Auto-Complete on a Website

Document list for onboarding

Data Collection Point (DCP)

Creating attributes that fit your industry

International Standards

Add documents to vendors

Use AI to create elements

Priverion GRC Platform overview

Sharing Elements

Risk Settings

Managing audiences

Release 211 (18.10.2024)  

The Asset Risk Model

Release 276 (16.05.2025)

Release 257 (08.03.2025) 

Release 260 (20.03.2025)  

How to answer an assessment/questionnaire

Release 229 (02.12.2024) 

Setting up the first organization or company

How can a user change the language?

Contact our Support

Release 207 (05.10.2024)

Release 210 (12.10.2024) 

Quickstart Guide

Release 251 (12.02.2025) 

Record of Processing Activities (ROPA)

Release 228 (18.11.2024) 

Data Flow Map

Time Machine

Company Widget Feature

Create and evaluate assessments 

Asset Register

Vendors

Data Protection Impact Assessments (DPIA)

Meetings & Activities

Retentions & Deletions Periods

Report Explorer

Data Subject Requests

Exporting your ROPA

Terms for legitimate processing

How to create a new user and how to change the password for login

Creating organizational units

Maturity model

Release 235 (10.01.2025)

Adding risk scenarios to assets or asset groups

Relevant Risk Szenarios

Release 253 (22.02.2025) 

Release 250 (08.02.2025) 

Release 244 (31.01.2025) 

Release 254 (26.02.2025) 

Release 256 (05.03.2025)  

Release 258 (14.03.2025) 

Release 263 (24.03.2025)  

Release 265 (14.04.2025) 

Release 267 (22.04.2025)

Release 268 (23.04.2025)

Release 272 (02.05.2025)

Release 269 (25.04.2025)

Release 270 (25.04.2025)

Release 271 (29.04.2025)

Release 274 (07.05.2025)

Release 273 (05.05.2025)

Release 275 (09.05.2025)

Getting Started

Modules

Document

Manage

React & Resolve

Sharing & Group functions 

Features

provide you with practical instructions and advice to navigate and use the platform effectively.

