⚡

🔴AI Recruitment Screening DPIA is 4 days overdue. Art 35(3)(a) trigger confirmed - DPO consultation required immediately. View →

1/6

▣ Healthy

Processing Activities

↑ +2 this month

👤 On track

Active DSARs

↑ 0 overdue

▥ Attention

Vendors tracked

⚠ 3 high risk

▤ Action

Open assessments

⚠ 1 overdue

⚠ Attention

Open incidents

⚠ 1 critical

🎓 Healthy

Training completion

91%

↑ +3% MoM

≣ Attention

Policies due review

⚠ 2 overdue

✓ Healthy

Consent records

8420

↑ Active

Privacy Risk Radar

Live cross-module risk distribution

Data Mapping 88

DSAR 94

Vendors 62

Assessments 58

Policies 71

Retention 74

AI Governance 66

Training 91

Incidents 70

Privacy Maturity Score

Composite across 9 governance modules

/100

Data Mapping 88%

DSAR 94%

Vendors 62%

Assessments 58%

Policies 71%

Activity Timeline

Recent actions and system events

👤

New request received DSAR

Today 09:14

Mila Schneider - Rectification (Germany)

▤

DPIA status updated Assessments

Today 08:55

Smart CCTV - moved to Mitigation Planning

▥

Vendor review due Vendors

Yesterday 16:30

Cloud AI Labs DPA flagged for renewal

⚠

Incident escalated Incidents

Yesterday 14:12

INC-1444 - improper access escalated to Critical

🎓

Module completed Training

21 Mar 11:00

DSAR Handling for HR - 74/82 completions

⚠

Assessment overdue Assessments

21 Mar 09:30

AI Recruitment Screening DPIA - 4 days past due

▣

Processing record updated Data Mapping

20 Mar 15:44

Behavioural Analytics - risk score revised to HIGH

≣

Policy review approaching Policies

20 Mar 10:22

DSAR Handling Standard - due 30 Mar

DSAR Pipeline

Active requests by status and urgency

Processing

Pending

Completed

Alex Morgan

PRIV-DSAR-001 · Access · UK

Processing

10 days remaining

Claire Dubois

PRIV-DSAR-002 · Erasure · France

Pending

21 days remaining

Mila Schneider

PRIV-DSAR-003 · Rectification · Germany

Processing

23 days remaining

Horizon Watchlist

Top signals from Scan my Horizon

Children-data transfer exposure

2 RoPA records + active cross-border transfers.

Threats · RoPA + Vendors

Critical

AI DPIA overdue

Recruitment AI - no completed DPIA. Art 35(3)(a).

Threats · Assessments

Critical

Vendor DPA hygiene gaps

2 high-risk processors with stale DPAs.

Weaknesses · Vendors

High

EU AI Act readiness gap

3 AI systems may need FRIA by Aug 2026.

PESTLE · AI + Assessments

High

Retention drift in 4 records

Deletion timelines missing - minimisation risk.

Weaknesses · RoPA

Medium

Module Health

Click any module to navigate

Data Mapping

2 issues

DSAR Manager

No issues

Vendors

3 issues

Assessments

4 issues

Policies

2 issues

Retention

2 issues

AI Governance

2 issues

Training

No issues

Incidents

1 issue

Global Data Sovereignty Map

Live 3D · Click nodes · Scroll to zoom · Drag to rotate

12visible points

6high risk

1critical

10mapped flows

Map intelligence
Low Moderate
High Critical
Solid route = controlled · dashed = review

🔀

Model my Data Map

Visual flow modeler · query your estate · compliance intelligence

Assets

Flows

High risk

Intelligent query shortcuts

Global Geographic Intelligence Console

Customer-estate infrastructure plus verified public space and scientific-data reference layers

Visible points12

High / critical6

Countries12

Single points of failure4

Ask the globe

Select layers or ask a geographic governance question.

Time state2026

Scenario simulation

No scenario active.

Priority geographic signals

Open AI Transfer Finding · 86Unresolved transfer evidence and provider-change exposure

LEO AI Telemetry Satellite · 74Onboard anomaly detection · signed telemetry · ground-controlled keys

Virginia Foundation Model Endpoint · 72External LLM API · transfer and subprocessor controls

Cape Town Warm Disaster Recovery · 67Encrypted recovery copies · tested restoration required

Singapore Edge Inference · 61Local intent classification and minimisation

Frankfurt High-Risk Cluster · 58Restricted Annex III workloads

Dashboard Map Intelligence Workspace

Operational map register, dependencies, transfer mechanisms, alerts and board-ready outputs

Global pointsGoverned estate

Cloud, AI, satellite, security, recovery and regulatory locations.

Highest exposureExternal model route

Provider, transfer and subprocessor evidence requires continuous validation.

Resilience focus4 dependencies

Model, HSM, cloud region and ground station require tested fallback.

Governance linkageLive routing

Use the map to navigate into AI Infrastructure and related governance workflows.

Point	Type	Risk	Year
Open AI Transfer Finding Unresolved transfer evidence and provider-change exposure	incident	86	2026
LEO AI Telemetry Satellite Onboard anomaly detection · signed telemetry · ground-controlled keys	satellite	74	2026
Virginia Foundation Model Endpoint External LLM API · transfer and subprocessor controls	model	72	2025
Cape Town Warm Disaster Recovery Encrypted recovery copies · tested restoration required	recovery	67	2026
Singapore Edge Inference Local intent classification and minimisation	edge	61	2026
Frankfurt High-Risk Cluster Restricted Annex III workloads	datacentre	58	2025
GEO Communications Satellite Network telemetry and service optimisation	satellite	48	2025
Svalbard Ground Station Downlink relay · EEA processing · secondary station required	ground	46	2024
Dublin Vector and Data Zone RAG corpus, embeddings and feature stores	datacentre	39	2024
London Confidential Compute Private inference · UK-only sensitive workloads	datacentre	26	2024
Cardiff HSM and Key Trust Anchor FIPS HSM · signing and approval tokens	hsm	23	2024
London AI Security Operations Centre Prompt attacks, agent actions and exfiltration monitoring	soc	22	2025

Flow	Data	Mechanism	Risk	Status
External model inference	Prompts, retrieved context and outputs	IDTA and transfer assessment	78	Review required
Human review escalation	Flagged AI decisions and evidence	Contractual safeguards	62	Assessment open
APAC minimised inference	Tokenised intent and metadata	IDTA	61	Review required
AI security monitoring	Logs, alerts and agent actions	UK-EU safeguards	55	Evidence due
Identity and access federation	User and role attributes	Processor contract	49	Monitored
Ground processing route	Operational telemetry and diagnostics	EEA processing	46	Monitored
Satellite telemetry downlink	Signed telemetry and anomaly events	EEA route	42	Monitored
Disaster recovery replication	Encrypted backups and configurations	Approved recovery route	38	Tested
UK to EU RAG replication	Knowledge corpus and embeddings	UK-EU adequacy	28	Controlled
Key and signing trust	Encryption keys and approval tokens	Domestic	18	Controlled

Open AI Transfer Finding · 86
Unresolved transfer evidence and provider-change exposure

LEO AI Telemetry Satellite · 74
Onboard anomaly detection · signed telemetry · ground-controlled keys

Virginia Foundation Model Endpoint · 72
External LLM API · transfer and subprocessor controls

Cape Town Warm Disaster Recovery · 67
Encrypted recovery copies · tested restoration required

Singapore Edge Inference · 61
Local intent classification and minimisation

Frankfurt High-Risk Cluster · 58
Restricted Annex III workloads

Cross-Module Risk Heat Map

Where risk converges across the estate

	Transfer	Children	AI/Auto	Data Vol.	Retention	Vendor	Incident	Rights
RoPA	H	L	H	M	L	M	L	M
DSAR	L	M	L	L	L	L	H	H
Vendors	H	L	H	M	L	H	M	L
Assessments	M	M	M	H	M	L	L	M
Policies	L	L	L	L	H	L	L	L
Retention	M	L	L	L	M	L	L	L
AI	M	L	H	H	L	M	L	M
Incidents	M	H	M	L	L	L	H	M

High Medium Low

Programme Trends

6-month rolling view

Regulatory Calendar

Key dates and obligations

AI Recruitment DPIA overdue

25 Mar 2026 · EU / UK

DSAR Handling Standard review due

31 Mar 2026 · UK

Global Privacy Essentials training deadline

31 Mar 2026 · Global

Master Privacy Policy annual review

15 Apr 2026 · Global

EU AI Act - high-risk AI system requirements apply

01 Aug 2026 · EU

UK GDPR reform - potential divergence from EU

01 Jan 2027 · UK

Data Mapping

RoPA · Discovery · Information Assets · AI Copilot · Regulator Fit · 7 modules

PRIVASTU · Information Asset Register

Know every asset. Map every flow. Control every risk.

Automatically discover, classify and map all information assets across your organisation. Linked in real time to your RoPA records, vendor register, assessments and incidents - the single source of truth for what data you hold, where and why.

Total assets

In register

Critical risk

Immediate action

Shadow / unknown

Undocumented stores

No RoPA record

Not mapped to RoPA

Retention gap

No or overdue policy

Proposed new

From last scan

Asset	Type	Owner	Classification	Personal data	Risk	Source system	RoPA
Employee Lifecycle Management	HR	Recruitment, payroll, performance	Contract / legal obligation	Employees	UK - US SCCs	Medium	Active
Marketing CRM	Marketing	Lead generation and campaigns	Consent / legitimate interests	Prospects	EEA - US	High	Review
Security Monitoring	IT & Security	Threat detection and incident response	Legitimate interests	Employees / contractors	No	Medium	Active
Customer Support Case Handling	Operations	Service resolution and QA	Contract	Customers	EEA - India	Medium	Draft

Discovery Scan Engine

AppMap-style automated PII & asset discovery

Connect your systems and PRIVASTU automatically discovers personal data, classifies sensitivity, maps data flows and proposes RoPA records. Powered by pattern recognition, schema analysis and AI-assisted classification.

☁

Salesforce

Last scan: 21 Mar 2026 · 3 assets found

Connected

👥

Workday

Last scan: 21 Mar 2026 · 4 assets found

Connected

❄

Snowflake

Last scan: 21 Mar 2026 · 12 assets found

Connected

🔷

Microsoft 365

Last scan: 21 Mar 2026 · 8 assets found

Connected

🪣

AWS S3

Last scan: 20 Mar 2026 · 6 assets found

Partial

📁

Network file shares

Last scan: Never · 0 assets found

Pending

Scheduled Scans

Full estate scanWeekly · Sundays 02:00

New data type detectionDaily · 06:00

Transfer path monitoringContinuous

Shadow data detectionWeekly · Wednesdays 03:00

Discovery Findings

Last scan: 21 Mar 2026 · 06:14

🔴

Legacy CRM discovered with ~200K unencrypted records - no owner, no RoPA, no retention policy

Critical

🔴

PII (CV data, biometric) flowing to Cloud AI Labs without completed TRA or DPIA

Critical

🟡

Production PII (customer emails) found in Snowflake development schema - 3 columns unmasked

High

🟡

HR file share (\\server01\HR) contains salary spreadsheets and medical certificates - no RBAC

High

🟡

Workday health data found in test environment - not masked or anonymised

High

🔵

Slack workspace - 18-month message retention includes employee personal data - not in RoPA

Medium

🔵

OneDrive personal folders - shadow PII in unmanaged documents - no policy applied

Medium

Proposed New Assets

Discovered but not yet in register

AWS S3 - analytics-raw-prod

File Store · S3 bucket scan found email addresses and device IDs

94% match

Slack workspace messages

Email System · Collaboration platform - message retention and employee data

87% match

Jira / Confluence

SaaS Application · Project management with employee personal data in issues

78% match

Network file share \\server01\HR

File Store · HR folder detected - contains payroll spreadsheets and medical certificates

96% match

Data Flow Map

How personal data moves across your asset estate

From	To	Type	Data	Freq.	Risk	Cross-border	Documented
Salesforce CRM	Snowflake DW	Scheduled ETL	Customer records, behavioural	Daily	Medium	No	✓
Workday HRIS	Payroll Provider	API push	Salary, bank details, personal data	Monthly	High	⚠ Yes	✓
Website	Google Analytics 4	JavaScript tag	Behavioural, location, device ID	Real-time	Medium	⚠ Yes	✓
Salesforce CRM	Mailchimp	Integration	Customer email, name, preferences	Real-time sync	Medium	⚠ Yes	✓
Workday HRIS	Cloud AI Labs	Batch export	CV data, contact details, assessments	Per recruitment cycle	Critical	⚠ Yes	✗ NOT DOCUMENTED
Unknown legacy CRM	Unknown destination	Unknown	Unknown PII	Unknown	Critical	No	✗ NOT DOCUMENTED
Snowflake DW	BI tool (Tableau)	Direct query	Customer analytics with PII columns	Ad hoc	High	No	✗ NOT DOCUMENTED

⚠ 3 undocumented flows · 4 cross-border transfers · 2 critical-risk flows

Transfer Risk Summary

🔴CV/biometric data flowing to Cloud AI Labs (US) - no TRA, no DPIA

🟡Customer data to Mailchimp (US) via SCCs - verify Article 46 mechanism currency

🟡Employee data to Workday (US) via SCCs - DPA expiry: Dec 2026

🟡Analytics to Google Analytics 4 (US) via DPF - monitor DPF validity

Data Flow Anomalies

Unexpected or undocumented flows detected

🔴

Legacy CRM → unknown destination: uncharted flow, unknown data types

First detected: 21 Mar

🔴

Snowflake dev schema receiving production PII - unexpected flow

First detected: 19 Mar

🟡

Workday → external payroll: batch export not on DPA schedule

First detected: 15 Mar

Classification Framework

Confidential

Personal data, financial data, health data, credentials, biometrics

Restricted

Payment data, authentication tokens, legal documents, sensitive contracts

Internal

Business-internal information, aggregated analytics, operational data

Public

Publicly available information, marketing content, published records

PII Detection Patterns

AI-powered field recognition (Concentric-style)

Email address

Validated email format

99%

8 assets

UK National Insurance No.

