Step-by-Step Onboarding Guide: PIA & DPIA Automation

Getting up and running with your PIA & DPIA Automation solution

The OneTrust PIA & DPIA Automation module is implemented to provide you with a means of capturing information from assessment recipients within the organization to support business processes such as Data Mapping and Privacy Risk Assessment. Specific Assessments may address Privacy Impact Assessments (PIAs), Data Protection Impact Assessments (DPIAs), Data Privacy Assessments (DPAs), and Privacy by Design (PbD).

Key benefits:

  • Seamless integration with the Data Mapping module, allowing for a holistic approach to your privacy program

  • Designed for re-assessment and continued monitoring, ensuring your privacy program remains up-to-date

  • Supports the creation of a comprehensive and current Data Map, contributing to overall privacy program maturity

Let’s get you started



Before you begin

Before you get started with your implementation, complete the following key-activities which will help you accelerate your implementation:

  1. Assign Key Decision Makers

    During an implementation, there will be many configuration and process decisions that need to be made. Identifying key roles ensures accountability and efficient decision-making.

    Recommended roles:

    • Key Decision Maker: Main point of contact responsible for configuration and setting decisions

    • Privacy Champion/Expert: Understands regulatory requirements and liaises with different business areas

    • Super User (OneTrust Site Admin): Oversees configuration, troubleshoots errors, and controls user access

    • Testing Group: Representatives from various departments who will use the tool daily

    Example:

    • Key Decision Maker: Chief Privacy Officer (CPO)

    • Privacy Champion: Senior Privacy Analyst

    • Super User: IT Security Manager

    • Testing Group: Representatives from Legal, Marketing, and Customer Service departments

    Identified individuals should take the guided hands on lab and available certification.

  2. Understand Requirements

    It’s crucial to understand your organization's specific needs and regulatory requirements. This understanding will help you make informed decisions during the implementation process.

    Key considerations:

    • Respondents: Who will be completing the assessments? (e.g., Product Managers, IT Directors, Data Analysts) Why it matters: Engaging with these stakeholders early ensures they understand their role and responsibilities.

    • Data Entry Points: What are your key data collection points? (e.g., New product launches, changes to existing processes, vendor onboarding) Why it matters: Identifying these points helps in designing effective assessment templates and workflows.

    • Approvers: Who will review and approve the assessments? (e.g., Legal team, Data Protection Officer) Why it matters: Ensures the right people are involved in the decision-making process and helps in capacity planning.

    • Organization Structure: How is your organization structured? (e.g., By geographical region or business unit) Why it matters: Helps in setting up appropriate workflows and access controls.

    • Risk Assessment: How will you define and assess privacy risks? Why it matters: Aligns risk assessment with your organization's risk appetite and ensures consistent evaluation.

    • Reporting Needs: What metrics and information do you need to extract from the system? Why it matters: Helps in configuring the right reports and dashboards for effective program management and demonstrating compliance.

    Example: A global pharmaceutical company might identify the following:

    • Respondents: Clinical Trial Managers, Data Scientists, IT Security Leads

    • Data Entry Points: New drug trials, patient data collection processes, research collaborations

    • Approvers: Ethics Committee, Data Protection Officer, Legal Department

    • Organization Structure: By research division and geographical region

    • Risk Assessment: Focus on patient data protection, regulatory compliance, and reputational risks

    • Reporting Needs: Compliance status by region, risk trends in clinical trials, data minimization effectiveness

PIA & DPIA Automation Configuration

You can access all our knowledge base articles at the link here. The steps below direct you to the most relevant way to get started as quickly as possible.

Step 1: Review and Select Templates

OneTrust provides a variety of templates available in the template gallery. These templates are regularly updated by our in-house legal team to reflect the latest regulatory requirements.

Available template categories:

  • Business Functions (e.g., Processing Activity Creation, Asset Discovery, Privacy by Design Review)

  • Regions or Regulations (e.g., GDPR, UK ICO, CPRA, LGPD, PDPL)

  • Legislative Requirements (e.g., PIA/DPIA, LIAs, TIAs)

Note:

Additional templates are available in other OneTrust modules, such as Vendor Onboarding or NIST Framework assessments in the GRC Cloud.

Example: A financial services company might select the following templates:

  1. GDPR DPIA template for new financial products

  2. CCPA Processing Activity Inventory for US operations

  3. Privacy by Design Review for digital banking initiatives

If there is not a template that quite fits your organization’s needs, you can create your own custom template (more details on this in the next step).