How-To Guides & Tips

Get Help

Privacy Knowledge

Release Notes

Legal

<h2>Overview</h2><p>At any stage of data protection compliance, it is helpful to evaluate your current status and identify areas for improvement. Assessments in data protection management can serve various purposes, including:</p><ul><li>Data protection risk assessments</li><li>Internal compliance reviews</li><li>Data Protection Impact Assessments (DPIA)</li><li>Security assessments</li><li>Training needs assessments</li><li>Reviewing the effectiveness of data protection measures</li><li>Vendor evaluations</li></ul><p>Through assessments, companies can improve their data protection practices, ensure compliance with legal requirements, and minimize the risk of data breaches.</p><p>Assessments consist of questionnaires on specific topics to be evaluated. These questionnaires are sent to one or more responsible persons tasked with answering them.</p><p>The overview page differentiates between the tabs <strong>All,</strong> <strong>Response Evaluation</strong>, <strong>Overdue</strong>, <strong>Waiting Response</strong>, <strong>Passed</strong>, and <strong>Failed, </strong>subdividing your current assessments into states. You can also display an overview of the permalinks by clicking on the switch in the top right corner.</p><p>Clicking on an existing assessment will take you to its management page. If you wish to create a new assessment, click the <strong>Create</strong> button.</p><h2>Creating Assessments</h2><p>You can create an assessment, generate a permalink, or download a shared assessment from your organization. This guide focuses on the manual creation of assessments and permalinks. For more information about downloading, refer to the relevant <a href="https://helpcenter.priverion.com/en/article/downloading-an-element" target="_blank" rel="noopener noreferrer">guide</a>.</p><p>First, enter the general information, such as:</p><ul><li><strong>Responsible person</strong></li><li><strong>Assessment status</strong></li><li><strong>Priority</strong></li><li><strong>Assessment name</strong></li></ul><p>Optionally, you can classify the assessment using an attribute.</p><p>Next, select the templates (questionnaires) for the assessment. Set a deadline by which the questionnaires must be completed. Finally, specify whether a report should be shown to the responder.</p><p>Click <strong>Next</strong> to proceed.</p><h3>Maturity Goals</h3><p>The <strong>Maturity Goals</strong> tab is only active if maturity goals are requested in the selected questionnaire.</p><p>Here, you can set maturity goals for the entire questionnaire, by section, or for each question individually.</p><p>While answering the questions, respondents will assess maturity levels, ranging from <strong>Incomplete</strong> to <strong>Optimized</strong>. Later, these responses can be compared with the predefined goals.</p><p>Set goals realistically and effectively to evaluate your data protection processes accurately and make progress measurable.</p><p>Click <strong>Next</strong> to proceed.</p><h3>Recipients and Notification</h3><p>On this page, you can define the recipients of the questionnaires. Follow these steps:</p><ul><li>Click <strong>Add Audience</strong> to select groups, then click <strong>Add to list</strong>.</li><li>You can add individual recipients by typing an <strong>email address</strong> into the corresponding field and pressing <strong>Enter</strong>.</li></ul><p>You can select one or more <strong>Notification Workflows</strong> from the dropdown menu for each person or group. Additionally, you can set the notification language.</p><p>Click <strong>Send</strong> when you are finished.</p><h3>Creating a Permalink</h3><p>A permanent link generates a new assessment each time it is opened. It<span style="color:rgb(25,35,50);"> can be shared via an intranet or email to gather multiple responses quickly.</span></p><p>To create a permalink, follow these steps:</p><ul><li>Enter the general information for the assessment.</li><li>Select at least one method to identify the responding person. This can be done through email registration or account login.</li><li>Decide whether the permalink should expire after a certain period.</li><li>Set the amount of responders.</li><li>Set a deadline for completing the assessment.</li><li>Specify whether a report should be shown to the recipient.</li><li>Choose the priority level and click <strong>Next</strong>.</li></ul><p>Setting maturity goals follows the process described earlier. On the next page, you can configure default notifications for all respondents by notification workflows and selecting the notification language.</p><p>Once all settings are configured, click <strong>Send</strong>. The permalink is now ready to use and can be shared as needed.</p><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.128342245989305; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm3px2rji1vk1ahr78haz5spl?embed_v=2" loading="lazy" title="Create Assessments" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><h2>Managing Assessments</h2><h3>General</h3><p>Click on an assessment to view its general information. You will also see a URL that allows you to open the questionnaire.</p><p>Click <strong>Edit</strong> to modify details. This will take you to the page you are already familiar with from the creation process. At the bottom, you can activate or deactivate the assessment. By default, all assessments are active. However, deactivation might be helpful if the assessment is temporarily not in use.</p><p>As with most elements, you can add notes by clicking the <strong>Notes</strong> button on the right or <strong>Manage Access</strong> by clicking the three horizontal dots in the top-right corner.</p><h3>Notification Status</h3><p>The <strong>Notification Status</strong> tab allows you to track the status of all notifications.</p><h3>Answers</h3><p>The <strong>Answers</strong> tab displays all responses to the assessment. Here, you can see the template used and the number of questions answered and approved.</p><p>Clicking on a response takes you to the <strong>Reviewer Panel</strong>, where you can further review and manage the answers.</p><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.128342245989305; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm3q0ik7x1zuiahr7s0y8snnv?embed_v=2" loading="lazy" title="Edit Assesments" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><h2>Evaluating assessments</h2><p>Regardless of whether the questionnaire is fully completed, you can evaluate the answers provided so far at any time.</p><p>In the Reviewer Panel, you will see all the answers awaiting to be reviewed in the left column, all answers awaiting to be resubmitted in the middle, and the reviewed answers will be displayed on the right.</p><h3>Evaluating Answers</h3><ul><li>Click on an answer in the left column to view the question and the given answer. Below the answer, you will see the options to <strong>approve</strong> or <strong>decline</strong>. For questions with multiple answers, you can evaluate each answer separately.</li><li>If maturity levels have been queried, you can compare them with the set goals and approve or decline them.</li><li>On the right, you will see any comments from the responder. You can also add a comment, for example, to justify a declined answer.&nbsp;</li><li>Additionally, you can link the question to a specific item, such as a ROPA, by selecting the corresponding option in the Data Mapping section.</li><li>For some questions, uploading evidence documents may be required or optional. These documents will be displayed below the answer. You can also upload your own documents to support or supplement your evaluation.</li><li>Click <strong>Save</strong> to move to the next question.</li></ul><p><strong>Tip</strong>: Instead of approving each question individually, you can go through all the questions using the arrow and then click <strong>Approve All</strong>. This action will apply to all remaining questions without modifying previously declined answers. Alternatively, you can use the <strong>Decline All</strong> function.</p><p>You can always click the blue bar on the right to get an overview or return to the Reviewer Panel during the evaluation process. Once you have reviewed all answers, you will be automatically redirected to the Reviewer Panel.</p><h3>Resubmission</h3><p>Declined answers will now appear in the middle column of the Reviewer Panel. If you click <strong>Resubmit All</strong>, the questions will be sent back to the responder so they can revise their answers. If a resubmitted question has been answered again, you can view the previous answer by moving the icon on the timeline.</p><h3>Modify Evaluation</h3><p>You can reopen previously reviewed answers if you wish to adjust your evaluation. To do so, click on the answer in the right column and then click <strong>Reopen</strong> at the top right to modify your evaluation.</p><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.128342245989305; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm3q1z3vm00de3vukyjnrc72q?embed_v=2" loading="lazy" title="Assess questionnaire" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div>