[A-Z]{2}[0-9]{6}[A-D]

98%

2 assets

Payment card number (PAN)

Luhn-validated 16-digit

97%

3 assets

Date of birth

DOB / birth_date field name + date pattern

95%

5 assets

IP address

IPv4/IPv6 pattern

99%

6 assets

UK phone number

+44 / 07xx pattern

94%

4 assets

Sort code + account number

NN-NN-NN + 8 digits

96%

2 assets

Location coordinates

lat/lon field names + numeric range

91%

3 assets

Unclassified Assets

Assets pending classification review

All assets have been classified. ✓

Critical assets

High-risk assets

Undocumented flows

Anomalies detected

Asset Risk Matrix

Likelihood × Impact across asset estate

Assets plotted by risk rating

	High impact	Med impact	Low impact
High likelihood	3	6	1
Medium likelihood	3	6	1
Low likelihood	6	1
Very low	6	1

High-Risk Assets

AI Recruitment Screening Model

AI / ML Model

Legacy CRM (pre-2020)

Database

Workday HRIS

SaaS Application

Snowflake Data Warehouse

Data Warehouse

PRIVASTU Document Archive

Backup / Archive

Salesforce Production CRM

SaaS Application

Shadow Data Exposure

Undocumented or overlooked data stores

Google Analytics 4Active

Behavioural / analytics · Location data

Legacy CRM (pre-2020)Shadow / Unknown

Name / contact details · Financial data · Behavioural / analytics

Retention Compliance

Assets with missing, exceeded, or undocumented retention periods

Asset	Retention policy	Status
AI Recruitment Screening Model	Not defined - action needed	⚠ Missing
PRIVASTU Document Archive	Varies by document type	⚠ Missing
Legacy CRM (pre-2020)	No policy - OVERDUE	⚠ OVERDUE

Asset Type Library

Pre-built templates for common information asset types. Use as starting points for your asset register - each template includes recommended classification, typical PII types and standard risk indicators.

🗄

Production Database

Confidential High risk

Typical PII

Customer/employee PII · Financial data

Key controls

Encryption at restAccess controlsAudit loggingBackup & DR

High risk - likely requires RoPA record and possible DPIA. Ensure retention policy defined.

☁

SaaS CRM Platform

Confidential High risk

Typical PII

Customer data · Contact data · Commercial data

Key controls

DPA requiredSSO/MFAIP allowlistExport controls

Likely processor relationship. Verify SCCs/IDTA for non-EEA processing. Check sub-processors.

👥

HR / People System

Confidential Critical risk

Typical PII

Employee data · Salary · Health data · Biometric data

Key controls

Strict RBACDedicated DPAHR-only accessRetention schedules

Special category data likely. Legal basis per Art. 9 required. DPA and transfer mechanism mandatory.

❄

Data Warehouse / Analytics

Confidential High risk

Typical PII

Aggregated PII · Behavioural data · Financial analytics

Key controls

Column-level encryptionRow-level securityMasking for dev/testRetention enforcement

High risk of PII in test/dev environments. Minimisation critical. Profiling rules may apply.

🤖

AI / ML Model

Confidential Critical risk

Typical PII

Training data (PII) · Inference inputs · Model outputs on individuals

Key controls

DPIA requiredHuman oversightExplainabilityBias testingFRIA (EU AI Act)

Art. 22 ADM obligations likely. DPIA mandatory. EU AI Act may require FRIA. No autonomous decisions without safeguards.

📧

Email / Collaboration System

Confidential Medium risk

Typical PII

Employee data · Customer correspondence · Attachments (unknown PII)

Key controls

Retention policyLegal hold capabilityDLPContent scanning

Often underestimated. Unstructured PII in emails. Retention and litigation hold must be balanced.

💳

Payment / Financial System

Restricted High risk

Typical PII

Payment card data · Bank details · Transaction records

Key controls

PCI DSS complianceTokenisationNo raw card storageStrict access

Financial data is highly sensitive. PCI DSS alongside GDPR. Retention driven by tax/audit law.

📁

File Server / SharePoint

Internal Medium risk

Typical PII

Unstructured PII (unknown) · HR documents · Customer files

Key controls

Folder-level RBACDLP scanningPeriodic auditsAuto-classification

Highest source of shadow PII. Scan regularly. Apply auto-classification and retention tags.

📦

Backup / Archive System

Confidential Medium risk

Typical PII

Mirrors of all above · Historical PII

Key controls

Encrypted backupsGeo-restrictedDefined retentionTested restore

Erasure requests must include backups. Document backup retention separately from live system.

📷

CCTV / Physical Security

Restricted High risk

Typical PII

Biometric data · Location data · Visitor records

Key controls

Signage (transparency)30-day rolling retentionRestricted accessSecure export only

Special category biometric data in UK/EU. ICO CCTV Code of Practice. DPIA may be needed.

🔌

API / Integration Endpoint

Internal Medium risk

Typical PII

Transient PII in transit · API keys · Authentication tokens

Key controls

TLS 1.2+Token rotationRate limitingAudit logging

Data in transit. Ensure transfer logging. API access should appear in DPA schedules if third-party.

📊

Analytics / BI Tool

Internal Medium risk

Typical PII

Derived / aggregated PII · Reports with personal data

Key controls

Row-level securityExport controlsAnonymisation checksUser audit trail

Profiling risk. If individual-level data accessible, treat as live PII system. Minimise by default.

Signals · PRIVASTU - SWOT my Data™

Role-based intelligence for your data landscape

Dashboard Intelligence - beyond static registers and generic privacy tooling. PRIVASTU turns your live data estate into a role-aware intelligence layer by combining DSAR, RoPA, consent, assessments, vendor, policy, retention, AI, incident, training and SWOT signals inside one analysis surface. Each query is engineered to return issues, affected populations, control owners, remediation pathways and defensible outputs.

⚬ Cross-module reasoning

👤 Role-aware queries

◆ SWOT

◆ PESTLE

◆ SOAR

◆ Porter's 5 Forces

◆ STEEPLE

◆ TOWS Matrix

◆ VRIO

⚡ Actionable outputs

Sector / SIC division

Industry sub-sector

Your role

SIC Code Search

Type to search 1,270+ UK SIC codes

Start typing a code number or industry keyword to search

Selected:

Run Sector + Role Intelligence

Generates query packs using the selected analysis framework, sector, sub-sector and role context

Strengths8

Weaknesses5

Opportunities6

Threats4

Role packs15

Data signals12

Select Your Role

Each pack includes five intelligent queries built for how that function consumes privacy data

Chief Privacy Officer

Best for privacy leadership, investment decisions and enterprise-wide accountability.

5 queries Role pack

Data Protection Officer

Best for legal oversight, statutory controls and evidence-ready compliance answers.

5 queries Role pack

Chief Financial Officer

Best for funding decisions, exposure estimation and control-efficiency trade-offs.

5 queries Role pack

Chief Executive Officer

Best for enterprise line of sight, sponsor actions and board-level judgement.

5 queries Role pack

HR Director

Best for employee lifecycle controls, worker trust and HR process redesign.

5 queries Role pack

Procurement Director

Best for vendor prioritisation, onboarding gates and contract discipline.

5 queries Role pack

Risk Director

Best for risk committees, scenario analysis and exposure prioritisation.

5 queries Role pack

Communications Director

Best for public-facing trust, internal messaging and response clarity.

5 queries Role pack

AI Governance Officer

Best for use-case governance, model risk and AI-specific control assurance.

5 queries Role pack

Chief Information Security Officer

Best for security/privacy overlap, operational control failures and escalation.

5 queries Role pack

Privacy Manager

Best for day-to-day queue management, action orchestration and follow-through.

5 queries Role pack

Sales & Growth Director

Best for customer-facing growth, marketing dependency and trust-led conversion.

5 queries Role pack

Chief Compliance Officer

Best for enterprise compliance alignment and formal control assurance.

5 queries Role pack

Chief Operating Officer

Best for process design, service delivery and operating-model improvements.

5 queries Role pack

Regulatory Affairs Director

Best for external oversight, regulator packs and horizon-scanning discipline.

5 queries Role pack

Analysis Framework

Change the lens without changing the underlying data graph

Chief Privacy Officer - Pre-built Queries

Enterprise privacy strategy, maturity, board narrative and control direction

PRIVASTU will use the selected VRIO lens to interpret the same underlying data for Chief Privacy Officer.

VRIO 5 queries

1. Privacy Program Maturity Index

Using RoPA coverage, DSAR SLA performance, policy review health, vendor assurance, assessment completion, incident severity and training completion, show the current enterprise privacy maturity baseline and the three areas moving in the wrong direction.

RoPADSARPoliciesVendorsAssessmentsIncidentsTraining

2. Cross-Border Risk Posture

Which business units depend on transfers involving high-risk jurisdictions, sensitive categories, children, workers, or profiling activity and where are safeguards, TIAs, or vendor terms still weak?

RoPAVendorsTransfersAssessments

3. Board-Ready Privacy Dashboard

Summarise the five items leadership should see now across incidents, DSAR deadlines, blocked contracts, AI use cases, overdue policies and material SWOT threats.

DashboardDSARIncidentsVendorsAISWOT

4. Privacy-vs-Competitive-Advantage Analysis

Identify where privacy strengths such as faster DSAR handling, better vendor assurance, stronger transparency, or lower incident rates can be converted into customer trust, sales enablement, or procurement advantage.

DSARVendorsPoliciesIncidentsSWOT

5. Regulatory Horizon Risk Forecast

Across AI, children data, worker monitoring, cross-border flows, retention and direct marketing, where are our next regulator-pressure points most likely to emerge based on open actions and current control debt?

AIRoPARetentionConsentSWOTPolicies

Privacy Program Maturity Index

Intelligent query: Using RoPA coverage, DSAR SLA performance, policy review health, vendor assurance, assessment completion, incident severity and training completion, show the current enterprise privacy maturity baseline and the three areas moving in the wrong direction.

Role framing

Chief Privacy Officer needs the answer expressed through enterprise privacy strategy, maturity, board narrative and control direction.

VRIO

Signals to traverse

RoPA, DSAR, Policies, Vendors, Assessments, Incidents, Training

Cross-module

Expected output

Maturity scorecard with trend movement, affected functions and next-step recommendations.

Actionable

Framework guidance

Anchor the analysis in internal strengths, weaknesses, opportunities and threats and translate them into control or growth actions.

Lens

Free-Form Intelligence Query

Ask a bespoke question in the context of the selected role

Role context: Chief Privacy Officer Framework: VRIO

PRIVASTU will expand your prompt into an intelligent cross-module query with role framing, suggested signals and expected output structure.

Prompt orchestration workspace

Your expanded intelligent query will appear here once generated.

Role packs15

Horizon packs10

Queries per role5

Legally boundedYes

Select Your Role

All role packs - each contains five legally bounded queries.

Analysis Framework

Change the lens without changing the underlying data graph.

SWOT: assess internal strengths and weaknesses against external opportunities and threats.

Queries

Analysis Workspace

Governed signals based on your role, framework and selected query.

Select a role and query to generate analysis.

Intelligent Query Expansion

Enter a question in natural language - PRIVASTU will expand it into a governed, role-aware, cross-module query plan.

DPO Relational Query Studio

Governed cross-module joins. Select datasets, set parameters and generate a legally anchored query plan.

Primary dataset

Risk threshold

Join datasets

Query intent

Run the DPO studio to generate a governed relational watchlist.

Consent Management

Capture, proof and renewal tracking

Active records1

Expiring in 30 days1

Withdrawn1

Proof coverage100%

Data Subject	Channel	Purpose	Captured	Expiry	Evidence	Status
Contact 0012	Web form	Marketing emails	2025-12-12	2026-12-12	Double opt-in log	Active
Contact 0184	Event sign-up	Newsletter	2025-10-09	2026-10-09	Event form archive	Renewal due
Contact 0217	Call centre	Product updates	2025-09-16	2026-03-16	Call recording ref	Withdrawn

DSAR Manager

Public intake, tracking, jurisdiction logic and internal case operations inside PRIVASTU

This module turns PRIVASTU into a working data subject rights portal rather than a static register. It supports public submission, request tracking, jurisdiction-driven response clocks, identity verification checkpoints and an internal operations view for Privacy, Legal, HR and service owners.

Public request intake Jurisdiction-aware deadlines Identity verification control Admin case management

PRIVASTU

360° Enterprise Privacy Management

PRIVASTU - 360° Enterprise Privacy Management. The logo stays confined to the DSAR hero and selected brand panels so the product remains precise and uncluttered.

Total requests3All stored cases

Pending verification1Identity confirmation still needed

Active processing2Internal teams currently working

Overdue risk3Past statutory deadline

What is live in this build

Deployable static module

Public-facing submission flow

Requesters can submit access, rectification, erasure, restriction, portability and objection requests against a jurisdiction list with response logic attached.

Tracking experience

Every submission gets a PRIVASTU reference and a response deadline based on the selected jurisdiction.

Internal case operations

Privacy teams can verify identity, move cases through workflow stages, add or close actions, filter queues and inspect deadlines.

What makes it product-grade

Built into PRIVASTU, not bolted on

One shell, two audiences

Public subjects get a clean rights portal while internal teams stay in the operating console.

Unified

Jurisdiction-first logic

Deadlines are calculated from the applicable law table rather than hard-coded globally.

Smart

Ready for orchestration

The structure is already suited to connect later into mail, workflow engines, vaults, or case evidence repositories.

Scalable

Current case queue

Live register from PRIVASTU local storage

Reference	Type	Requester	Jurisdiction	Due date	Verification	Status
PRIV-DSAR-20260320-A1X9	Access	Alex Morgan Employee	United Kingdom	Thursday, 9 April 2026	Verified	Overdue
PRIV-DSAR-20260320-K7M2	Erasure	Claire Dubois Customer	France	Saturday, 11 April 2026	Unverified	Overdue
PRIV-DSAR-20260320-N4Q8	Rectification	Mila Schneider Candidate	Germany	Monday, 13 April 2026	Verified	Overdue

Data Subject Request Portal

PRIVASTU public rights interface

PRIVASTU respects privacy rights under applicable law. Requesters receive a unique reference and a deadline calculated from the selected jurisdiction.

Important legal information

Identity verification is required before any disclosure of personal data.
Response windows vary by jurisdiction and complexity.
Available rights depend on the law that applies in the requester's country or state.

Built for different requester groups

Employees, workers, candidates, customers, children and guardians, suppliers and other data subjects can use the same portal with consistent control points.

