Create a privacy assessment

Create various types of assessments and send those assessments to the business process or business application owners to collect their responses. The responses help you to understand how personal information (PI) is being used or stored in a processing activity.

Before you begin

Role required: sn_privacy.admin and sn_privacy.manager

About this task

Using the privacy assessment capability, you can create various types of assessments such as privacy screening initial assessments, privacy impact assessments (PIA), and privacy readiness assessments.

The following capabilities are provided to configure the assessments:

• Mapping control objectives to the responses of the question.
• Mapping information objects to the responses of the question.
• Mapping the processing activity fields to the responses of the questions.

While configuring the assessments, consider the following terminology:

• Metric type refers to the assessment template.
• Metric category refers to the section label in the assessment.
• Metric refers to a question.

Procedure

1. Navigate to All > Privacy Management > New Assessment Template.
2. On the form, fill in the fields.

   Table 1. Assessment Metric Type form

   Field	Description
   Name	Name of the assessment template.
   Assessment duration	Length of time allowed for completing the assessment from the time the assessment is generated.
   Table	Table that contains the records.
   Auto approve privacy assessment tasks	Option to indicate that the privacy assessment tasks must be automatically approved without a review. When this option is selected, after the assessment task is submitted, automatically the assessment task is approved and controls, risks and the information objects are created on the processing activity, and the task is closed.
   State	State of the assessment. This field is automatically set to Draft.
   Roles	Roles that have read access to the template.
   Classification	Classification of assessment metric type. The choices are the following: None Initial Assessment PIA Assessment
   Description	Purpose of the assessment template and the reason for its creation.
   Introduction	Guidance text for business users who respond to the assessment.

3. Click Save and Open Designer.
   The designer contains the following elements.

   Element	Description
   Controls	Supported question data types that are available in the Controls palette.
   Questions	Library of questions for various categories.
   Categories	New assessment opens in the Design view. The questionnaire Name field appears above the first category in the canvas. An empty question field appears in the category container.

4. Drag a control on the designer canvas to create a question of that type.

   The canvas contains the following types of questions controls.

   Table 2. Question controls

   Data type	Description
   Attachment	Questions that enable users to attach one or more files as a response.
   Boolean	Questions with the following value types: A check box to select or clear. A Yes or No answer.
   Choice	Questions with a list of predefined options.
   Date	Date field. Enables you to collect the date information filled in by a respondent.
   Date/Time	Date and time field. Enables you to collect the date and time information filled in by a respondent.
   Number	Number field with predefined minimum and maximum values. The default range is 1–10.
   Percentage	Percentage field with a prescribed range.
   Scale	Predefined Likert scale. Answer options appear as radio buttons.
   Numeric Scale	Numeric or numerical scale. Requires the respondent to provide the response in terms of numerical values.
   String	Single or multi-line text field.
   Template	List of templates that provide a predefined scale of options.
   Reference	List of fields from a specified reference table.
   Image Scale	Image question. Enables you to click images as your answer to a question.
   Multiple Selection	Multiple options. You can select multiple options as responses.
   Ranking	Question type with options as answers. The options must be ranked.

5. Point to Save and then select Save and Publish.
   The state of the template changes to Published.

Result

The assessment template with the questions is ready to be sent to the entity owner.

What to do next

After the template is published, send it to the entity or processing activity owners to collect responses. For more information, see Send a privacy assessment to an entity and Respond to a privacy screening assessment.

After responses are submitted, review and approve the assessment. For more information, see Review a privacy assessment.

To map assessment responses to a processing activity, see Map the processing activity fields to a question response.

To publish a new version of an existing privacy assessment template, see create-new-smart-asmt-version.html.

• Write a processing activity script
  Write custom scripts on the assessment templates to update the processing activity fields using a script. The script runs when the assessment response is completed. You can write multiple scripts for both screening assessments and impact assessments.
• Map a control objective to a question response
  Map the control objectives to the responses of the assessment questions to automatically create and apply the respective controls on the processing activity.
• Map an information object to a question response
  Map the [PI] Information objects to the responses of the assessment questions that must be associated to the processing activity. This association helps the privacy teams to understand what personal information is being processed by the processing activity.
• Map a risk statement to a question response
  Map the risk statements to the responses of the assessment questions to automatically create and apply the respective risks on the processing activity.
• Map the processing activity fields to a question response
  Map some of the processing activity fields with the responses of the assessment questions to update the processing activity details based on the assessment response.

Related concepts

• Smart assessments in Privacy Management