<h2><strong>Feedback and Support</strong></h2><p>We value your feedback. If you encounter any issues or have suggestions, please contact our support team:</p><ul><li><strong>Email:</strong> <a href="mailto:hello@priverion.com">hello@priverion.com</a></li><li><strong>Schedule a Meeting:</strong> Via the Help Widget</li><li><strong>Give Feedback with Screenshots:</strong> Via the Ticket Button in the Help Widget</li><li><strong>Schedule a Support Call: </strong><a href="https://calendly.com/d/ckv5-n5p-j6z/support-call" target="_blank" rel="noopener noreferrer">Here</a></li><li><strong>Schedule a Technical Support Call:</strong> <a href="https://calendly.com/d/cmg2-qsm-9zg/technical-support-call" target="_blank" rel="noopener noreferrer">Here</a></li></ul>

<h2>How is the Priverion Platform built up?</h2><h3>Dashboard</h3><p>The dashboard provides a comprehensive overview of all pending and ongoing obligations. It helps keep track of tasks, effectively set priorities and plan resources.</p><ul><li><strong>Tasks</strong>: Overview of all upcoming tasks and the total workload. It also highlights overdue tasks.</li><li><strong>Assessments</strong>: Displays the progress of ongoing assessments.</li><li><strong>ROPA Risk</strong>: Shows existing gaps and the risk distribution across all ROPAs, allowing you to address the most urgent areas first.</li><li><strong>Projects</strong>: Overview of planned projects, including details on urgency and timeline.</li></ul><h3>Menu&nbsp;</h3><ul><li><strong>Priverion Logo:</strong> &nbsp;Return to the dashboard.&nbsp;</li><li><strong>Document</strong>, <strong>Manage</strong>, and <strong>React &amp; Resolve: </strong><span style="color:hsl(0,0%,30%);">Navigate between the different </span><span style="background-color:rgb(255,255,255);color:hsl(0,0%,30%);">elements of your documentation.</span></li><li><strong>Plus Icon: </strong>Shortcuts, you can also find these functions in the respective elements.</li><li><strong>Companies</strong>: If you have multiple companies, you can switch between documentations here.</li><li><strong>Gear Icon</strong>: Settings</li></ul><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.128342245989305; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm1tvdzji01q113b31kg8ngei?embed_v=2" loading="lazy" title="Dashboard overview" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><h3>Element Types</h3><p>Get an overview of the three tabs' respective elements for a structured navigation.</p><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.128342245989305; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm1yzpsta12ue13b3pwavhefo?embed_v=2" loading="lazy" title="Element tabs" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><h3>Element Structure</h3><p>The elements are all similarly structured. First, you get to an overview page where the elements are organized by status. Using the search bar, you can quickly find the desired element. On the same page, new elements can be created. You will be taken to its editing page by clicking on a specific element, where you can navigate through the various tabs and linked elements.</p><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.128342245989305; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm1z4h675152w13b37a8yb3dy?embed_v=2" loading="lazy" title="Element structure" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><h2>How are the elements connected?</h2><p>In the Priverion platform, all elements are interconnected.</p><ul><li>The heart of this system is the <a href="https://helpcenter.priverion.com/en/article/record-of-processing-activities" target="_blank" rel="noopener noreferrer"><strong>Record of Processing Activities (ROPA)</strong></a>, which documents all organizational processes involving personal data.</li><li><a href="https://helpcenter.priverion.com/en/article/data-collection-point" target="_blank" rel="noopener noreferrer"><strong>Data Collection Points</strong></a> are the interfaces through which personal data enters your organization. These could be forms, applications, or other points that collect personal information.</li><li>Once collected, the data flows into various <a href="https://helpcenter.priverion.com/en/article/asset-register" target="_blank" rel="noopener noreferrer"><strong>Assets</strong></a>, such as software, databases, physical documents, etc. These assets may be owned by your organization (e.g., your servers) or provided by third-party vendors (e.g., a CRM system).</li><li>Assets are exposed to various <a href="https://helpcenter.priverion.com/en/article/risk-settings" target="_blank" rel="noopener noreferrer"><strong>Risks</strong></a>, including technical, human, and environmental risks.</li><li>Risks are mitigated through <a href="https://helpcenter.priverion.com/en/article/controls-technical-and-organizational-measures" target="_blank" rel="noopener noreferrer"><strong>Technical and Organizational Measures (TOMs)</strong></a>, which are designed to minimize potential threats.</li><li>Most data protection regulations require data to be deleted or anonymized once its purpose is fulfilled unless it is legally required to retain it. Priverion's <a href="https://helpcenter.priverion.com/en/article/retentions-deletions-periods" target="_blank" rel="noopener noreferrer"><strong>Retention and Deletion Periods Library</strong></a> helps manage these requirements.</li><li>Additionally, a wide range of tools for management, documentation, and efficiency enhancement are integrated into the platform and linked to these core elements.</li></ul><figure class="image"><img src="https://cdn-assets.productfruits.com/b6440767-8341-497e-98fd-f8c044217871"></figure><h2>How does the Priverion Platform manage risk</h2><h3>Risk in Data Protection / Privacy</h3><p>The <a href="https://helpcenter.priverion.com/en/article/the-process-risk-model" target="_blank" rel="noopener noreferrer">Risk Model for Data Protection</a> relates to processes (ROPA) and determines the risk from a data protection perspective. It focuses on personal data and evaluates how well the implemented measures protect this data. You can customize this model to fit your specific needs.</p><p>The <a href="https://helpcenter.priverion.com/en/article/record-of-processing-activities" target="_blank" rel="noopener noreferrer">Risk Assessment</a> and treatment documentation for the <strong>Record of Processing Activities (ROPA)</strong> is carried out directly within the element, following this process:</p><ol><li>Identify Risk Scenarios</li><li>Assess the Risk</li><li>Select Appropriate TOMs</li><li>Reevaluate the Risk After Treatment</li></ol><p>This process ensures that risks related to processing activities are effectively identified, mitigated, and monitored.</p><h3>Risk in Information Security</h3><p>The<strong> </strong><a href="https://helpcenter.priverion.com/en/article/risk-settings" target="_blank" rel="noopener noreferrer">Risk Model for InfoSec</a> addresses risks related to assets. It includes all types of data, not only personal data, emphasizing information security and cybersecurity. This risk model assesses the impact of a loss of confidentiality, integrity, or availability of the assets.</p><p>The Asset Risk Model is defined per standard. The <a href="https://helpcenter.priverion.com/en/article/asset-register" target="_blank" rel="noopener noreferrer">Risk Assessment</a> for assets or asset groups is carried out as follows:</p><ol><li>Select Applicable Standards.</li><li>Identify Potential Risk Scenarios.</li><li>Link Implemented TOMs.</li><li>Assess Current Risk.</li><li>Define Suitable Treatment Options.</li><li>Create a Treatment Plan.</li><li>Reevaluate the Risk.</li></ol><p>This process helps ensure that asset-related risks are correctly identified, mitigated, and reviewed following the relevant standards.</p><h2>How the Priverion Platform collects information</h2><ul><li><strong>Assessments</strong>: Information is gathered through assessments. Create templates to send questionnaires and review the answers directly on the platform.</li><li><strong>Direct Input</strong>: Users manually enter data directly on the platform via input fields on the screen.</li><li><strong>External Integrations</strong>: The platform integrates with external tools like Jira to collect and sync relevant data from external systems automatically.</li></ul><p>This approach ensures data is collected efficiently through multiple channels: manual input, structured assessments, or integrated external systems.</p><p>&nbsp;</p><p>&nbsp;</p>