Step 2: Customize Templates

Once you've selected a template, you can customize it to fit your organization's specific needs. Key customization areas include:

A) Questions

  • Add, edit, reorder, or delete questions to align with your assessment needs.

  • Pay special attention to Personal Data questions, which link to the Data Mapping module.

Example: Add a question about data retention periods for each data element collected.

B) Inventory Record Links

  • Create connections between your PIA/DPIA and Data Mapping modules.

  • This step is crucial for maintaining a holistic view of your privacy program.

Example: Link a new mobile app PIA to the relevant processing activities and IT assets in your data inventory

C) Rules

  • Set up automated actions based on assessment responses.

  • Rules can trigger tasks, flag risks, or initiate additional assessments.

Example: Create a rule that automatically flags a high risk if sensitive data is processed without encryption.

D) Show/Skip Conditions

  • Use conditional logic to create an efficient user journey.

  • Only show relevant questions based on previous answers.

Example: Only show questions about international data transfers if the respondent indicates data will be transferred outside the country.

Resources:

Step 3: Configure Risk Settings

Accurate risk flagging is essential for effective privacy risk management. OneTrust supports one scoring methodology, so it's important to align this with your organization's risk assessment approach.

Key steps:

  1. Review and customize risk settings

  2. Define risk owners and approvers

  3. Set up risk rules within assessments

Example: An e-commerce platform sets up the following risk criteria:

  • Impact Levels: Low (1-3), Medium (4-6), High (7-9)

  • Likelihood Levels: Unlikely (1), Possible (2), Likely (3)

  • Risk Calculation: Impact x Likelihood

  • Risk Thresholds: Low Risk (1-6), Medium Risk (7-12), High Risk (13-27)

Note:

Work with your IT and Procurement teams to ensure the risk methodology aligns with other risk assessment processes in your organization.

Resources:

Step 4: Launch Assessments

Once your templates and risk settings are configured, you can launch assessments. There are three main methods:

Example: A retail company launches a PIA for a new customer loyalty program:

  1. Creates the assessment using a customized GDPR PIA template.

  2. Links the assessment to relevant inventory records (e.g., customer database, marketing systems).

  3. Assigns sections to different respondents (e.g., Marketing team for data collection, IT for security measures).

  4. Sets up automated reminders for respondents and approvers.

Resources:

Step 5: Manage the Assessment Process

Once assessments are launched, you'll need to manage the process from response collection to approval.

Key steps:

  1. Monitor respondent progress

  2. Review submitted assessments

  3. Flag risks manually if needed

  4. Link assessments to inventory records

  5. Approve or request changes

Example: For the retail company's loyalty program PIA:

  1. Send reminder emails to Marketing and IT teams to complete their sections.

  2. Privacy team reviews the submitted assessment, identifying two medium risks.

  3. Manually flag an additional risk related to data retention periods.

  4. Link the assessment to the newly created loyalty program processing activity.

  5. DPO reviews and approves the assessment with recommendations for risk mitigation.

Resources:

Step 6: Reporting and Continuous Monitoring

Leverage the reporting capabilities to gain insights into your PIA/DPIA process and maintain ongoing compliance.

Key reports and monitoring activities:

  1. Assessment status and completion rates

  2. Risk trends and mitigation progress

  3. Compliance status across different regulations

  4. Re-assessment scheduling based on defined criteria

Example: A multinational corporation creates a monthly privacy program dashboard showing:

  1. Number of PIAs/DPIAs completed, in progress, and overdue

  2. Top 5 identified risks and their mitigation status

  3. Compliance rate with GDPR Article 35 requirements

  4. Upcoming re-assessments for high-risk processing activities

Resources:

Complete!

Congratulations on completing your implementation.

By following this comprehensive guide and adapting the examples to your organization's specific needs, you'll be well-equipped to implement a robust PIA & DPIA Automation process. Remember to regularly review and update your assessment templates, workflows, and risk criteria to ensure ongoing compliance and effectiveness of your privacy program.

The integration between the PIA & DPIA Automation and Data Mapping modules allows for a holistic approach to privacy management. By leveraging automated workflows and continuous monitoring, you can maintain an up-to-date and comprehensive view of your data processing activities and associated risks