PIA & DPIA Automation Overview

Introduction to PIA & DPIA Automation

Increasing personal data collection, frequent breaches, and cross-border data transfers continue to drive complexity across global privacy regulations. Regulations including the GDPR and CPRA, require organizations to perform privacy impact, transfer impact, legitimate interest, and other types of assessments to understand the risks of their personal data use. Moreover, privacy risk assessments serve as a foundational component for privacy programs to enable audit readiness, accelerate certifications, and provide supporting documentation for regulators and other stakeholders. Mitigating privacy risk without automation and a dedicated tool, these assessments are time-intensive and nearly impossible to perform at scale.

The OneTrust PIA & DPIA Automation solution enables organizations to consolidate information from internal and external stakeholders to gain both a technical and contextual understanding of how data is collected, the purpose for which it’s being used, where the data is located and what protections are in place.

PIA & DPIA Automation is part of the Privacy & Data Protection cloud with OneTrust. To learn more, see the PIA & DPIA Automation knowledge base.

Note:

For a demo on PIA & DPIA Automation, watch the video here.

Module Benefits:

Enables organizations to understand the context related to their personal data collection, storage, and use
Powered by OneTrust DataGuidance®, a database of global privacy laws, that backs dozens of built-in assessment templates and automated mitigation recommendations
The tool scales and supports multiple languages, enabling you to maintain all the records you need to demonstrate compliance with global laws

Problems Solved by PIA & DPIA Automation:

Simplify Assessments: : Get assessments done faster with automated workflows, pre-built templates, and integration into existing productivity tools
Demonstrate Compliance & Value: : Get real-time insights and analytics to demonstrate compliance to regulators and generate metrics to show the value of your program to boards and executives.
Establish Efficient Workflows: : Implement threshold assessments to determine if PIA's are necessary, and automatically escalate PIA's with high risk to DPIAs. Set specific conditions to automatically flag risks based on specific responses. Integrate OneTrust with SaaS tools like Jira to automatically deploy assessments to internal stakeholders when updates are most relevant
Save time on ad-hoc privacy requests: : Choose from over 250 templates: including PIAs, DPIAs, vendor risk assessments, readiness checklists, and security assessments. OneTrust enables customizations like incorporating business-friendly language and helpful tips

Typical Users

Admins or key users of PIA & DPIA Automation would report to or have the following titles:

Data Protection Officer
Chief Information Officer
Chief Risk Officer
Chief Compliance Officer
Chief Ethics & Compliance Officer
Chief Legal Officer
Chief Privacy Officer
Chief Data Officer
Privacy Manager
Privacy Program Manager
General Counsel
Privacy Analyst

PIA & DPIA Automation Module Terminology


PIA & DPIA Automation Terminology	Terminology Context/Definition
Templates	Questionnaire document formatted based on laws and frameworks, geographic location, or other categories such as finance, health, privacy, security, ethics, and more. Comes in either a pre-set format in the OneTrust template gallery or can be custom-made.
Risks	Threats and vulnerabilities the organization faces when processing data.
SIG (Standardized Information Gathering questionnaire)	The SIG is a configurable questionnaire that enables the scoping of risk domains using a comprehensive set of questions to assess at-hand risks.
PIA (Privacy Impact Assessment)	A questionnaire that’s used to identify and help reduce privacy risks. They're fundamental to evaluating an organization's privacy activities, and mitigating risks as efficiently as possible. It is a useful tool that is often mandatory for privacy compliance.
DPIA (Data Protection Impact Assessment)	A requirement under a growing number of privacy and data protection laws when introducing new data processing processes, systems, and technology. These are often associated with Article 35 of the GDPR (General Data Protection Regulation) in terms of processing personal data using automated means of decision making, processing personal categories of data on a large scale or if systematic public monitoring has been conducted.

Framework Examples

OneTrust PIA & DPIA Automation provides a solution that can help organizations fulfill the requirements to comply with many frameworks and laws. Below is a list of some of the popular privacy and legal frameworks that this module can help with.


Framework	Framework Description
GDPR	The GDPR is the strongest global privacy law in effect today. Created by the European Union (EU) to regulate how organizations collect, handle, and protect personal data of EU residents. It also defines eight data subject rights that guarantee specific entitlements for individual’s personal data. Ultimately giving individuals more autonomy over their personal information and how it is used. Article 35 requires the controller to carry out a Data Protection Impact Assessment (DPIA) when a certain processing operation (or a set of operations with similar attributes) presents a high risk to the rights and freedoms of natural persons Note: To learn more about the GDPR Framework, read our blog post here.
CCPA	CCPA compliance means that covered businesses – for-profit entities that fall under the scope of the CCPA – can demonstrably meet obligations set out under the CCPA, including a range of new consumer rights, a new definition of personal information, and new concepts of businesses and service providers in relation to the roles of controller and processor. Note: To learn more about the CCPA Framework, read our blog post here.
LGPD	Brazil passed its General Personal Data Protection Law (LGPD) in 2018. The legislation establishes and protects the rights and freedoms of individuals and provides increased transparency to covered data subjects. The law contains unique definitions of personal data and their authorized uses that count on enforcement by the Brazilian Data Protection Authority (ANPD). Similar to the GDPR, the LGPD, or Lei Geral de Proteção de Dados, applies to the processing of data by organizations within Brazil, but also to organizations outside Brazil under certain circumstances. LGPD compliance provides significant benefits to data subjects who will be afforded new rights. Note: To learn more about the LGPD Framework, read our blog post here

Relationship in OneTrust Platform

PIA & DPIA Automation can integrate with other OneTrust modules to enable enhanced features:

Data Mapping: : Specific assessments may address Privacy Impact Assessments (PIAs), Data Protection Impact Assessments (DPIAs), Data Privacy Assessments (DPAs) and Privacy by Design (PbD). Assessment data (where appropriate) may be transferred to, update or create inventory records within the Data Mapping Module.
Third-Party Risk Management (TPRM): : Privacy-type assessments launched via TPRM are sometimes seen within the 'active' assessments page in PIA & DPIA Automation.
IT & Security Risk Management (ITRM): : Privacy-type assessments launched via ITRM are sometimes seen within the 'active' assessments page in PIA & DPIA Automation.

Privacy Professional