<h2>Overview</h2><p>The Record of Processing Activities (ROPA) forms the core of any data protection management system. It is required by both the Swiss Data Protection Act (FADP) and the European General Data Protection Regulation (GDPR).</p><p>It enables the traceable and complete documentation of all processing activities involving personal data within an organization.</p><p>According to the FADP, the following elements must be included:</p><ul><li>the identity of the data controllers</li><li>the purpose of the processing</li><li>a description of the categories of data subjects and categories of personal data being processed</li><li>the categories of recipients</li><li>if possible, the retention period of personal data or the criteria for determining this duration</li><li>if possible, a general description of the measures to ensure data security</li><li>If data is transferred abroad, what is the transfer country, and what are the guarantees for equivalent data protection levels?</li></ul><p>For the data processor, the following information must also be ensured:</p><ul><li>information on the identity of both the processor and the controller</li><li>information on the categories of processing carried out on behalf of the controller.</li></ul><p>The ROPA supports companies by enabling them to quickly and efficiently provide information during audits, in response to data protection inquiries (for example, from data subjects or financial supervisory authorities), or in cases of incidents such as data breaches. Thus, it is an essential instrument to ensure transparency and compliance with data protection regulations.</p><p>The overview page lists all your processing activities, divided by their status into <strong>All, Active</strong>, <strong>Draft</strong>, <strong>Inactive</strong>, and <strong>Review</strong>.</p><h2>Creating a new ROPA (without AI)</h2><p>As with every element, you can create the ROPA manually or download a shared one from the organization. This guide focuses on manual creation. To learn more about downloading elements, read the corresponding <a href="https://helpcenter.priverion.com/en/article/downloading-an-element"><u>guide</u></a>.</p><p>Click on <strong>Create</strong> and select <strong>Create ROPA</strong>.&nbsp;Provide the following information:</p><ul><li>Select the <strong>responsible person </strong>and set the <strong>status</strong>.</li><li><strong>Name </strong>the processing activity and briefly describe how the processing will occur.</li><li>Select the relevant <strong>organizational unit</strong>.</li><li>The<strong> type </strong>defines your role regarding the processing activity:<ul><li><i>Processor</i>: If you process personal data on behalf of another party, act in their name, and the processing serves them.</li><li><i>Controller</i>: If the processing serves you, you determine how and why the data is processed.</li><li><i>Joint Controller</i>: If you and another party jointly determine the purposes and means of the processing.</li><li>Note: If you categorize yourself as a <i>Processor</i>, specify the <i>Controller </i>in the following field. If you are unsure, consult your Data Protection Officer.</li></ul></li><li><strong>Classify </strong>the processing activity with an attribute. Attributes are an organizational aid.&nbsp;You can select one from the drop-down list or create a new attribute by typing it into the field and selecting it.</li><li>Select the <strong>applicable regulations</strong> relevant to this processing activity.</li><li>Set the<strong> target risk</strong>, ranging from <i>very low </i>to <i>very high</i>.</li><li><strong>Need To Process: </strong>Briefly describe why this processing is vital to your organization.</li><li><strong>Save </strong>your inputs.</li></ul><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.1226666666666665; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm0xukbc504dan9xp3va4r6mk?embed_v=2" loading="lazy" title="ROPA creation" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><h2>Managing your ROPA</h2><h3>General</h3><p>When you click on a particular processing activity, you will be provided with general information about that activity. To edit the general information, click the <strong>Edit</strong> button.&nbsp;<br>As with most elements, you may write notes by clicking the <strong>Notes </strong>button on the right or manage its <strong>Access</strong> and <strong>Sharing</strong> by clicking the three horizontal dots in the top right corner.&nbsp;<br>At the bottom of the screen, you can upload documents to your ROPA.</p><p>Click on the blue menu icon at the top left to expand or minimize the menu.</p><h3>Purpose of Processing</h3><p>On the <strong>Purpose of Processing tab</strong>, you will find all the linked purposes of the processing activity. A detailed description of the purposes is essential for data protection compliance.&nbsp;</p><ul><li>To link a purpose, click on the <strong>Add </strong>button.</li><li>On this page, you will find the library for all purposes. You can choose one or more purposes from the list or create a new one by clicking the <strong>Create</strong> button and then typing a description into the corresponding input box.</li><li>For each purpose, you can select the applicable regulations.</li></ul><h3>Need to Process</h3><p>The <strong>Need to Process tab</strong> describes why the processing is necessary. If you do not have a description yet or want to edit it, click the <strong>Edit </strong>button, enter the information, and save it.