Submit Request

Working intake form

First name *

Last name *

Email address *

Country / state *Select a jurisdiction to view the response rule.

Requester type

Request type *

Description of request

I confirm that the information I have provided is accurate and that I am the data subject or an authorised representative. I understand identity verification is required. I understand the portal will process my request according to the applicable privacy law and that not all rights are available in all jurisdictions.

Track a Request

Public status look-up

Request reference

The public tracker shows high-level workflow only. Evidence, exemptions and internal handling notes remain in the operations console.

Enter a PRIVASTU request reference to see status, verification state and response deadline.

Operations Console

Internal case management for Privacy, Legal, HR and service owners

Reference	Requester	Jurisdiction	Submitted	Due by	Days left	Verification	Status	Actions required
PRIV-DSAR-20260320-A1X9	Alex Morgan alex.morgan@example.com	United Kingdom	10/03/2026	Thursday, 9 April 2026	106 overdue	Verified	Overdue	Collect HRIS extracts, Review third-party references
PRIV-DSAR-20260320-K7M2	Claire Dubois claire.dubois@example.com	France	12/03/2026	Saturday, 11 April 2026	104 overdue	Unverified	Overdue	Verify identity, Check contractual retention
PRIV-DSAR-20260320-N4Q8	Mila Schneider mila.schneider@example.com	Germany	14/03/2026	Monday, 13 April 2026	102 overdue	Verified	Overdue	Update applicant system, Notify recruiter

DSAR Workflow Command Centre

Role queues, controlled hand-offs and intelligent suggested next steps

Open tasks22Across all roles

Approval queue0Awaiting sign-off

Overdue actions22Internal or statutory

Release-ready0Approved packages

Role queue

Every activity carries ownership, evidence and hand-off criteria

Urgency	Reference	Stage	Role / owner	Status	Due	Evidence and hand-off	Suggested next step
critical	PRIV-DSAR-20260320-A1X9 Alex Morgan	Intake and acknowledgement	Request Respondent Unassigned	Completed	11/03/2026 -136 day(s)	Original request and acknowledgement Case logged and requester acknowledged.	Complete
critical	PRIV-DSAR-20260320-A1X9 Alex Morgan	Identity and authority verification	Identity Verification Officer Unassigned	Completed	11/03/2026 -136 day(s)	Verification decision and evidence reference Identity or authority verified, or further evidence request documented.	Complete
critical	PRIV-DSAR-20260320-A1X9 Alex Morgan	Scope, rights and jurisdiction	Case Manager / DPO Unassigned	In progress	11/03/2026 -136 day(s)	Scope note and jurisdiction analysis A clear search scope and legal route are recorded.	Immediate statutory escalation
critical	PRIV-DSAR-20260320-A1X9 Alex Morgan	Search and data collection	Data Owner / Search Respondent Unassigned	Not started	11/03/2026 -136 day(s)	Search log, system returns and custodian attestations All assigned searches are complete or exceptions escalated.	Continue or assign
critical	PRIV-DSAR-20260320-A1X9 Alex Morgan	Legal review and exemptions	Legal Reviewer Unassigned	Not started	11/03/2026 -136 day(s)	Exemption and legal review schedule Every withholding or restriction has a documented basis.	Continue or assign
critical	PRIV-DSAR-20260320-A1X9 Alex Morgan	Redaction and response package	Redaction Reviewer Unassigned	Not started	11/03/2026 -136 day(s)	Redaction log, package index and QA record A complete quality-assured response package is ready.	Continue or assign
critical	PRIV-DSAR-20260320-A1X9 Alex Morgan	Approval and sign-off	Approver Unassigned	Not started	11/03/2026 -136 day(s)	Approval decision and conditions Signed approval or documented rework instruction.	Continue or assign
critical	PRIV-DSAR-20260320-A1X9 Alex Morgan	Secure release and communication	Release Officer Unassigned	Not started	11/03/2026 -136 day(s)	Delivery record and sent communication Approved response securely delivered.	Continue or assign
critical	PRIV-DSAR-20260320-A1X9 Alex Morgan	Closure and lessons learned	Case Manager / DPO Unassigned	Not started	11/03/2026 -136 day(s)	Closure checklist and lessons log Case closed with a complete audit trail.	Continue or assign
critical	PRIV-DSAR-20260320-K7M2 Claire Dubois	Intake and acknowledgement	Request Respondent Unassigned	Completed	13/03/2026 -133 day(s)	Original request and acknowledgement Case logged and requester acknowledged.	Complete
critical	PRIV-DSAR-20260320-K7M2 Claire Dubois	Identity and authority verification	Identity Verification Officer Unassigned	In progress	13/03/2026 -133 day(s)	Verification decision and evidence reference Identity or authority verified, or further evidence request documented.	Immediate statutory escalation
critical	PRIV-DSAR-20260320-K7M2 Claire Dubois	Scope, rights and jurisdiction	Case Manager / DPO Unassigned	Not started	13/03/2026 -133 day(s)	Scope note and jurisdiction analysis A clear search scope and legal route are recorded.	Continue or assign
critical	PRIV-DSAR-20260320-K7M2 Claire Dubois	Search and data collection	Data Owner / Search Respondent Unassigned	Not started	13/03/2026 -133 day(s)	Search log, system returns and custodian attestations All assigned searches are complete or exceptions escalated.	Continue or assign
critical	PRIV-DSAR-20260320-K7M2 Claire Dubois	Legal review and exemptions	Legal Reviewer Unassigned	Not started	13/03/2026 -133 day(s)	Exemption and legal review schedule Every withholding or restriction has a documented basis.	Continue or assign
critical	PRIV-DSAR-20260320-K7M2 Claire Dubois	Redaction and response package	Redaction Reviewer Unassigned	Not started	13/03/2026 -133 day(s)	Redaction log, package index and QA record A complete quality-assured response package is ready.	Continue or assign
critical	PRIV-DSAR-20260320-K7M2 Claire Dubois	Approval and sign-off	Approver Unassigned	Not started	13/03/2026 -133 day(s)	Approval decision and conditions Signed approval or documented rework instruction.	Continue or assign
critical	PRIV-DSAR-20260320-K7M2 Claire Dubois	Secure release and communication	Release Officer Unassigned	Not started	13/03/2026 -133 day(s)	Delivery record and sent communication Approved response securely delivered.	Continue or assign
critical	PRIV-DSAR-20260320-K7M2 Claire Dubois	Closure and lessons learned	Case Manager / DPO Unassigned	Not started	13/03/2026 -133 day(s)	Closure checklist and lessons log Case closed with a complete audit trail.	Continue or assign
critical	PRIV-DSAR-20260320-N4Q8 Mila Schneider	Intake and acknowledgement	Request Respondent Unassigned	Completed	15/03/2026 -132 day(s)	Original request and acknowledgement Case logged and requester acknowledged.	Complete
critical	PRIV-DSAR-20260320-N4Q8 Mila Schneider	Identity and authority verification	Identity Verification Officer Unassigned	Completed	15/03/2026 -132 day(s)	Verification decision and evidence reference Identity or authority verified, or further evidence request documented.	Complete
critical	PRIV-DSAR-20260320-N4Q8 Mila Schneider	Scope, rights and jurisdiction	Case Manager / DPO Unassigned	In progress	15/03/2026 -132 day(s)	Scope note and jurisdiction analysis A clear search scope and legal route are recorded.	Immediate statutory escalation
critical	PRIV-DSAR-20260320-N4Q8 Mila Schneider	Search and data collection	Data Owner / Search Respondent Unassigned	Not started	15/03/2026 -132 day(s)	Search log, system returns and custodian attestations All assigned searches are complete or exceptions escalated.	Continue or assign
critical	PRIV-DSAR-20260320-N4Q8 Mila Schneider	Legal review and exemptions	Legal Reviewer Unassigned	Not started	15/03/2026 -132 day(s)	Exemption and legal review schedule Every withholding or restriction has a documented basis.	Continue or assign
critical	PRIV-DSAR-20260320-N4Q8 Mila Schneider	Redaction and response package	Redaction Reviewer Unassigned	Not started	15/03/2026 -132 day(s)	Redaction log, package index and QA record A complete quality-assured response package is ready.	Continue or assign
critical	PRIV-DSAR-20260320-N4Q8 Mila Schneider	Approval and sign-off	Approver Unassigned	Not started	15/03/2026 -132 day(s)	Approval decision and conditions Signed approval or documented rework instruction.	Continue or assign
critical	PRIV-DSAR-20260320-N4Q8 Mila Schneider	Secure release and communication	Release Officer Unassigned	Not started	15/03/2026 -132 day(s)	Delivery record and sent communication Approved response securely delivered.	Continue or assign
critical	PRIV-DSAR-20260320-N4Q8 Mila Schneider	Closure and lessons learned	Case Manager / DPO Unassigned	Not started	15/03/2026 -132 day(s)	Closure checklist and lessons log Case closed with a complete audit trail.	Continue or assign

Case workflow

Nine governed stages from intake to closure

Intake and acknowledgement

Request Respondent · Unassigned · due 11/03/2026

Case logged and requester acknowledged.

Completed

Identity and authority verification

Identity Verification Officer · Unassigned · due 11/03/2026

Identity or authority verified, or further evidence request documented.

Completed

Scope, rights and jurisdiction

Case Manager / DPO · Unassigned · due 11/03/2026

A clear search scope and legal route are recorded.

In progress

Search and data collection

Data Owner / Search Respondent · Unassigned · due 11/03/2026

All assigned searches are complete or exceptions escalated.

Not started

Legal review and exemptions

Legal Reviewer · Unassigned · due 11/03/2026

Every withholding or restriction has a documented basis.

Not started

Redaction and response package

Redaction Reviewer · Unassigned · due 11/03/2026

A complete quality-assured response package is ready.

Not started

Approval and sign-off

Approver · Unassigned · due 11/03/2026

Signed approval or documented rework instruction.

Not started

Secure release and communication

Release Officer · Unassigned · due 11/03/2026

Approved response securely delivered.

Not started

Closure and lessons learned

Case Manager / DPO · Unassigned · due 11/03/2026

Case closed with a complete audit trail.

Not started

Suggested next steps

Deadline, right, evidence and stage-aware

critical

Immediate statutory escalation

This request is 106 day(s) overdue. Escalate to the DPO and Legal, record the breach risk and complete the oldest open stage immediately.

Notify accountable approver
Document cause and recovery plan
Prioritise secure completion
Consider regulatory or complainant communications

Case context

access · United Kingdom · deadline Thursday, 9 April 2026 · -106 day(s) remaining

Workflow audit trail

Updates, approvals, reports and email preparation

Date / time	Reference	Actor / role	Action	Detail
22/07/2026, 12:31:48	PRIV-DSAR-20260320-N4Q8	System	Workflow created	Nine-stage DSAR workflow initialised
22/07/2026, 12:31:48	PRIV-DSAR-20260320-K7M2	System	Workflow created	Nine-stage DSAR workflow initialised
22/07/2026, 12:31:48	PRIV-DSAR-20260320-A1X9	System	Workflow created	Nine-stage DSAR workflow initialised

Step-by-step role guidance

Respondent through approver and release officer

Request Respondent
Recognise, log and acknowledge rights requests promptly and accurately.

1Treat any clear rights request as valid regardless of channel or wording.

2Preserve the original request and record the received date and time.

3Create the case, confirm contact details and issue the acknowledgement.

4Do not promise an outcome or seek unnecessary identity data.

5Hand off with the original request, acknowledgement and any obvious urgency indicators.

Minimum evidence

Original request
Intake timestamp
Acknowledgement
Initial triage note

Governed correspondence templates

Case-aware letters, notices and internal instructions

Request

Template

Subject

BodyReview and tailor before issue.

DSAR handling DPIA suite

Full templates for process, technology and AI-assisted discovery or redaction

Scope: these templates assess risks created by the DSAR handling environment itself, including large data volumes, employee records, special-category data, third-party material, cross-border support, automated discovery and AI-assisted review.

Assessment titleIdentify the DSAR process, technology or change being screened.

OwnerAccountable owner and delivery team.

Processing descriptionDescribe collection, review, redaction, transfer and delivery.

Scale and volumeRequests, records, systems and jurisdictions.

Sensitive dataSpecial-category, criminal, children, employee or confidential material.

Systematic monitoringWhether monitoring records or behavioural data are involved.

Automation or AIDiscovery, classification, summarisation, redaction or decision support.

International access or transfersRemote support, vendors, cloud regions or cross-border review.

Vulnerable peopleChildren, workers, patients or people in dependent relationships.

Threshold conclusionIs a full DPIA required and why?

Screening actionsImmediate controls, owner and due date.

DSAR Report Studio

Structured working reports and polished PRIVASTU reports

Request

Report type

Presentation

Prepared by

Email-ready delivery

Generates a standards-based .eml file for review and sending

Subject

Cover message

Workflow integration: report and email preparation writes to the audit trail, refreshes the role queues and updates suggested next steps. The standalone file does not send messages automatically.

Report preview

Rendered from current case, workflow, evidence, templates and DPIA data

Select a request and generate a report.

⏱

Assessment Activity Queue

Role-specific queues, respondent deadlines, chasers, review gates and escalation actions

Total assessments5

Open5

Overdue responses1

High risk4

Comments1

Templates19

Chronological work queue

Earliest due first

Assessment	Activity	Role	Due	Urgency
Employee Monitoring Platform ASM-2026-MON02	Respondent completion	Workplace Technology Lead	18 Jul 2026	6 days overdue
AI Recruitment Screening ASM-2026-AI01	Respondent completion	HR Systems Lead	25 Jul 2026	1 days
Employee Monitoring Platform ASM-2026-MON02	Final decision and closure	COO	27 Jul 2026	3 days
Global Cloud Data Platform ASM-2026-CLOUD03	Respondent completion	Cloud Architect	01 Aug 2026	8 days
AI Recruitment Screening ASM-2026-AI01	Final decision and closure	Chief People Officer	05 Aug 2026	12 days
test ASM-2026-OIFAN	Respondent completion	nnn	08 Aug 2026	15 days
test ASM-2026-CM1Q5	Respondent completion	nnn	08 Aug 2026	15 days
test ASM-2026-OIFAN	Final decision and closure	nnnmmm	10 Aug 2026	17 days
test ASM-2026-CM1Q5	Final decision and closure	nnnmmm	10 Aug 2026	17 days
Global Cloud Data Platform ASM-2026-CLOUD03	Final decision and closure	CIO	19 Aug 2026	26 days

Chase and escalation log

Automatic while PRIVASTU is open

Reminder logic: 7, 3 and 1 days before the respondent deadline, on the due date and daily when overdue. The standalone build prepares auditable email messages. Hosted deployment can connect the same queue to an email service.

