A Significant Data Fiduciary must assess; everyone else should before a risky new purpose. In Nyvika an assessment is attached to the real purposes, stores and processors it covers, so it is never a document nobody can find.
A DPIA written as a document in a shared folder is complete on the day it is signed and wrong a month later. The Act expects it to describe the processing as it actually is.
Choose what the assessment covers, answer the questionnaire, assign the mitigations, submit for review.
An assessment names the purposes, data stores and processors it covers, drawn from the registers.
Necessity, proportionality, security, rights, transfers and children's data, scored to a risk level.
Each risk gets a mitigation, an owner and a status.
Draft, submitted, approved or returned, with the reviewer recorded.
Every module writes to the same registers and the same hash-chained evidence, so nothing is re-keyed and nothing is lost between teams.
The purposes an assessment covers are the ones on your notice.
See notice & consent →Stores and their findings give the assessment its data categories.
See data discovery →Processors in scope bring their agreement and review status with them.
See processors & connectors →The Act only mandates it for SDFs. It is still the clearest way to show reasonable safeguards for a new or risky purpose, and the questionnaire takes an hour, not a week.
No. The questionnaire is fixed and documented, and the scoring is transparent. Your team answers from knowledge of the processing, which is what a reviewer wants to see.
Not in this release. The questionnaire covers the elements a DPIA under the Rules is expected to, and notes on each answer hold the detail your template would.
Still have a question? Write to us.
In the demo we open an assessment on one of your purposes and score it with your team in the room.