</p><p>This information is essential for appropriate data protection compliance. To be allowed to perform a processing activity, you must have reasonable needs.</p><h3>Affected People</h3><p>The <strong>Affected People tab </strong>lists the categories of people affected by the processing activity, such as customers or employees. Knowing whose data is being processed is essential under applicable data protection law.</p><p>You can <strong>Add</strong> categories of affected people by choosing from the existing library or creating a new one.</p><h3>Data Collection Points</h3><p>Documenting where the data has been collected is crucial to ensure transparency and information-sharing duties. These so-called <strong>Data Collection Points</strong>, or short DCPs, can be linked and managed under this tab.</p><p>When clicking the <strong>Add</strong> button, you may link existing DCPs with the specific processing activity or create a new one. To manage it, click on an existing DCP. To learn more about Data Collection Points, check out the <a href="https://helpcenter.priverion.com/en/article/data-collection-point"><u>guide</u>.</a></p><h3>Personal Data</h3><p>On the <strong>Personal Data tab</strong>, you will find the list of all the personal data categories linked to the processing activity.</p><p>It's essential to keep this list complete. Be sure not to leave out any personal data categories subject to the specific processing activity. Adding new elements works the same way described in the other tabs before.</p><h3>Special Categories</h3><p>Some processing activities may use <strong>Special Categories</strong> of personal data. Depending on what data protection law is applicable, Special Categories of personal data may have different definitions. In general, they are very sensitive data categories. Typical examples are genetic or biometric data.</p><p>This tab provides the Special Categories of data linked to the processing activity. Click the <strong>Add</strong> button to add or create new categories.</p><p>Note: When creating a new Special Category, you need to choose the applicable data protection regulation that stipulates the category as such. As mentioned above, not all data protection laws define Special Categories similarly. Consult your Data Protection Officer if you need clarification.</p><h3>Assets</h3><p>In addition to data protection as a legal aspect, information security constitutes technical data protection. Assets are part of the latter technical handling of the data. Assets are, therefore, everything that serves the processing of the data. This may be software or databanks, physical assets such as server centers, or safety measures like firewalls.</p><p>This tab lets you link all assets used for the specific processing activity. You may choose from existing assets by clicking the <strong>Add</strong> button or create a new one.</p><p>When clicking on an existing asset, you are directed to its managing page, where your assets are being complemented and managed. Manage a newly created Asset to fill in all necessary information.</p><p>Follow the Guide on the <a href="https://helpcenter.priverion.com/en/article/asset-register"><u>Asset Register</u></a> to learn more about it.</p><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.128342245989305; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm35uqs2f2036533hxrnw6b0t?embed_v=2" loading="lazy" title="ROPA edit" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><h2>Evaluate ROPA Risk</h2><h3>Risk Scenarios</h3><p>You can link all risk scenarios used for this processing activity on the <strong>Risk Scenarios tab</strong>.&nbsp;</p><ul><li>You can select from existing scenarios by clicking the <strong>Add</strong> button or creating a new scenario.&nbsp;</li><li>Then, click on each linked risk scenario to assess the current risk.&nbsp;</li><li>Enter the R<span style="color:rgb(25,35,50);">easons for Risk classification / Justification for risk assessment below.</span></li></ul><h3>TOMs</h3><p>Processing personal data requires the controller to protect this data accordingly. This is done by using appropriate technical and organizational measures, so-called TOMs.</p><p>The <strong>TOMs tab</strong> shows you all the TOMs linked to the processing activity. TOMs are implemented to prevent specific risks. &nbsp;All TOMs that you add there will then be listed in this tab.</p><p>Add TOMs:</p><ul><li>Click on the risk scenario</li><li>Select the corresponding TOMs from the library.&nbsp;</li><li>Assess the risk after mitigation.</li><li>Enter the R<span style="color:rgb(25,35,50);">easons for Risk classification / Justification for risk assessment below.</span></li></ul><p>Creating a TOM may be more elaborate than creating other elements of a processing activity. Be sure to study the guide on <a href="https://helpcenter.priverion.com/en/article/controls-technical-and-organizational-measures"><u>Controls &amp; TOMs</u></a> to include the necessary level of detail before creating a new one.</p><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.1226666666666665; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm112cfjw03j9t1hrsl5exgsm?embed_v=2" loading="lazy" title="Evaluate ROPA risk" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><h3>DPIA</h3><p>The DPIA tab provides the Data Protection Impact Assessments (DPIA) conducted for your processing activity. Usually, you won't need to add existing DPIAs to your processing activity, as DIPAs are explicitly conducted for processing activities.