2026-07-25T06:10:00.890Z · ASM-2026-MON02

Overdue response escalation: 6 day(s).

2026-07-25T06:10:00.890Z · ASM-2026-AI01

Scheduled response reminder: 1 day(s) remaining.

2026-07-24T09:41:46.370Z · ASM-2026-MON02

Overdue response escalation: 5 day(s).

2026-07-23T11:30:32.656Z · ASM-2026-MON02

Overdue response escalation: 4 day(s).

2026-07-23T11:30:32.655Z · ASM-2026-AI01

Scheduled response reminder: 3 day(s) remaining.

2026-07-22T17:40:55.722Z · ASM-2026-MON02

Overdue response escalation: 3 day(s).

📋

Assessment Registry

DPIA, PIA, US state assessments, AI FRIA, role workflows, respondent communications and audit evidence

Total assessments5

Open5

Overdue responses1

High risk4

Comments1

Templates19

Reference	Assessment	Template	Risk	Status	Respondent / owner	Response due	Completion
ASM-2026-OIFAN	test USA	US-STATE	High	Draft	nnn nnnnn	08 Aug 2026 15 days left	0%
ASM-2026-CM1Q5	test USA	US-STATE	High	Draft	nnn nnnnn	08 Aug 2026 15 days left	0%
ASM-2026-AI01	AI Recruitment Screening EU/UK	AI-ADM	High	In progress	HR Systems Lead People Director	25 Jul 2026 1 days left	0%
ASM-2026-MON02	Employee Monitoring Platform UK/Germany	EMP-MON	High	Awaiting review	Workplace Technology Lead CISO	18 Jul 2026 6 days overdue	0%
ASM-2026-CLOUD03	Global Cloud Data Platform Global	CLOUD	Medium	Draft	Cloud Architect CTO	01 Aug 2026 8 days left	0%

🧭

Assessment Workspace

ASM-2026-CM1Q5 · test

StatusDraft

RiskHigh

Question completion0%

Response deadline08 Aug 2026

Time remaining15 days

End date10 Aug 2026

Role and scenario guided questionnaire

Hover ? for deeper guidance

1. Describe the project, processing and decision this assessment must govern.?

ContextRespondent

2. Identify controllers, joint controllers, processors, subprocessors and accountable owners.?

RolesRespondent

3. Map collection, use, disclosure, storage, access, transfer, inference and deletion.?

Data flowsData owner

4. Identify data categories and affected groups, including sensitive, inferred and vulnerable-person data.?

People and dataRespondent

5. For each purpose identify the legal basis, compatibility analysis and sensitive-data condition.?

Purpose and basisLegal

6. Why is each operation necessary and what less intrusive alternatives were considered??

NecessityBusiness owner

7. Is scale, granularity, access, retention and effect on people proportionate to the benefit??

ProportionalityPrivacy analyst

8. How will people be informed and exercise access, correction, deletion, objection, consent withdrawal and contest rights??

Transparency and rightsRespondent

9. Who was consulted and how did their feedback change the design??

ConsultationAssessment owner

10. Which high-risk indicators and jurisdictional mandatory-list triggers apply??

High-risk screeningPrivacy analyst

11. Describe plausible events affecting confidentiality, integrity, availability, autonomy, fairness, dignity or rights.?

Risk eventsSecurity and privacy

12. List preventive, detective, corrective and recovery controls with owners and evidence.?

ControlsControl owner

13. Reassess likelihood and severity after verified controls for each affected group.?

Residual riskPrivacy analyst

14. Does residual high risk require consultation with a supervisory authority before processing??

Prior consultationDPO

15. Record DPO advice, owner acceptance, approver decision, conditions and dissent.?

ApprovalApprover

16. Define performance, fairness, privacy, security and complaint monitoring plus reassessment triggers.?

MonitoringSystem owner

Suggested next steps

Dynamic

Complete 16 unanswered assessment questions.Suggested from current answers, dates, risk evidence and workflow state.

Identify and score risk events for affected people.Suggested from current answers, dates, risk evidence and workflow state.

Respondent and decision roles

Respondent: nnn
Owner: nnnnn
DPO: Data Protection Officer
Approver: nnnmmm

Chronological chain of risk

ID	Risk event and impact on people	Inherent	Controls	Residual	Owner	Evidence	Status	Action
No risks recorded. Add risk events as the assessment develops.

Risk chain rule: every material risk must retain its original inherent rating, linked controls, evidence, residual rating, accountable owner, acceptance decision and later review history.

Conversation with DPO and respondents

Chronological and auditable

No comments yet.

Comment as

Name

Comment, question or submission

Immutable chronological record

1 events

Created · Privacy Office22/07/2026, 20:00:37

Assessment created from US-STATE for USA.

Audit controls

All created, sent, opened, answered, commented, chased, reviewed, risk-rated, approved, rejected and exported events are timestamped against the assessment.

Status

Risk level

Respondent due date

Assessment end date

Next review date

Approver

Decision, conditions or recorded dissent

Global DPIA authority and jurisdiction library

143 DSAR-aligned jurisdictions

Current assessment: ASM-2026-CM1Q5 · test · USA. Select any country or US state to apply its DPIA terminology, trigger test, authority route, respondent prompts and approver decision rules.

143 visibleAll authority records replicatedDPIA-specific rules added

Albania

IDP · Information and Data Protection Commissioner
Europe · National Supervisory Authority

Global PIA Composite

Primary lawPersonal Data Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Legal positionComplete a proportionate privacy impact assessment before high-impact or materially changed processing. Determine whether local law makes it mandatory, regulator-requested, public-sector specific or recognised accountability practice.

Trigger testSensitive or special-category data, large scale, systematic monitoring, profiling, automated decisions, vulnerable people, innovative technology, extensive matching, location tracking, denial of rights or significant cross-border processing.

Required methodDescribe the project and information flows; identify purpose, legal basis and affected people; test necessity and proportionality; identify risks to people; assign evidenced controls; determine residual risk; record advice, approval and review triggers.

Authority escalationEscalate to the privacy lead or DPO. Verify whether the competent authority must be consulted, notified or supplied with the assessment before processing where high residual risk remains.

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Algeria

ANPDP · National Authority for the Protection of Personal Data
Africa · National supervisory authority

Global PIA Composite

Primary lawData Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Andorra

APDA · Andorran Data Protection Agency
Europe · National Supervisory Authority

Global PIA Composite

Primary lawOrganic Law on Data Protection

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Angola

APD · Data Protection Agency
Africa · National supervisory authority

Global PIA Composite

Primary lawLDP

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Antigua and Barbuda

Information Commissioner · Information Commissioner
Americas · National supervisory authority

Global PIA Composite

Primary lawData Protection Act

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Argentina

AAIP · Agency of Access to Public Information
Americas · National supervisory authority

Global PIA Composite

Primary lawLGPDP

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Armenia

PDPA Armenia · Personal Data Protection Agency
Europe · National Supervisory Authority

Global PIA Composite

Primary lawLaw on Personal Data

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Australia

OAIC · Office of the Australian Information Commissioner
Asia-Pacific · National privacy authority

OAIC PIA

Primary lawPrivacy Act

DPIA terminologyPrivacy Impact Assessment (PIA)

Legal positionUse the OAIC risk-proportionate PIA process and verify any Australian Government, state, territory or sector-specific mandatory requirement.

Trigger testNew or changed projects involving personal information, intrusive technology, matching, biometrics, surveillance, AI, significant data sharing or sensitive information.

Required methodThreshold assessment; plan; describe project; identify stakeholders; map information flows; analyse impacts; manage risks; make recommendations; report; implement and review.

Authority escalationEngage privacy, security, legal and affected stakeholders. Check whether an agency, regulator or governance body requires submission or publication.

Review ruleTrack recommendation implementation and repeat when the project or information handling changes.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Austria

DSB · Austrian Data Protection Authority
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Legal positionA DPIA is required before processing where the proposed processing is likely to result in high risk to people. Apply Article 35(3), the authority mandatory list and the EDPB high-risk criteria.

Trigger testSystematic and extensive evaluation with significant effects, large-scale sensitive or criminal data, large-scale systematic monitoring, national list triggers or a combination of EDPB high-risk indicators.

Authority escalationObtain and record DPO advice. Where residual high risk cannot be mitigated, determine and complete prior consultation with the competent supervisory authority under Article 36 before processing.

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Azerbaijan

Authority · Ministry of Digital Development and Transport / competent authority
Europe · No dedicated authority confirmed in the source; verify before reliance

Global PIA Composite

Primary lawLaw on Personal Data

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Bahamas

DPC Bahamas · Data Protection Commissioner
Americas · National supervisory authority

Global PIA Composite

Primary lawData Protection Act

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Bahrain

PDPA Bahrain · Personal Data Protection Authority
Middle East · National supervisory authority

Global PIA Composite

Primary lawData Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Bangladesh

Authority · Data Protection Board / competent authority
Asia-Pacific · Operational status should be verified

Global PIA Composite

Primary lawData Protection Act

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Barbados

DPC Barbados · Data Protection Commission
Americas · National supervisory authority

Global PIA Composite

Primary lawData Protection Act

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Belarus

NCPDP · National Center for Personal Data Protection
Europe · National Supervisory Authority

Global PIA Composite

Primary lawLaw on Personal Data

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Belgium

APD-GBA · Belgian Data Protection Authority
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Belize

Authority · Information Commissioner / competent data protection authority
Americas · Current authority details should be verified

Global PIA Composite

Primary lawData Protection Act

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Benin

APDP · Personal Data Protection Authority
Africa · National supervisory authority

Global PIA Composite

Primary lawData Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Bhutan

Authority · GovTech Agency / competent privacy authority
Asia-Pacific · Current institutional position should be verified

Global PIA Composite

Primary lawPrivacy Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Bolivia

Authority · Personal Data Protection Agency / competent authority
Americas · Current institutional position should be verified

Global PIA Composite

Primary lawData Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Bosnia and Herzegovina

AZLP · Personal Data Protection Agency in Bosnia and Herzegovina
Europe · National Supervisory Authority

Global PIA Composite

Primary lawLaw on Personal Data

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Botswana

Authority · Information and Data Protection Commission / competent authority
Africa · Current institutional position should be verified

Global PIA Composite

Primary lawPOPIA

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Brazil

ANPD · National Data Protection Authority
Americas · National supervisory authority

Brazil RIPD

Primary lawLGPD

DPIA terminologyRelatório de Impacto à Proteção de Dados Pessoais (RIPD)

Legal positionAssess whether the LGPD, ANPD request, sensitive data, legitimate-interests governance or high-impact processing requires or supports a RIPD.

Trigger testHigh-risk or sensitive processing, profiling, vulnerable people, large scale, legitimate interests, public-sector data sharing or processing identified by the ANPD.

Required methodDescribe data, methodology, safeguards, purposes, necessity, risks, mitigations, responsible persons and evidence.

Authority escalationThe ANPD may request the report. Verify current regulations, guidance and sector-specific requirements.

Review ruleUpdate for material changes and maintain evidence for ANPD scrutiny.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

British Virgin Islands

ICO BVI · Information Commissioner
Americas · National supervisory authority

Global PIA Composite

Primary lawData Protection Act

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Brunei Darussalam

AITI · Authority for Info-communications Technology Industry / competent privacy authority
Asia-Pacific · Current institutional position should be verified

Global PIA Composite

Primary lawData Protection Act

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Bulgaria

CPDP · Commission for Personal Data Protection
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Cambodia

MPTC · Ministry of Posts and Telecommunications / competent privacy authority
Asia-Pacific · Current institutional position should be verified

Global PIA Composite

Primary lawPersonal Data Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Canada

OPC · Office of the Privacy Commissioner of Canada
Americas · Federal privacy authority; provincial authorities may also apply

Canada PIA

Primary lawPIPEDA

DPIA terminologyPrivacy Impact Assessment (PIA)

Legal positionDetermine the applicable federal, provincial and public-sector PIA requirement. Federal institutions should apply the current Treasury Board and OPC process.

Trigger testNew or substantially modified programme, activity, system or service involving personal information, particularly sensitive data, matching, AI, biometrics and cross-border services.

Required methodDescribe authority and programme; map flows; identify privacy risks and compliance gaps; document mitigations, residual risk, approval and submission requirements.

Authority escalationIdentify the correct federal or provincial commissioner and any mandatory review or submission route.

Review ruleUpdate for material programme or technology change and track mitigation implementation.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Chile

CPLT · Council for Transparency / competent data protection authority
Americas · Institutional allocation should be verified

Global PIA Composite

Primary lawLaw 19628

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Colombia

SIC · Superintendence of Industry and Commerce
Americas · National data protection authority

Global PIA Composite

Primary lawLaw 1581

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Congo, Democratic Republic of the

ARPTC · Post and Telecommunications Regulatory Authority / competent data authority
Africa · Current institutional position should be verified

Global PIA Composite

Primary lawData Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Côte d'Ivoire

ARTCI · Telecommunications/ICT Regulatory Authority of Côte d’Ivoire
Africa · Personal data supervisory authority

Global PIA Composite

Primary lawPersonal Data Protection Act

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Croatia

AZOP · Croatian Personal Data Protection Agency
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Cyprus

OCPDP · Office of the Commissioner for Personal Data Protection
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Czech Republic

UOOU · Office for Personal Data Protection
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Denmark

Datatilsynet · Danish Data Protection Agency
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Egypt

PDPC Egypt · Personal Data Protection Centre / competent authority
Africa · Operational authority details should be verified

Global PIA Composite

Primary lawLaw on Regulated Professions

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Estonia

AKI · Estonian Data Protection Inspectorate
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Eswatini

Authority · Eswatini Data Protection Authority / competent regulator
Africa · Current institutional position should be verified

Global PIA Composite

Primary lawPOPIA

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Ethiopia

ECA · Ethiopian Communications Authority / competent privacy authority
Africa · Current institutional position should be verified

Global PIA Composite

Primary lawPrivacy Directive

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Finland

ODPO · Office of the Data Protection Ombudsman
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

France

CNIL · Commission Nationale de l'Informatique et des Libertés
European Union · National Supervisory Authority

CNIL AIPD

Primary lawGDPR

DPIA terminologyAnalyse d’impact relative à la protection des données (AIPD)

Legal positionApply the CNIL required and non-required lists, GDPR Article 35 and the high-risk criteria before processing.

