Privacy Assessment
The reason for performing a Privacy Assessment is to ensure compliance with GDPR, which requires companies to meet data protection and privacy standards when operating in the EU or handling data of EU residents. If your company is based in the EU or serves EU customers, GDPR compliance is mandatory. Conducting an annual Privacy assessment helps identify any compliance gaps and allows you to address them proactively. This ongoing process ensures your business meets GDPR standards by regularly updating data protection practices and it helps identify emerging risks, regulatory changes, or shifts in operations that could affect your compliance.
Step 1: Conduct the Privacy Assessment
The Data Protection Officer (DPO) or Privacy Officer (PO) is responsible for leading the Privacy Assessment and must collaborate with relevant stakeholders to review the results.
To begin, use the Privacy Assessment template, which can be accessed in the Compleye Online Templates Section. This template includes a series of questions designed to help identify compliance gaps within your organization. It is provided in Excel format and consists of two tabs: the Data Processor Checklist and the Data Controller Checklist. Before starting the assessment, it is essential to identify the categories of personal data you handle and clarify your organization’s role in processing data, whether as a Data Processor, Data Controller, or Joint Controller. These roles may vary depending on the type of personal data processed and the scope of processing activities defined by your business model, as outlined by the GDPR, for example If your business is a B2B SaaS provider with employees, you are likely both a Processor (for Customer Data) and a Controller (for HR and Marketing Data).
For a more detailed explanation of each of these roles, please refer to the following:
A Data Processor is an entity that processes personal data on behalf of the Data Controller. The Data Processor acts under the instruction of the Data Controller and does not make decisions about the data processing. Typically, this role applies to external services or third-party vendors that handle personal data, such as cloud service providers, payroll companies, or email marketing platforms.
Example: A company that provides a cloud storage service where an organization stores customer data would be considered a Data Processor.
A Data Controller is the entity that determines the purposes and means of processing personal data. The Data Controller is responsible for ensuring that the personal data is processed in compliance with applicable laws, including obtaining consent where necessary and ensuring data subject rights are respected.
Example: A company that collects customer data to process orders and send marketing communications would be a Data Controller.
A Joint Controller is when two or more entities jointly determine the purposes and means of processing personal data. This role occurs when multiple parties collaborate in processing personal data and share responsibilities for compliance with data protection laws. The relationship between Joint Controllers must be clearly defined in a transparent arrangement, often in the form of a written agreement that specifies each party’s responsibilities.
Example: Two companies that jointly run a marketing campaign and share customer data to target specific advertisements could be considered Joint Controllers.
After completing the assessment, communicate and review the results with relevant stakeholders. Management or C-level executives must then approve the findings and proposed improvements.
Step 2: Address the Findings
After completing the assessment, focus on addressing the identified findings and implementing the necessary improvements. The findings should be documented and tracked for resolution, ensuring compliance with GDPR standards.
Step 6: Approvals and Follow-up
Once the Privacy Assessment has been reviewed and updated, it must be approved by the relevant stakeholders.
Now that the Privacy Assessment has been completed, the next crucial step is to process the findings and convert them into actionable improvements. This final step is typically handled by a Data Protection Officer (DPO) and Privacy Officer (PO) to ensure that all gaps and weaknesses identified during the assessment are properly addressed.
To begin, click the ‘Create New Assessment’ button located at the bottom-left of the page.
Once you click the ‘Create New Assessment’ button, a new tab will open where you can upload the assessment. Please note that once the document is attached, it cannot be deleted but can only be downloaded. The Privacy Assessment card will be automatically named based on the date it was uploaded. You have the option to upload multiple documents; however, it is important to upload the main Privacy Assessment first to ensure proper organization and clarity.
After creating the Privacy Assessment, you can proceed to add the findings. Additionally, you have the option to attach other relevant documents in the ‘Attachments’ tab. While this step is not mandatory, attaching supporting materials can be helpful for reference and further clarification of the findings and improvements.
Once every field is addressed, you can click the ‘Create Improvement’ button. This will automatically generate an improvement with a unique ID in the ‘Improvements Section’. Additionally, it will be displayed in the section with the status ‘Improvement has been created’. This ensures that the improvement is officially tracked and visible for further follow-up and action.
Once the improvement is closed, it will be indicated by a green check-box tick in the tab, along with the date it was closed and the person who closed the improvement. It’s important to remember that with every new Privacy Assessment performed, you must verify if the previous findings have been addressed. Therefore, before starting the next assessment, ensure that all the findings from the previous assessment have been resolved and marked as closed improvements.