</p><p>If you want to create a DPIA or learn more about it, follow the corresponding <a href="https://helpcenter.priverion.com/en/article/data-protection-impact-assessments"><u>guide</u>.</a></p><h3>Internal Access</h3><p>To ensure integrity and confidentiality, limiting access to personal data and tracking who has access are essential. Linking the internal Organizational units partially fulfills this requirement.</p><p>The tab provides the list of units already linked and lets you add additional units by clicking the <strong>Add</strong> button. You may create new organizational units by clicking the <strong>Create</strong> button.</p><h3>Legal Basis</h3><p>Many data protection laws require you to base your processing activity on a legal basis when processing personal data. This is true for several laws, but not all. Generally, these legal bases are predefined in the according law. Therefore, specifying a legal basis and the applicable regulation for each processing activity is essential.</p><p>The tab shows the list of Legal Bases linked to the processing activity. You may click on the <strong>Add</strong> button if you wish to link new Legal Bases. When choosing the new elements, it's essential to note two things:</p><ul><li>First, you must select a legal basis that the applicable data protection law provides. For example, if you need to comply with the GDPR, you will need a Legal Basis recognized by the GDPR. The second column of the list will indicate which law the respective basis stems from.&nbsp;</li><li>Secondly, you will need a Legal Basis for each regulation that applies to your processing. For example, if you need to comply with the Korean PIPA and the GDPR, you must choose a legal basis for the PIPA and the GDPR. This is necessary as different regulations acknowledge different legal bases. Even though some legal bases sound the same, they might mean something different under the respective laws. That is, consent might be defined differently among various regulations. Of course, you must also fulfill all the requirements for each legal basis. If you need guidance on how to rely on a specific legal basis, consult your Data Protection Officer.</li></ul><p>Creating a new legal basis is also possible. However, be sure to get the necessary legal advice, as legal bases are generally enumerated and cannot be created freely.</p><h3>External Recipients</h3><p>It is essential to follow the "Data Flow" for several purposes. One ought to keep a record of where personal data comes from, what is being done to and with the data, and where it flows. Under the <strong>External Recipients tab</strong>, you will comply with the latter. The tab shows all the third-party recipients and lets you choose new ones with the <strong>Add </strong>button.</p><p>You must create a new one if an external recipient is missing in your library. The <a href="https://helpcenter.priverion.com/en/article/vendors"><u>Vendors</u></a> guide will help you with that.</p><h3>Retention &amp; Deletion</h3><p>In general, there is a limit to how long personal data may be stored or processed. Of course, the retention and deletion periods depend on the nature of the personal data and the processing activity. The <strong>Retention &amp; Deletion tab</strong> shows all the necessary periods linked to the processing activity. If you wish to add new ones, click the <strong>Add</strong> button. If the period you are looking for is already in your library, you may choose it there. Otherwise, you may need to create a new period. If you possess the Retention &amp; Deletion periods databank, you may search for a specific period there. Otherwise, you need to create a period manually.</p><p>The <a href="https://helpcenter.priverion.com/en/article/retentions-deletions-periods"><u>Retention and Deletion Periods</u></a><strong> </strong>guide will provide more information about creating new periods.</p><h3>Tasks</h3><p>The <strong>Tasks</strong> tab contains the tasks linked to your current processing activity. To link a task to the processing activity, click the Add button to select one from the library or create a new one. To learn more, follow the steps in the <a href="https://helpcenter.priverion.com/en/article/tasks"><u>Tasks guide</u>.</a></p><h3>Assessments</h3><p>Using the assessments, you can have people responsible for the processing activity answer questionnaires to collect and document relevant information on the processing activity and how it is handled. Hence, the assessments are an important tool for reviewing your status and developments in the processing activity.</p><p>If you have already created an assessment, click the <strong>Add</strong> button and choose the ones you want to link. Otherwise, you may create new ones by clicking the <strong>Create</strong> button. Follow the <a href="https://helpcenter.priverion.com/en/article/create-and-evaluate-assessments"><u>Assessments guide</u></a> to learn more.</p><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.128342245989305; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm35v89nw20dm533hpfdbdccp?embed_v=2" loading="lazy" title="ROPA edit 2" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><p><br>​</p>