Trigger testNational mandatory-list activity, GDPR Article 35(3), or processing meeting the CNIL / EDPB high-risk criteria.

Required methodUse the CNIL four-part method: context; fundamental principles including necessity and proportionality; privacy risks; formal validation, action plan and ongoing review.

Authority escalationRecord DPO advice. Consult the CNIL before processing where residual high risk remains after mitigation.

Review ruleMaintain the AIPD as a living record and reassess material changes, incidents and control failures.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Germany

BfDI · Federal Commissioner for Data Protection and Freedom of Information
European Union · Federal Supervisory Authority; state authorities also apply

Germany DSK / BfDI DSFA

Primary lawGDPR

DPIA terminologyDatenschutz-Folgenabschätzung (DSFA)

Legal positionApply GDPR Article 35 and the applicable BfDI, DSK or state authority mandatory list according to controller type and competence.

Trigger testMandatory-list processing, significant automated evaluation, extensive monitoring, sensitive data at scale and other likely high-risk processing.

Required methodDescribe processing and legal context; test necessity and proportionality; model threats and impacts on people; document safeguards, DPO advice, residual risk and review.

Authority escalationIdentify the competent federal or state authority. Prior consultation is required where high residual risk remains.

Review ruleReview after significant change and where monitoring shows risk assumptions or controls are no longer valid.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Ghana

DPC Ghana · Data Protection Commission
Africa · National supervisory authority

Global PIA Composite

Primary lawGDPA

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Greece

HDPA · Hellenic Data Protection Authority
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Hong Kong

PCPD · Office of the Privacy Commissioner for Personal Data
Asia-Pacific · Privacy regulator

Hong Kong PIA

Primary lawPDPO

DPIA terminologyPrivacy Impact Assessment (PIA)

Legal positionUse a PIA as accountability and privacy-by-design practice and verify sector or public-body requirements under the PDPO.

Trigger testNew systems, surveillance, biometrics, matching, AI, direct marketing, major sharing or processing that materially changes privacy risk.

Required methodMap data flows, assess Data Protection Principles, identify impacts, controls, owners and residual risks, then monitor implementation.

Authority escalationEngage the Data Protection Officer and consider PCPD guidance or consultation for novel or high-impact processing.

Review ruleReassess material changes and control effectiveness.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Hungary

NAIH · Hungarian National Authority for Data Protection and Freedom of Information
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

India

DPB · Data Protection Board of India
Asia-Pacific · Operational status and contact route should be verified

India DPIA

Primary lawDPDP Act

DPIA terminologyData protection impact / significant data fiduciary assessment

Legal positionVerify current DPDPA rules, significant data fiduciary designation and any sectoral or contractual impact-assessment requirement.

Trigger testHigh-volume or high-risk processing, sensitive sector data, children, profiling, AI, monitoring, cross-border processing and designation-based obligations.

Required methodDescribe purpose and data; test necessity and safeguards; assess harms to data principals; document rights, security, processors, residual risk and approval.

Authority escalationEngage the Data Protection Officer where appointed and verify Data Protection Board or sector regulator expectations.

Review ruleReassess material processing changes and prescribed periodic requirements.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Indonesia

PDP Authority · Personal Data Protection supervisory authority
Asia-Pacific · Institutional arrangements should be verified

Global PIA Composite

Primary lawPDP Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Ireland

DPC · Data Protection Commission
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Israel

PPA Israel · Privacy Protection Authority
Middle East · National supervisory authority

Global PIA Composite

Primary lawPrivacy Law 1981

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Italy

Garante · Garante per la protezione dei dati personali
European Union · National Supervisory Authority

Italy Garante DPIA

Primary lawGDPR

DPIA terminologyValutazione d’impatto sulla protezione dei dati (DPIA)

Legal positionApply GDPR Article 35 and the Garante list of processing subject to DPIA.

Trigger testInnovative technology, systematic monitoring, profiling, vulnerable people, biometric or sensitive data, large scale and other Garante list triggers.

Required methodDocument processing, purposes, necessity, proportionality, rights risks, safeguards, DPO advice, approvals and implementation monitoring.

Authority escalationConsult the Garante before processing where residual high risk cannot be adequately mitigated.

Review ruleUpdate for material processing, technology, vendor, scale or risk changes.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Japan

PPC · Personal Information Protection Commission
Asia-Pacific · National supervisory authority

Japan PIA

Primary lawAPPI

DPIA terminologyPrivacy impact / personal information risk assessment

Legal positionDetermine whether a PIA is required by sector, public-body rules, procurement or organisational governance and apply APPI accountability.

Trigger testSensitive personal information, profiling, AI, large-scale data, cross-border provision, biometrics, location and novel surveillance.

Required methodMap data and third-party provision; identify purpose, notices, consent and security requirements; assess harms; assign safeguards and review.

Authority escalationEngage the privacy lead and relevant sector authority. Verify PPC guidance and notification or consultation requirements.

Review ruleUpdate for new purposes, vendors, transfers, security changes and material risk.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Jordan

PDPC Jordan · Personal Data Protection Council / Ministry of Digital Economy and Entrepreneurship
Middle East · National privacy authority

Global PIA Composite

Primary lawData Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Kenya

ODPC · Office of the Data Protection Commissioner
Africa · National supervisory authority

Global PIA Composite

Primary lawDPA 2019

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Latvia

DVI · Data State Inspectorate
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Lesotho

DPC Lesotho · Data Protection Commission
Africa · National supervisory authority

Global PIA Composite

Primary lawPOPIA

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Lithuania

VDAI · State Data Protection Inspectorate
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Luxembourg

CNPD · National Commission for Data Protection
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Malawi

Authority · Data Protection Authority / Malawi Communications Regulatory Authority
Africa · Competence should be verified

Global PIA Composite

Primary lawPOPIA

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Malaysia

JPDP · Personal Data Protection Commissioner
Asia-Pacific · National supervisory authority

Global PIA Composite

Primary lawPDPA

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Malta

IDPC · Office of the Information and Data Protection Commissioner
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Mexico

Federal authority · Competent federal transparency and personal data authority
Americas · Institutional position should be verified for the date of use

Global PIA Composite

Primary lawLGPD

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Moldova

NCPDP · National Centre for Personal Data Protection
Europe · National Supervisory Authority

Global PIA Composite

Primary lawLaw on Personal Data

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Morocco

CNDP · National Commission for the Control of Personal Data Protection
Africa · National supervisory authority

Global PIA Composite

Primary lawGDPL

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Mozambique

INTIC · National Institute of Information and Communication Technologies / competent authority
Africa · Current institutional position should be verified

Global PIA Composite

Primary lawLPDA

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Netherlands

AP · Dutch Data Protection Authority
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

New Zealand

OPC NZ · Office of the Privacy Commissioner
Asia-Pacific · National privacy authority

New Zealand OPC PIA

Primary lawPrivacy Act 2020

DPIA terminologyPrivacy Impact Assessment (PIA)

Legal positionUse a brief or full PIA proportionate to risk and verify sector or public-body requirements.

Trigger testNew or changed collection, use, disclosure, data matching, AI, biometrics, surveillance, sensitive information or material effects on individuals.

Required methodDefine scope, map information flows, consult, identify privacy impacts, rate risks, assign mitigations, approve and review.

Authority escalationUse the privacy officer and seek OPC advice where significant uncertainty or unresolved risk remains.

Review ruleReview implementation and reassess when processing or risks materially change.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Nigeria

NDPC · Nigeria Data Protection Commission
Africa · National supervisory authority

Global PIA Composite

Primary lawNDPR

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Norway

Datatilsynet · Norwegian Data Protection Authority
Europe · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Peru

ANPD · National Authority for Personal Data Protection
Americas · National supervisory authority

Global PIA Composite

Primary lawLaw 29733

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Philippines

NPC · National Privacy Commission
Asia-Pacific · National supervisory authority

Global PIA Composite

Primary lawDP Act 2012

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Poland

UODO · Personal Data Protection Office
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Portugal

CNPD · National Data Protection Commission
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Qatar

NCGAA · National Cyber Governance and Assurance Affairs / competent privacy authority
Middle East · Current institutional position should be verified

Global PIA Composite

Primary lawData Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Romania

ANSPDCP · National Supervisory Authority for Personal Data Processing
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Russian Federation

Roskomnadzor · Federal Service for Supervision of Communications, Information Technology and Mass Media
Europe · Federal supervisory authority

Global PIA Composite

Primary lawFederal Law on Personal Data

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Saudi Arabia

SDAIA/NDMO · Saudi Data and Artificial Intelligence Authority / National Data Management Office
Middle East · National data governance authority

Global PIA Composite

Primary lawData Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Singapore

PDPC · Personal Data Protection Commission
Asia-Pacific · National regulatory authority

Singapore PDPC DPIA

Primary lawPDPA

DPIA terminologyData Protection Impact Assessment (DPIA)

Legal positionApply a lifecycle-based DPIA as accountability practice and verify any sectoral or contractual mandate.

Trigger testNew or changed high-impact processing, sensitive information, profiling, monitoring, AI, large-scale sharing or cross-border processing.

Required methodScope and describe processing; assess compliance, necessity, proportionality and risks; identify safeguards; approve; implement; monitor and review.

Authority escalationEngage the Data Protection Officer and sector regulator where applicable. Verify whether notification or consultation is required for the particular processing.

Review ruleMaintain throughout the system and data lifecycle.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Slovakia

UOOU SR · Office for Personal Data Protection of the Slovak Republic
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Slovenia

IP-RS · Information Commissioner of the Republic of Slovenia
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

South Africa

IR · Information Regulator
Africa · National supervisory authority

South Africa PIA

Primary lawPOPIA

DPIA terminologyPrivacy impact and risk assessment under POPIA accountability

Legal positionUse a documented assessment to demonstrate responsible-party accountability and verify current Information Regulator guidance and sector rules.

Trigger testSpecial personal information, children, biometrics, profiling, surveillance, extensive matching, cross-border processing or material risk to data subjects.

Required methodDocument purpose, lawful justification, minimality, openness, security safeguards, participation rights, operators, cross-border conditions, risks and controls.

Authority escalationEngage the Information Officer and determine whether prior authorisation or regulator engagement applies to the processing.

Review ruleReview on material change, incident, complaint or control failure.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Spain

AEPD · Spanish Data Protection Agency
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Sweden

IMY · Swedish Authority for Privacy Protection
European Union · National Supervisory Authority

EU / EEA DPIA

Primary lawGDPR

DPIA terminologyGDPR Data Protection Impact Assessment (Article 35)

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Switzerland

FDPIC · Federal Data Protection and Information Commissioner
Europe · Federal Supervisory Authority

Switzerland DPIA

Primary lawFederal Data Protection Act

DPIA terminologyData protection impact assessment under the Federal Act on Data Protection

Legal positionAssess planned processing likely to result in high risk to personality or fundamental rights and verify current federal guidance.

Trigger testSensitive personal data at scale, systematic monitoring, profiling with high risk, innovative or extensive processing and other circumstances creating likely high risk.

Required methodDescribe processing; assess risks to affected people; document measures; consult the data protection adviser where appointed; record residual risk and decision.

Authority escalationDetermine whether consultation with the FDPIC is required where high residual risk remains and is not resolved through the statutory adviser route.

Review ruleUpdate where risk or processing changes materially.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Tanzania

PDPC Tanzania · Personal Data Protection Commission
Africa · National supervisory authority

Global PIA Composite

Primary lawDPA 2022

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Thailand

PDPC · Personal Data Protection Committee / Office of the PDPC
Asia-Pacific · National supervisory authority

Global PIA Composite

Primary lawPDPA

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Uganda

PDPO · Personal Data Protection Office
Africa · National supervisory authority

Global PIA Composite

Primary lawDPA 2019

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United Arab Emirates

UAE Data Office · UAE Data Office
Middle East · Federal privacy authority; free-zone regulators may also apply

Global PIA Composite

Primary lawData Protection Law

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United Kingdom

ICO · Information Commissioner's Office
Europe · National Supervisory Authority

UK ICO DPIA

Primary lawUK GDPR

DPIA terminologyUK GDPR Data Protection Impact Assessment

Legal positionComplete a DPIA before high-risk processing. Apply UK GDPR Article 35, the ICO high-risk processing list and current UK guidance.

Trigger testSystematic evaluation with significant effects, large-scale special-category or criminal data, systematic public monitoring and other processing identified by the ICO as likely high risk.

Required methodDescribe processing and consultation; assess necessity and proportionality; identify and assess risks to rights and freedoms; identify measures and safeguards; record DPO advice and sign-off.

Authority escalationConsult the DPO. Submit a prior-consultation request to the ICO before processing where identified high residual risk cannot be reduced.

Review ruleKeep the DPIA under review and update it when the nature, scope, context, purposes, technology or risk changes.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Alabama

AL AG · Alabama Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Trigger testWhere regulated by the applicable state law: sale or sharing, targeted advertising, sensitive data, profiling or automated decision-making, substantial privacy risk, unfair treatment, financial or physical injury, intrusion or other defined heightened-risk processing.

Required methodDocument purpose, benefits, data categories, affected consumers, profiling logic where relevant, foreseeable harms, safeguards, necessity, alternatives, residual risk and approval. Preserve the assessment for regulator production where required.

Authority escalationConfirm the enforcing Attorney General, privacy agency and any sector regulator. Verify whether the assessment must be filed, certified, produced on request or retained internally.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Alaska

AK AG · Alaska Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Arizona

AZ AG · Arizona Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Arkansas

AR AG · Arkansas Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawACDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - California

CPPA · California Privacy Protection Agency
United States · State privacy regulator; Attorney General also has enforcement functions

California CPPA Risk Assessment

Primary lawCCPA/CPRA

DPIA terminologyCalifornia privacy risk assessment

Legal positionApply California risk-assessment requirements and rules to covered processing that presents significant risk to consumers’ privacy.

