Roles, responsibilities and notifications
When a user is created in the IT settings, one or more roles can be assigned to them. Depending on the role, users have different rights within the Priverion platform. We will go into this in more detail in this article.
Create a new user
In the IT Settings, under the User Management tab, you will see a list of all users of your Priverion platform. You can edit their details by clicking on an individual user or create a new user login by clicking the Create button. When creating a user, you enter their name and email. If you want to notify the user of his new account and ask him to set a password, select send invite per email. The telephone number is optional. Finally, you assign roles to this user.
Roles
While all registered users (who by default have the employee role) can access the dashboard and user settings and view the dashboard charts, other rights are restricted to specific roles. An additional distinction is made between read-only or read-and-write rights. Below, we provide a list of the rights for each role. You can create new roles under IT Settings > Roles. Name the role and assign permissions by selecting the appropriate checkboxes. Once done, Save your input.
If you want to give access (read or write) to a specific element (such as a ROPA, Vendor, etc.), you can do this via the Manage Access menu in each element on the upper right (the three ...). You can also create audiences for this. Learn more here.
Here is a summary PDF of the roles: PRIVERION Platform Roles
Data Protection Manager
| Access to dashboard | Data subject request: read |
| User settings | Assessment builder: read |
| Dashboard charts: read | Compliance settings: write, read |
| Data protection impact assessment: write, read | Sharing: write, read |
| Process risk: read | Notifications: write, read |
| Projects: write, read | Organizational units: write, read |
| Documents & Policies: write, read | Tags: write, read |
| Assessments: write, read | Applicable laws: write, read |
| TOMs: write, read | Audiences: write, read |
| International standards: write, read | IT settings: write, read |
| Report Explorer: write, read | Active Directory: write, read |
| ROPA: write, read | Language: write, read |
| Vendors: write, read | User management: write, read |
| Legitimate interest documentation: write, read | Risk settings: write, read |
| Meetings & Activities: write, read | Risk scenarios: write, read |
| Retentions & Deletions: write, read | Personal data: write, read |
| Data collection points: write, read | Notes: write, read |
| Tasks: write, read |
Data Protection Coordinator
| Access to dashboard | Vendors: write, read |
| User settings | Legitimate interest documentation: write, read |
| Dashboard charts: read | Meetings & Activities: write, read |
| Data protection impact assessment: write, read | Retentions & Deletions: write, rad |
| Process risk: read | Data collection points: write, read |
| Projects: write, read | Tasks: write, read |
| Documents & Policies: write, read | Assessment builder: read |
| Assessments: write, read | Risk settings: write, read |
| TOMs: write, read | Risk scenarios: write, read |
| Asset register: write, read | Personal data: write, read |
| International standards: write, read | Audiences: write, read (but no permissions to enter IT settings) |
| ROPA: write, read | Notes: write, read |
IT Administrator
| Access to dashboard | Language: write, read |
| User settings | User management: write, read |
| Dashboard charts: read | Personal data: write, read |
| IT settings: write, read | Notes: write, read |
| Active Directory: write, read |
IT Security Manager
| Access to dashboard | Data collection points: write, read |
| User settings | Tasks: write, read |
| Dashboard charts: read | Data subject request: read |
| Data Protection Impact Assessment: write, read | Assessment builder: read |
| Process risk: read | Compliance settings: write, read |
| Projects: write, read | Notifications: write, read |
| Risk settings: write, read | Organizational units: write, read |
| Risk scenarios: write, read | Tags: write, read |
| Documents & Policies: write, read | Applicable laws: write, read |
| Assessments: write, read | Companies: write, read |
| TOMs: write, read | IT settings: |
| Assets register: write, read | Active Directory: write, read |
| International standards: write, read | Language: write, read |
| ROPA: write, read | User management: write, read |
| Vendors: write, read | Personal data: write, read |
| Legitimate interest documentation: write, read | Notes: write, read |
| Meetings & Activities: write, read | Report Explorer: write, read |
| Retentions & Deletions: write, read |
IT Security Coordinator
| Access to dashboard | International standards: write, read |
| User settings | Vendors: write, read |
| Dashboard charts: read | Meetings & Activities: write, read |
| Projects: write, read | Tasks: write, read |
| Documents & Policies: write, read | Assessment builder: read |
| Assessments: write, read | Risk settings: write, read |
| TOMs: write, read | Personal data: write, read |
| Assets register: write, read | Notes: write, read |
Employee
| Access to dashboard | Dashboard charts: read |
| User settings | Any Element: write, read. If the element is assigned to the user as responsible person or if the user is assigned to an audience which has read or write access to the element. |