<h2>Overview</h2><p>In many cases, companies engage third parties to process data either on their behalf or in collaboration with them. To clearly document data flows and access to this information, the Priverion platform offers the <strong>Vendor Management</strong>.</p><p>Organize existing vendors efficiently, add new vendors, and record <strong>Sub-Vendors</strong> (so-called <strong>Downstream Processors)</strong> employed by your primary vendors for data processing. This lets you maintain an overview of your external partners and their roles in your data processing activities.</p><p>The overview divides your vendors into categories: <strong>All, Active, Draft, Inactive, Review,</strong> and <strong>Downstream Processors.</strong> This structure enables clear organization and targeted management.</p><ul><li><strong>Add new vendors:</strong> Use the <strong>Create</strong> button to add new vendors.</li><li><strong>Edit existing vendors:</strong> Click on a vendor to view or update their details.</li></ul><h2>Creating new Vendors</h2><h3>Contact Details and Regulation</h3><p>As with every element, you can create the vendor manually or download a shared one from the organization. This guide focuses on manual creation. If you would like to learn more about downloading elements, you can just read the corresponding <a href="https://helpcenter.priverion.com/en/article/downloading-an-element" target="_blank" rel="noopener noreferrer">guide</a>.</p><p>Click on <strong>Create</strong> and select the option <strong>Create Vendor</strong>. Enter the required information:</p><ul><li>Assign a <strong>responsible person</strong> from your team.</li><li>Select the current <strong>status</strong>.</li><li>Enter the <strong>vendor’s name</strong>.</li><li>Provide their <strong>complete address</strong>, including city, and select the corresponding <strong>country</strong>.</li><li>Select the <strong>applicable regulations</strong> for the vendor based on the countries where they operate.</li><li><strong>Type:</strong> You must define the vendor's role concerning the processing activity. In practice, this distinction can be complex. If in doubt, consult your Data Protection Officer.<ul><li><strong>Processor:</strong> If the processing serves your organization and you determine how and why the data is processed, the vendor is categorized as a Processor.</li><li><strong>Controller:</strong> If they process personal data for their purposes, their role is that of a Controller.</li><li><strong>Processor &amp; Controller:</strong> Some vendors act as controllers and processors for different processing activities or data. In this case, you should label them as Processor &amp; Controller.</li><li><strong>Joint Controller:</strong> If you and the vendor jointly determine the purposes and means of the processing, select Joint Controller.</li><li><strong>Other:</strong> Use this category if none of the above apply.</li></ul></li><li><strong>Classification:</strong> This is purely for internal organization and is flexible. Select an existing classification attribute from the drop-down menu or create a new one by typing it into the field and selecting it.</li><li><strong>Description:</strong> Describe who the vendor is and their specific tasks, particularly regarding processing your data.</li><li><strong>Reason for sharing:</strong> Specify why you are sharing data with this vendor. Be as precise as possible.</li><li><strong>Representatives and DPO:</strong> You can also provide details of the vendor’s representatives in other countries. Include their contact details if the vendor’s Data Protection Officer (DPO) is known.</li><li><strong>Contract duration:</strong> Lastly, if applicable, you can specify the contract’s expiration date with the vendor.</li><li>Click <strong>Save</strong> once all the required information has been entered.</li></ul><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.1226666666666665; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm0ye5d2103yey2bfu42k4td1?embed_v=2" loading="lazy" title="Create Vendor" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><h2>Managing existing Vendors</h2><p>Click on an existing vendor to manage it.</p><h3>General</h3><p>&nbsp;As with most elements, you may write notes by clicking the <strong>Notes </strong>button on the right or manage its <strong>Access</strong> by clicking the three horizontal dots in the top right corner.</p><p>The <strong>General</strong> page displays the information entered during the vendor creation. You can edit this information by clicking on <strong>Edit</strong>.