Trigger testCovered processing identified by current CCPA regulations, including relevant sale or sharing, sensitive data, profiling or automated decision-making and other significant-risk activity.

Required methodDocument purpose, benefits, data categories, affected consumers, safeguards, negative impacts, necessity, alternatives, responsible persons and certification or submission requirements.

Authority escalationIdentify CPPA and Attorney General competence. Verify filing, certification, timing and record-retention requirements in the current regulations.

Review ruleUpdate when processing materially changes and at any required periodic interval.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Colorado

CO AG · Colorado Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawCPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Connecticut

CT AG · Connecticut Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawCTDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Delaware

DE AG · Delaware Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawDPDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - District of Columbia

DC AG · District of Columbia Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Florida

FL AG · Florida Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFDBR

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Georgia

GA AG · Georgia Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Hawaii

HI AG · Hawaii Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Idaho

ID AG · Idaho Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Illinois

IL AG · Illinois Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Indiana

IN AG · Indiana Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawICDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Iowa

IA AG · Iowa Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawICDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Kansas

KS AG · Kansas Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Kentucky

KY AG · Kentucky Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawKCDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Louisiana

LA AG · Louisiana Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Maine

ME AG · Maine Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Maryland

MD AG · Maryland Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawMODPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Massachusetts

MA AG · Massachusetts Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Michigan

MI AG · Michigan Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Minnesota

MN AG · Minnesota Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawMNDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Mississippi

MS AG · Mississippi Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Missouri

MO AG · Missouri Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Montana

MT AG · Montana Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawMCDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Nebraska

NE AG · Nebraska Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawNDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Nevada

NV AG · Nevada Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawNDPP

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - New Hampshire

NH AG · New Hampshire Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawNHDPP

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - New Jersey

NJ AG · New Jersey Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawNJDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - New Mexico

NM AG · New Mexico Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - New York

NY AG · New York Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawNYDSA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - North Carolina

NC AG · North Carolina Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - North Dakota

ND AG · North Dakota Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Ohio

OH AG · Ohio Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Oklahoma

OK AG · Oklahoma Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Oregon

OR AG · Oregon Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawOCPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Pennsylvania

PA AG · Pennsylvania Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Rhode Island

RI AG · Rhode Island Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - South Carolina

SC AG · South Carolina Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - South Dakota

SD AG · South Dakota Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Tennessee

TN AG · Tennessee Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawTIPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Texas

TX AG · Texas Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawTDPSA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Utah

UT AG · Utah Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawUCPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Vermont

VT AG · Vermont Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawVDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Virginia

VA AG · Virginia Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawVCDPA

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Washington

WA AG · Washington Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - West Virginia

WV AG · West Virginia Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Wisconsin

WI AG · Wisconsin Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

United States - Wyoming

WY AG · Wyoming Attorney General
United States · State Attorney General / privacy enforcer

US State Data Protection Assessment

Primary lawFederal Law

DPIA terminologyUS state data protection assessment / risk assessment

Legal positionNo single federal DPIA regime applies across all processing. Test the current state law and rules for assessments covering processing that presents heightened risk.

Review ruleRepeat when processing materially changes and at the cadence required by applicable regulations or the approved risk programme.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Vietnam

MPS · Ministry of Public Security / competent personal data authority
Asia-Pacific · National competent authority

Global PIA Composite

Primary lawLaw on Info Security

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

Zambia

DPA Zambia · Data Protection Commissioner / Data Protection Authority
Africa · National supervisory authority

Global PIA Composite

Primary lawPOPIA

DPIA terminologyPrivacy Impact Assessment / Data Protection Impact Assessment

Review ruleReview before launch and whenever purpose, data, technology, geography, vendors, access, scale or risk changes. Record incidents, complaints and control test results.

Respondent: Provide factual system, data-flow and control evidence. Identify uncertainty and do not assume a control operates without test evidence.

Approver: Confirm necessity, proportionality, control ownership, evidence, residual risk acceptance, conditions, end date and review date.

Authority-specific DPIA position must be verified against current law and official guidance at the assessment decision date.

Authority website ↗

🚀

Launch Assessment

Select a jurisdiction and scenario template, assign roles, set respondent and end dates and prepare the secure respondent pack

New assessment

Required fields are marked *

Assessment title *

Template *

Jurisdiction or scope *

Business owner *

Respondent name or role *

Respondent email *

Approver *

Response due date *

Assessment end date *

Initial risk

DPO or privacy lead

Purpose and briefing note

Decision-tree screening

Before launch

Does the project process personal data or materially affect privacy?If no, record a threshold decision. If yes, continue.

Does an authority list or US state trigger expressly require an assessment?Check selected jurisdictions, sensitive data, profiling, sale, targeted advertising, ADMT and minors.

Are two or more EDPB high-risk indicators present, or one sufficiently serious indicator?Scoring, significant decisions, monitoring, sensitive data, scale, matching, vulnerable groups, innovation and denial of rights or service.

Can the processing be redesigned before assessment?Assess necessity, less intrusive alternatives and privacy by design before committing to the architecture.

⚙

Assessment Workflow

Eight governed stages from threshold screening to closure, monitoring and reassessment

Total assessments5

Open5

Overdue responses1

High risk4

Comments1

Templates19

Lifecycle for test

Current stage 1 of 8

Intake and thresholdRequester / Privacy analyst: Scope, jurisdictions and assessment need recorded

Current

Respondent evidenceRespondent / SMEs: Processing, data flows, purposes, roles and controls evidenced

Pending

Necessity and rightsBusiness owner / Legal: Necessity, proportionality, legal basis, transparency and rights tested

Pending

Risk analysisPrivacy / Security: Risk events scored and controls linked to operating evidence

Pending

DPO reviewDPO: Independent advice, consultation decision and conditions recorded

Pending

Approver decisionAccountable approver: Approve, reject or require changes with risk acceptance rationale

Pending

Implementation validationControl owners: Conditions implemented, tested and evidenced

Pending

Closure and monitoringAssessment owner: End date, review triggers and continuing monitoring set

Pending

Role-specific responsibilities

Requester: Define the change, sponsor, outcome and required decision.

Respondent: Provide complete factual answers, diagrams, contracts, configurations and control evidence.

Privacy analyst: Test threshold, scope, necessity, proportionality, rights and risk to people.

Security: Evidence technical controls, threat scenarios, detection, recovery and testing.

Legal: Confirm roles, bases, statutory duties, contracts, rights and consultation triggers.

DPO: Advise independently, challenge unsupported claims and record prior-consultation decision.

Approver: Own the decision, conditions and any accepted residual risk.

Control owner: Implement, test and maintain each mitigation and review trigger.

Workflow integrity checks

Complete 16 unanswered assessment questions.Suggested from current answers, dates, risk evidence and workflow state.

Identify and score risk events for affected people.Suggested from current answers, dates, risk evidence and workflow state.

📚

DPIA and PIA Template Library

Jurisdiction-specific, role-specific and scenario-specific assessment packs

EDPB 2026 DPIA Meta-Template

EU/EEA
General high-risk processing

EU-EDPB-2026 16 core questions

UK ICO DPIA

UK
UK GDPR high-risk processing

UK-ICO 16 core questions

CNIL AIPD

France
French AIPD method

FR-CNIL 16 core questions

Germany DSK DSFA

Germany
German mandatory-list and high-risk review

DE-DSK 16 core questions

Italy Garante DPIA

Italy
Innovative technology or systematic monitoring

IT-GARANTE 16 core questions

AI and Automated Decisioning DPIA

Global
AI, profiling, LLM and agentic systems

AI-ADM 16 core questions

Employee Monitoring DPIA

Global
Email, device, productivity, CCTV and location monitoring

EMP-MON 16 core questions

Biometric and Facial Recognition DPIA

Global
Identification, verification or categorisation

BIO 16 core questions

Children and Age Assurance DPIA

Global
Services likely to be accessed by children

CHILD 16 core questions

Health, Genetic and Research DPIA

Global
Health, genetic, clinical and research data

HEALTH 16 core questions

CCTV and Systematic Monitoring DPIA

Global
Public spaces, workplaces and video analytics

CCTV 16 core questions

Location and Tracking DPIA

Global
Precise geolocation, telematics and movement patterns

LOC 16 core questions

Cloud, Vendor and Data Platform DPIA

Global
Cloud, SaaS, data lake and platform migration

CLOUD 16 core questions

Data Sharing and Matching DPIA

Global
Inter-agency sharing, matching and enrichment

SHARE 16 core questions

Connected Device and IoT DPIA

Global
Sensors, smart devices and ambient collection

IOT 16 core questions

US State Data Protection Assessment

United States
Sale, targeted advertising, sensitive data, profiling and ADMT

US-STATE 16 core questions

Global PIA Composite

Global
Multi-jurisdiction programme or system

GLOBAL 16 core questions

Combined DPIA and Transfer Assessment

Global
Cross-border processing and remote access

TRANSFER 16 core questions

AI Fundamental Rights Impact Assessment

EU/Global
High-impact or high-risk AI

FRIA 16 core questions

🏛

Authority Guidance and Jurisdiction Rules

Official authority library, divergence alerts and current-status warnings for assessment decisions

Legal currency control: EDPB 2026 template is still pending finalisation. ICO guidance states it is under review following UK legislative changes. PRIVASTU records source status and requires human verification at final sign-off.

Official guidance library

11 sources

EDPB · EU/EEA

2026 DPIA consultation meta-template · Draft pending finalisation
Use with WP248 criteria. The consultation closed in June 2026 and the final common template is pending.

Open official source

ICO · United Kingdom

UK DPIA guidance · Current but under review
The ICO states its guidance is under review following the Data (Use and Access) Act. Verify current guidance before final legal sign-off.

Open official source

CNIL · France

AIPD method, templates and knowledge bases · Current
Context, fundamental principles, privacy risks and formal validation. Includes required and non-required processing lists.

Open official source

BfDI / DSK · Germany

DSFA and mandatory processing lists · Current
Structured prior risk analysis with lists for federal public bodies and non-public controllers.

Open official source

Garante · Italy

DPIA guidance and tools · Current
High-risk processing, systematic monitoring, sensitive data and innovative technologies require close assessment.

Open official source

CPPA · California

Risk assessment and ADMT regulations · Effective 1 January 2026
Final regulations cover risk assessments, cybersecurity audits and automated decisionmaking technology.

Open official source

Connecticut AG · Connecticut

Data protection and profiling impact assessments · Current
Heightened-risk processing and profiling assessments require purpose, context, data, performance, limitations, monitoring and safeguards.

Open official source

OAIC · Australia

10-step Privacy Impact Assessment · Current
Threshold, plan, describe, consult, map flows, analyse, manage, recommend, report and review.

Open official source

NZ OPC · New Zealand

PIA toolkit · Updated October 2025
Brief analysis, full PIA, risk table and review, including AI use.

Open official source

OPC Canada · Canada

PIA process and federal submission · Updated 2025
Risk-proportionate PIA before new or substantially modified programmes using personal information.

Open official source

PDPC · Singapore

Guide to Data Protection Impact Assessments · Current
Lifecycle-based assessment aligned to PDPA accountability.

Open official source

Jurisdiction decision rules

EU/EEA: assess before processing where high risk is likely. Use national Article 35 lists and consult the authority if residual high risk remains.

UK: screen for likely high risk, complete before processing and preserve DPO advice. Verify current ICO guidance at decision date.

France: apply CNIL required/non-required lists, nine criteria and the four-part AIPD method.

Germany: identify public or non-public sector and test the applicable BfDI or DSK mandatory list.

Italy: consider Garante list triggers, including innovative technologies and systematic monitoring.

US states: assess sale, targeted advertising, sensitive data, profiling and ADMT under applicable state laws. California regulations are effective from 1 January 2026.

Global PIA: add stakeholder consultation, information-flow mapping, recommendations, implementation ownership and ongoing review.

Coverage disclaimer

The library supports major authority methods and an extensible jurisdiction layer. It does not claim to reproduce every national or subnational supervisory authority document. Final legal conclusions must be verified against the authority responsible for the actual processing.

Vendor	Category	Data Role	Risk Tier	Risk Score	DPA Status	Last Assessed	Next Review
Ketch	Privacy management	US	Signed	Yes	Complete	Medium	Approved
FilersKeepers	Retention tooling	UK	In negotiation	N/A	Pending	Medium	Review
Cloud AI Labs	Model hosting	US	Draft	Required	Open issues	High	Blocked

Risk Distribution

Highest Risk Vendors

Ranked by composite risk score

Risk Heat Map

Likelihood × Impact

DPA / Contract Status

Certification Coverage

Vendor	Framework	Sent	Due	Status	Completion	Risk finding	Actions

Assessment Questionnaire Library

10 governance frameworks. Click any questionnaire to preview, customise, or send. All templates use [CLIENT_ENTITY] placeholders - populated when deployed for a client.

Vendor	Document type	Version	Signed date	Expiry date	Status	Actions

Onboarding Pipeline

Periodic Review Schedule

Offboarding Tracker

Vendors in offboarding - data deletion confirmation, contract termination, access revocation

Risk by Category

Risk by Geography

Assessment Completion Rate

Transfer Mechanism Coverage

Board-Ready Report

Narrative summary of vendor risk posture for board or audit committee

Portal Configuration

Portal URL

Portal branding - display name

Welcome message to vendors

Contact for vendor queries

Require authentication

Auto-reminders

Evidence upload enabled

Active Portal Sessions

Reminder Schedule

First reminder

Second reminder

Overdue escalation

Escalate to

Contracts & Data Processing Agreements

Central register of all vendor contracts, DPAs, SCCs and addenda. Expiry alerts and renewal workflow integrated.

Vendor	Document type	Version	Signed	Expires	SCCs / TIA	Data roles	Jurisdiction	Status

Fourth-Party Risk

Sub-processors, nested dependencies and supply-chain relationships disclosed by your vendors. Maps concentration risk and regulatory exposure across the vendor ecosystem.

Dependency map

Vendor → sub-processor chains

Concentration risk

Sub-processors used by multiple vendors

Disclosed sub-processors

Sub-processor	Country	Service	Used by vendors	Data categories	Transfer mechanism	Risk

Vendor Monitoring & Alerts

Continuous monitoring of vendor risk signals - DPA expiry, assessment overdue, security incidents, news monitoring and regulatory changes affecting your vendor base.