</p><h3>Documents</h3><p>The <strong>Documents</strong> tab lists all documents uploaded for the vendor, such as the main contract, a data protection agreement, documentation of implemented TOMs, and general terms and conditions. All relevant vendor-related documents should be linked here.</p><ul><li>Use <strong>Add</strong> to select documents from your library.</li><li>Select all relevant documents.</li><li>If the required document is not yet in the library, you can create it by selecting <strong>Create</strong>.</li><li>Click <strong>Add to list</strong> to finalize the selection.</li></ul><p>For more details, refer to the guide on <a href="https://helpcenter.priverion.com/en/article/documents-policies"><u>Documents and Policies</u></a>.</p><h3>Criticality</h3><p>The <strong>Criticality</strong> tab allows you to document how vital the vendor is for your organization and its data processing activities. You can update this information by clicking <strong>Edit</strong>.</p><p>Using a 5-point scale ranging from <i>very low</i> to <i>very high</i>, you can assess:</p><ul><li><strong>Material Impact</strong>: Refers to the actual consequences or effects of the vendor’s actions on your organization. As a data controller, you are accountable for the actions of your processors. The material impact depends on the tasks the vendor performs.</li><li><strong>Criticality of Service</strong>: Evaluates the importance or necessity of the services provided by the vendor. This assesses how crucial the vendor's processing activities are for achieving your objectives and requirements.</li><li><strong>Overall Criticality</strong>: Represents the vendor's overall significance to your business operations. This considers various factors, such as the service itself, the volume of data processed, the sensitivity of the data, and the potential impact of a data breach.</li></ul><h3>Assets</h3><p>Under the next tab, you can link all assets associated with the vendor. The process is the same as adding documents.</p><h3>Transfers</h3><p>Since it is common for data processors to engage sub-vendors, it is important to document where data flows. The <strong>Transfers</strong> tab provides an overview of all Sub-Vendors the vendor uses to process your data.</p><p>To link new Sub-Vendors:</p><ul><li>Click <strong>Add</strong> and select the relevant vendor from the library.</li><li>To create a new vendor, click <strong>Create</strong>. The process is identical to creating regular vendors.</li></ul><p>Once you have selected the vendors and clicked <strong>Next</strong>, you will be prompted to specify a legal basis for transferring data. For each Sub-Vendor, select the applicable legal basis.</p><p>If you need assistance determining the appropriate legal basis, consult your Data Protection Officer.</p><h3>Tasks</h3><p>The <strong>Tasks</strong> tab lists all tasks associated with this vendor. To link a new task to the vendor:</p><ul><li>Click <strong>Add</strong> and select a task from the library, or</li><li>Create a new task by clicking <strong>Create</strong> afterward.</li></ul><p>To learn more, follow the steps in the <a href="https://helpcenter.priverion.com/en/article/tasks"><u>Tasks guide</u></a>.</p><h3>Assessments</h3><p>Assessments are crucial for documenting vendors. If you have conducted an assessment, you can add it to this tab by clicking <strong>Add</strong>. You can also create new assessments by clicking <strong>Create</strong> afterward.&nbsp;</p><p>To learn more, follow the guide about <a href="https://helpcenter.priverion.com/en/article/create-and-evaluate-assessments"><u>Assessments</u>.</a></p><h3>Workflow</h3><p>The <strong>Workflow</strong> tab lets you view required actions or trigger a new workflow.</p><div class="raw-html-embed"><div style="position: relative; box-sizing: content-box; max-height: 80vh; max-height: 80svh; width: 100%; aspect-ratio: 2.128342245989305; padding: 40px 0 40px 0;"><iframe src="https://app.supademo.com/embed/cm4h6kusy1y48ifugtk6y7uit?embed_v=2" loading="lazy" title="Edit vendor" allow="clipboard-write" frameborder="0" webkitallowfullscreen="true" mozallowfullscreen="true" allowfullscreen="" style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"></iframe></div></div><p>&nbsp;</p><p><br>​</p><p><br>&nbsp;</p>

Was this article helpful?

You recently requested to reset your password for your account. Use the button below to reset it. This password reset is only valid for the next 24 hours.

If you’re having trouble with the button above, copy and paste the URL below into your web browser.

Please check your email for instructions to reset your password.

Check your email

Enter your email address and we will send you instructions to reset your password.

Please enter a new password below.

Set your password

Help Center