DPA expiries - 60 days

Assessment overdue

Risk score changes

Alert rules

Vendor Risk Reports & Analytics

Board-ready reports, regulatory compliance summaries and operational analytics across the full vendor estate.

Risk distribution

Vendors by risk level

Assessment coverage

% of vendors assessed by framework

Export report packages

PRIVASTU · Policy Management

Complete | Intelligent | Policy Governance

25 deployable policy templates · version control · approval workflows · attestation campaigns · cross-module intelligence · regulatory change tracking

⚠ 2 policies overdue - DSAR Handling Standard & AI Governance Standard require immediate review

↻ 4 policies due within 30 days - schedule reviews now to maintain compliance posture

🌍 EU AI Act Aug 2026 - AI Governance Policy template updated with Annex III FRIA requirements

✓ 15 policies published - core GDPR programme coverage achieved

Total policies

In register

Published

Active and current

In review / Draft

Need attention

Overdue

Past review date

11/12

Mandatory coverage

Core GDPR policies published

78%

Avg health score

Completeness index

Policy	Category	GDPR / Legal basis	Mandatory	Owner	Version
Master Privacy Policy	v4.2	Group Privacy Office	2026-04-15	Global	Published
DSAR Handling Standard	v2.1	Privacy Ops	2026-03-30	HR / Legal	In review
AI Governance Standard	v1.0	AI Office	2026-03-25	All staff	Draft

25 fully deployable, GDPR-compliant policy templates. Each includes all required clauses, defined roles and responsibilities, review triggers and cross-references to related policies and modules. Click any template to view the full document.

Core GDPR Published

Art. 12 - 14

Public-facing transparency notice for all personal data processing. Meets Art. 13/14 requi…

Mandatory

Core GDPR Published

Internal Data Protection Policy

Art. 5(2), 24

Master internal policy demonstrating accountability and governance. Sets out roles, respon…

Mandatory

Core GDPR Published

Data Retention and Deletion Policy

Art. 5(1)(e)

Establishes maximum retention periods per data category and lawful basis, deletion schedul…

Mandatory

Core GDPR Published

Data Breach Response and Notification Policy

Art. 33, 34

Defines the 72-hour ICO notification process, severity classification, internal escalation…

Mandatory

Core GDPR In Review

Data Subject Rights Handling (DSAR) Policy

Art. 15 - 22

End-to-end procedure for handling all data subject rights requests. Covers verification, t…

Mandatory

Core GDPR Published

DPIA Procedure

Art. 35

Step-by-step procedure for conducting Data Protection Impact Assessments. Includes Article…

Mandatory

Technical Published

Information Security Policy

Art. 32

Technical and organisational security measures for personal data processing. Aligned to IS…

Mandatory

Operational Published

Data Classification and Handling Policy

Art. 5, 24

Defines four-tier classification scheme (Confidential, Restricted, Internal, Public) with …

Recommended

Governance Published

Third-Party Processor / Vendor Management Policy

Art. 28

Due diligence requirements for appointing processors, mandatory DPA terms, sub-processor c…

Recommended

Governance Published

Training and Privacy Awareness Policy

Art. 24, 39

Mandatory privacy training requirements, frequency, content standards, role-specific modul…

Recommended

Core GDPR Published

International Data Transfers Policy

Art. 44 - 49

Lawful mechanisms for international transfers (SCCs, IDTA, BCRs, adequacy decisions, DPF).…

Recommended

Governance Published

Data Governance and Accountability Framework

Art. 5(2), 24

Overarching accountability framework defining privacy governance structure, RACI matrix, b…

Recommended

Technical Published

BYOD and Remote Working Policy

Art. 32

Security controls for personal devices, remote access, home network standards, VPN require…

Recommended

Technical Published

Acceptable Use Policy (AUP)

Art. 32

Permitted and prohibited use of IT systems, data and internet access. Social media, person…

Recommended

Specialist Published

Cookie and Tracking Technology Policy

UK PECR / ePrivacy

Cookie categories, consent requirements under UK PECR and ePrivacy Directive, cookie notic…

Mandatory

Specialist Draft

AI Governance and Automated Decision-Making Policy

Art. 22 · EU AI Act

Governance of AI systems including Annex III high-risk AI, EU AI Act FRIA requirements, au…

Recommended

Core GDPR Published

Legitimate Interests Assessment (LIA) Procedure

Art. 6(1)(f)

Three-part LIA test procedure (purpose, necessity, balancing), documentation requirements,…

Recommended

Core GDPR Published

Consent Management Policy

Art. 6(1)(a), 7

Valid consent standards (freely given, specific, informed, unambiguous), withdrawal mechan…

Mandatory

Specialist Published

Children's Data and Online Safety Policy

Art. 8 · UK AADC

Age verification standards, UK Age-Appropriate Design Code (AADC) obligations, children's …

Mandatory

Specialist Published

Special Category Data Processing Policy

Art. 9, 10

Processing conditions for health, biometric, genetic, racial/ethnic origin, religious, pol…

Mandatory

Specialist Published

Employee Monitoring and Workplace Surveillance Policy

Art. 88 · Employment law

Lawful basis for employee monitoring (email, internet, location, CCTV, productivity tools)…

Recommended

Governance Published

Privacy by Design and Default Policy

Art. 25

Privacy by design obligations for new products, systems and processes. Data minimisation d…

Recommended

Governance Published

Whistleblowing and Privacy Disclosure Policy

EU Whistleblower Directive · Art. 24

Secure whistleblowing channel governance, reporter anonymity protections, investigation da…

Recommended

Core GDPR Published

Records Management and RoPA Governance Policy

Art. 30, 5(2)

Standards for maintaining, updating and auditing Records of Processing Activities. Respons…

Mandatory

Technical Draft

NIS2 and Operational Resilience Policy

NIS2 Directive · Art. 32

NIS2 Directive obligations for essential/important entities: risk management, incident rep…

Recommended

Active approval workflows

Policies currently in review or awaiting sign-off

AI Governance PolicyUrgent

9d in stage

Stage: DPO Review · Owner: AI Office · Since 12 Mar Mar

DSAR Handling Standard

3d in stage

Stage: Legal sign-off · Owner: Privacy Ops · Since 18 Mar Mar

NIS2 Operational Resilience Policy

7d in stage

Stage: CISO review · Owner: Security · Since 14 Mar Mar

Employee Monitoring Policy (update)

16d in stage

Stage: HR / Union consultation · Owner: HR · Since 05 Mar Mar

Workflow stages

Draft

Policy owner creates initial draft. AI grammar and compliance check runs automatically.

Legal / DPO review

Legal counsel and DPO review for compliance accuracy, regulatory completeness and internal consistency.

Stakeholder sign-off

Relevant department heads and CISO sign off via digital attestation. Countersignature recorded.

Published

Policy published to policy portal. Attestation campaign auto-triggered. Next review date set.

Completed reviews (this quarter)

Data Retention Policy

Approved by: DPO + Legal + Board

10 Mar Mar ✓

Special Category Data Policy

Approved by: DPO + HR Director

02 Mar Mar ✓

Privacy by Design Policy

Approved by: DPO + CTO

22 Feb Mar ✓

Active attestation campaigns

Staff acknowledgement of published policies

Internal Data Protection Policy

92%

287/312 staff · Deadline: 31 Mar

Acceptable Use Policy (AUP)

95%

296/312 staff · Deadline: 31 Mar

AI Governance PolicyNew

25%

12/48 staff · Deadline: 14 Apr

Information Security Policy

97%

304/312 staff · Deadline: 01 Mar

Completion rates

Overall programme attestation: 94% of staff have acknowledged all mandatory policies. Non-completions are tracked below.

Internal Data Protection Polic…

92%

Acceptable Use Policy (AUP)…

95%

AI Governance Policy…

25%

Information Security Policy…

97%

Non-completions requiring action

Staff who have not yet acknowledged mandatory policies

16 staff members have not completed all mandatory attestations. Automated reminder scheduled for 25 March.

Staff member	Department	Outstanding policies
James T.	Engineering	AI Governance Policy
Sarah M.	Marketing	AI Governance · AUP
+ 14 more · Export full list

PRIVASTU Policy Intelligence

AI-powered gap analysis vs GDPR, UK GDPR, EU AI Act, NIS2, ISO 27001 requirements

Critical gaps

Significant gaps

Minor gaps

Policies adequate

PRIVASTU analysis: Your core GDPR policy programme is largely in place (15 of 25 policies adequate). The two critical gaps are your AI Governance Policy (overdue - EU AI Act Annex III deadline August 2026) and the NIS2 Operational Resilience Policy (in draft - NIS2 already in force). Completing these two would raise your programme maturity from Medium to High.

Critical

EU AI Act Annex III - policy absent

AI Governance Policy is in draft with 42% health score. Three AI systems may require FRIA by August 2026. Action: Complete POL-016 immediately.

Critical

NIS2 Directive coverage gap

NIS2 Operational Resilience Policy (POL-025) is in draft. NIS2 is already in force for essential/important entities. 24-hour incident reporting obligation not yet documented.

Significant

Children's data policy health score below target

POL-019 health score 69%. UK Age-Appropriate Design Code (AADC) obligations not fully reflected. Age verification standards need updating.

Significant

DSAR Policy overdue for review

POL-005 is In Review and past its review date. DSAR Handling Standard must be current at all times given direct regulatory exposure.

Minor

LIA Procedure not cross-linked to RoPA

POL-017 health score 72%. The Legitimate Interests Assessment procedure should reference the RoPA records that use Art. 6(1)(f) as lawful basis.

Positive

Core GDPR programme: adequate

Policies POL-001 through POL-014 collectively cover all mandatory GDPR requirements. Board-level accountability framework (POL-012) is published - a differentiator from 62% of peer organisations.

Upcoming reviews - next 90 days

days

Acceptable Use Policy (AUP)

2026-09-01 · CISO / HR

days

Privacy by Design and Default Policy

2026-10-01 · DPO / Product / IT

Overdue reviews

⚠

Was due: 2026-04-15

⚠

Internal Data Protection Policy

Was due: 2026-03-15

⚠

Data Retention and Deletion Policy

Was due: 2026-05-01

⚠

Data Breach Response and Notification Policy

Was due: 2026-02-01

⚠

Data Subject Rights Handling (DSAR) Policy

Was due: 2026-03-30

⚠

DPIA Procedure

Was due: 2026-01-01

⚠

Information Security Policy

Was due: 2026-04-15

⚠

Data Classification and Handling Policy

Was due: 2026-06-01

⚠

Third-Party Processor / Vendor Management Policy

Was due: 2026-03-01

⚠

Training and Privacy Awareness Policy

Was due: 2026-05-01

⚠

International Data Transfers Policy

Was due: 2026-05-01

⚠

Data Governance and Accountability Framework

Was due: 2026-04-01

⚠

BYOD and Remote Working Policy

Was due: 2026-02-01

⚠

Cookie and Tracking Technology Policy

Was due: 2026-04-01

⚠

AI Governance and Automated Decision-Making Policy

Was due: 2026-03-25

⚠

Legitimate Interests Assessment (LIA) Procedure

Was due: 2026-06-01

⚠

Consent Management Policy

Was due: 2026-03-01

⚠

Children's Data and Online Safety Policy

Was due: 2026-01-01

⚠

Special Category Data Processing Policy

Was due: 2026-02-01

⚠

Employee Monitoring and Workplace Surveillance Policy

Was due: 2026-05-01

⚠

Whistleblowing and Privacy Disclosure Policy

Was due: 2026-06-01

⚠

Records Management and RoPA Governance Policy

Was due: 2026-03-01

⚠

NIS2 and Operational Resilience Policy

Was due: 2026-06-01

Review triggers

📅 Annual scheduled - all policies reviewed minimum annually

⚖ Regulatory change - triggered when PRIVASTU Horizon detects relevant law change

🔴 Incident trigger - relevant policy reviewed after any related incident

🔧 Process change - triggered when linked RoPA record or vendor is materially updated

📋 Assessment finding - DPIA or LIA finding triggers linked policy review

PRIVASTU · Global Data Retention & Destruction

Global retention intelligence and coached implementation

A jurisdiction-aware operational library, defensible retention schedule, secure disposition workflow, legal-hold register, 75-control implementation programme, role queues, evidence trail and email-ready report studio.

Reliance standard: this workspace is a global operational baseline rather than a substitute for current local legal advice. Every fixed period must be traced to its purpose, statutory floor, maximum or limitation period, sector rule, legal hold and official source before approval. Profiles marked “local validation required” must not be treated as final law.

143jurisdictions / states

2574obligation coverage points

61schedule rules

75programme controls

0disposition events

0active holds

Implementation position

Phase 1 · Foundation0% · 0/15 complete

Phase 2 · Design0% · 0/20 complete

Phase 3 · Implementation0% · 0/25 complete

Phase 4 · Validation & Maturity0% · 0/15 complete

Coached next steps

Approve the first schedule baseline

Select priority record classes, validate official sources and obtain owner/legal approval.

Configure legal hold governance

Create the hold roles, notice template, periodic review and formal release process.

Run a controlled disposition pilot

Select a low-complexity repository, document exclusions, validate deletion and issue a certificate.

14 rules are due for review

Revalidate purpose, law, system scope, notices and technical enforcement.

Priority legal and operational signals

Legal sources require verification

61 schedule rules remain a working baseline rather than approved local law.

Secure sanitisation assurance

Disposition method must match media type, sensitivity, recoverability and validation evidence.

Derived and replicated data

Ensure erasure propagates to backups, copies, embeddings, feature stores, exports and processors.

Over-retention risk

0 programme items are blocked, overdue or at risk; 0 are currently in progress.

Role accountability

Data OwnerConfirm purpose, record population, trigger, business need, system scope and operational impact.0 controls

Records ManagementMaintain the schedule, classification, lifecycle states, review calendar, archival decisions and evidence standards.0 controls

Privacy / DPOChallenge purpose, proportionality, transparency, rights impact, processor propagation and global consistency.75 controls

LegalIdentify statutory floors, limitation periods, privilege, litigation exposure, legal holds and local-law conflicts.75 controls

IT / SecurityTranslate approved rules into system controls, deletion jobs, backup cycles, validation and recoverability limits.0 controls

ApproverConfirm legal source, proportionality, operational feasibility, ownership, residual risk and evidence before sign-off.0 controls

143visible jurisdictions

2574visible coverage points

40official-source profiles

103local validation required

18record domains

Quarterlylegal currency review

Albania

Information and Data Protection Commissioner · Europe

Primary law: Personal Data Protection Law

Domain lens: All record domains

Retention principle: Purpose limitation and proportional retention generally apply, with national privacy, labour, tax, corporate and archival law determining exact periods.

Operational duty: Document a purpose, trigger, statutory floor, maximum and local-law source.

Destruction: Securely erase, anonymise or transfer to an authorised archive.

Local validation required Checked: Baseline generated 22 July 2026

Algeria

National Authority for the Protection of Personal Data · Africa

Primary law: Data Protection Law

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Andorra

Andorran Data Protection Agency · Europe

Primary law: Organic Law on Data Protection

Domain lens: All record domains

Retention principle: Purpose limitation and proportional retention generally apply, with national privacy, labour, tax, corporate and archival law determining exact periods.

Operational duty: Document a purpose, trigger, statutory floor, maximum and local-law source.

Destruction: Securely erase, anonymise or transfer to an authorised archive.

Local validation required Checked: Baseline generated 22 July 2026

Angola

Data Protection Agency · Africa

Primary law: LDP

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Antigua and Barbuda

Information Commissioner · Americas

Primary law: Data Protection Act

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Argentina

Agency of Access to Public Information · Americas

Primary law: LGPDP

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Armenia

Personal Data Protection Agency · Europe

Primary law: Law on Personal Data

Domain lens: All record domains

Retention principle: Purpose limitation and proportional retention generally apply, with national privacy, labour, tax, corporate and archival law determining exact periods.

Operational duty: Document a purpose, trigger, statutory floor, maximum and local-law source.

Destruction: Securely erase, anonymise or transfer to an authorised archive.

Local validation required Checked: Baseline generated 22 July 2026

Australia

Office of the Australian Information Commissioner · Asia-Pacific

Primary law: Privacy Act

Domain lens: All record domains

Retention principle: APP 11 requires reasonable steps to destroy or de-identify personal information no longer needed, subject to law and recognised exceptions.

Operational duty: Apply retention to all copies, backups, cloud services and providers; document legal requirements and the practical point at which data is beyond use.

Destruction: Destroy or de-identify securely and verify third-party and backup treatment.

Official-source profile Checked: 22 July 2026

Official source

Austria

Austrian Data Protection Authority · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Operational duty: Set purpose-linked periods or objective criteria; separate active use, restricted archive and deletion; retain longer only where a lawful obligation, claim or research/archive derogation is documented.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Azerbaijan

Ministry of Digital Development and Transport / competent authority · Europe

Primary law: Law on Personal Data

Domain lens: All record domains

Retention principle: Purpose limitation and proportional retention generally apply, with national privacy, labour, tax, corporate and archival law determining exact periods.

Operational duty: Document a purpose, trigger, statutory floor, maximum and local-law source.

Destruction: Securely erase, anonymise or transfer to an authorised archive.

Local validation required Checked: Baseline generated 22 July 2026

Bahamas

Data Protection Commissioner · Americas

Primary law: Data Protection Act

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Bahrain

Personal Data Protection Authority · Middle East

Primary law: Data Protection Law

Domain lens: All record domains

Retention principle: Purpose limitation and deletion duties increasingly apply, often alongside localisation, government records, employment and sector-specific retention.

Operational duty: Validate the competent authority, free-zone law, sector regulator and statutory records schedule.

Destruction: Secure disposal with evidence and cross-border processor confirmation.

Local validation required Checked: Baseline generated 22 July 2026

Bangladesh

Data Protection Board / competent authority · Asia-Pacific

Primary law: Data Protection Act

Domain lens: All record domains

Retention principle: Retention is commonly limited to lawful business or legal need, with deletion or de-identification when no longer required.

Operational duty: Validate national privacy law, sector rules, records law, localisation and individual-deletion rights.

Destruction: Use irreversible deletion, de-identification or controlled archival transfer with processor assurance.

Local validation required Checked: Baseline generated 22 July 2026

Barbados

Data Protection Commission · Americas

Primary law: Data Protection Act

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Belarus

National Center for Personal Data Protection · Europe

Primary law: Law on Personal Data

Domain lens: All record domains

Retention principle: Purpose limitation and proportional retention generally apply, with national privacy, labour, tax, corporate and archival law determining exact periods.

Operational duty: Document a purpose, trigger, statutory floor, maximum and local-law source.

Destruction: Securely erase, anonymise or transfer to an authorised archive.

Local validation required Checked: Baseline generated 22 July 2026

Belgium

Belgian Data Protection Authority · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Belize

Information Commissioner / competent data protection authority · Americas

Primary law: Data Protection Act

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Benin

Personal Data Protection Authority · Africa

Primary law: Data Protection Law

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Bhutan

GovTech Agency / competent privacy authority · Asia-Pacific

Primary law: Privacy Law

Domain lens: All record domains

Retention principle: Retention is commonly limited to lawful business or legal need, with deletion or de-identification when no longer required.

Operational duty: Validate national privacy law, sector rules, records law, localisation and individual-deletion rights.

Destruction: Use irreversible deletion, de-identification or controlled archival transfer with processor assurance.

Local validation required Checked: Baseline generated 22 July 2026

Bolivia

Personal Data Protection Agency / competent authority · Americas

Primary law: Data Protection Law

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Bosnia and Herzegovina

Personal Data Protection Agency in Bosnia and Herzegovina · Europe

Primary law: Law on Personal Data

Domain lens: All record domains

Retention principle: Purpose limitation and proportional retention generally apply, with national privacy, labour, tax, corporate and archival law determining exact periods.

Operational duty: Document a purpose, trigger, statutory floor, maximum and local-law source.

Destruction: Securely erase, anonymise or transfer to an authorised archive.

Local validation required Checked: Baseline generated 22 July 2026

Botswana

Information and Data Protection Commission / competent authority · Africa

Primary law: POPIA

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Brazil

National Data Protection Authority · Americas

Primary law: LGPD

Domain lens: All record domains

Retention principle: LGPD Articles 15 and 16 govern the end of processing, deletion and limited statutory exceptions.

Operational duty: End processing where purpose is achieved, data is no longer necessary, the period ends, the individual exercises rights or the authority requires it; document any Article 16 exception.

Destruction: Delete unless legal/regulatory compliance, research with anonymisation, compliant transfer or exclusive anonymised use justifies retention.

Official-source profile Checked: 22 July 2026

Official source

British Virgin Islands

Information Commissioner · Americas

Primary law: Data Protection Act

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Brunei Darussalam

Authority for Info-communications Technology Industry / competent privacy authority · Asia-Pacific

Primary law: Data Protection Act

Domain lens: All record domains

Retention principle: Retention is commonly limited to lawful business or legal need, with deletion or de-identification when no longer required.

Operational duty: Validate national privacy law, sector rules, records law, localisation and individual-deletion rights.

Destruction: Use irreversible deletion, de-identification or controlled archival transfer with processor assurance.

Local validation required Checked: Baseline generated 22 July 2026

Bulgaria

Commission for Personal Data Protection · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Cambodia

Ministry of Posts and Telecommunications / competent privacy authority · Asia-Pacific

Primary law: Personal Data Protection Law

Domain lens: All record domains

Retention principle: Retention is commonly limited to lawful business or legal need, with deletion or de-identification when no longer required.

Operational duty: Validate national privacy law, sector rules, records law, localisation and individual-deletion rights.

Destruction: Use irreversible deletion, de-identification or controlled archival transfer with processor assurance.

Local validation required Checked: Baseline generated 22 July 2026

Canada

Office of the Privacy Commissioner of Canada · Americas

Primary law: PIPEDA

Domain lens: All record domains

Retention principle: PIPEDA limiting-use, disclosure and retention principle requires information to be kept only as long as needed.

Operational duty: Set minimum and maximum periods, preserve decision records long enough for access/challenge, conduct reviews and govern third-party disposal.

Destruction: Destroy, erase or anonymise information and all associated copies/backups using secure methods.

Official-source profile Checked: 22 July 2026

Official source

Chile

Council for Transparency / competent data protection authority · Americas

Primary law: Law 19628

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Colombia

Superintendence of Industry and Commerce · Americas

Primary law: Law 1581

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Congo, Democratic Republic of the

Post and Telecommunications Regulatory Authority / competent data authority · Africa

Primary law: Data Protection Law

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Côte d'Ivoire

Telecommunications/ICT Regulatory Authority of Côte d’Ivoire · Africa

Primary law: Personal Data Protection Act

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Croatia

Croatian Personal Data Protection Agency · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Cyprus

Office of the Commissioner for Personal Data Protection · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Czech Republic

Office for Personal Data Protection · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Denmark

Danish Data Protection Agency · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Egypt

Personal Data Protection Centre / competent authority · Africa

Primary law: Law on Regulated Professions

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Estonia

Estonian Data Protection Inspectorate · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Eswatini

Eswatini Data Protection Authority / competent regulator · Africa

Primary law: POPIA

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Ethiopia

Ethiopian Communications Authority / competent privacy authority · Africa

Primary law: Privacy Directive

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Finland

Office of the Data Protection Ombudsman · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

France

Commission Nationale de l'Informatique et des Libertés · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: RGPD and French law require a defined duration linked to purpose.

Operational duty: Use active retention, intermediate archive and, only where justified, permanent archive. Distinguish mandatory durations from CNIL-recommended benchmarks.

Destruction: Delete or anonymise after the approved phase; segregate intermediate archives and restrict access.

Official-source profile Checked: 22 July 2026

Official source

Germany

Federal Commissioner for Data Protection and Freedom of Information · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: GDPR storage limitation applies with extensive German tax, commercial, employment, social-security and limitation rules.

Operational duty: Map the exact record class to federal law and, where relevant, state public-records or supervisory requirements.

Destruction: Delete or restrict when purpose ends unless a documented statutory floor or hold remains.

Official-source profile Checked: 22 July 2026

Official source

Ghana

Data Protection Commission · Africa

Primary law: GDPA

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Greece

Hellenic Data Protection Authority · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Hong Kong

Office of the Privacy Commissioner for Personal Data · Asia-Pacific

Primary law: PDPO

Domain lens: All record domains

Retention principle: Retention is commonly limited to lawful business or legal need, with deletion or de-identification when no longer required.

Operational duty: Validate national privacy law, sector rules, records law, localisation and individual-deletion rights.

Destruction: Use irreversible deletion, de-identification or controlled archival transfer with processor assurance.

Local validation required Checked: Baseline generated 22 July 2026

Hungary

Hungarian National Authority for Data Protection and Freedom of Information · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

India

Data Protection Board of India · Asia-Pacific

Primary law: DPDP Act

Domain lens: All record domains

Retention principle: The Digital Personal Data Protection Act and final Rules require purpose and legal-need analysis, with erasure and specified operational obligations subject to commencement and rule detail.

Operational duty: Validate current commencement, applicable retention schedules, notice and erasure requirements and significant-data-fiduciary duties.

Destruction: Erase when the purpose and legal need end, following applicable notice and technical requirements.

Official-source profile Checked: 22 July 2026

Official source

Indonesia

Personal Data Protection supervisory authority · Asia-Pacific

Primary law: PDP Law

Domain lens: All record domains

Retention principle: Retention is commonly limited to lawful business or legal need, with deletion or de-identification when no longer required.

Operational duty: Validate national privacy law, sector rules, records law, localisation and individual-deletion rights.

Destruction: Use irreversible deletion, de-identification or controlled archival transfer with processor assurance.

Local validation required Checked: Baseline generated 22 July 2026

Ireland

Data Protection Commission · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Israel

Privacy Protection Authority · Middle East

Primary law: Privacy Law 1981

Domain lens: All record domains

Retention principle: Purpose limitation and deletion duties increasingly apply, often alongside localisation, government records, employment and sector-specific retention.

Operational duty: Validate the competent authority, free-zone law, sector regulator and statutory records schedule.

Destruction: Secure disposal with evidence and cross-border processor confirmation.

Local validation required Checked: Baseline generated 22 July 2026

Italy

Garante per la protezione dei dati personali · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: GDPR storage limitation and the Italian Privacy Code apply, supplemented by Garante guidance and sector law.

Operational duty: Define duration or criteria in notices and processing records; validate labour, tax, surveillance, marketing and health rules.

Destruction: Delete, anonymise or restrict access after expiry, preserving only a documented legal need.

Official-source profile Checked: 22 July 2026

Official source

Japan

Personal Information Protection Commission · Asia-Pacific

Primary law: APPI

Domain lens: All record domains

Retention principle: APPI does not prescribe a general fixed period, but organisations should endeavour to erase personal data without delay when it is no longer necessary.

Operational duty: Set periods based on need and avoid excessive duration, while validating sector and statutory recordkeeping.

Destruction: Use unrecoverable deletion and supervise disposal providers appropriately.

Official-source profile Checked: 22 July 2026

Official source

Jordan

Personal Data Protection Council / Ministry of Digital Economy and Entrepreneurship · Middle East

Primary law: Data Protection Law

Domain lens: All record domains

Retention principle: Purpose limitation and deletion duties increasingly apply, often alongside localisation, government records, employment and sector-specific retention.

Operational duty: Validate the competent authority, free-zone law, sector regulator and statutory records schedule.

Destruction: Secure disposal with evidence and cross-border processor confirmation.

Local validation required Checked: Baseline generated 22 July 2026

Kenya

Office of the Data Protection Commissioner · Africa

Primary law: DPA 2019

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Latvia

Data State Inspectorate · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Lesotho

Data Protection Commission · Africa

Primary law: POPIA

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Lithuania

State Data Protection Inspectorate · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Luxembourg

National Commission for Data Protection · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Malawi

Data Protection Authority / Malawi Communications Regulatory Authority · Africa

Primary law: POPIA

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Malaysia

Personal Data Protection Commissioner · Asia-Pacific

Primary law: PDPA

Domain lens: All record domains

Retention principle: Retention is commonly limited to lawful business or legal need, with deletion or de-identification when no longer required.

Operational duty: Validate national privacy law, sector rules, records law, localisation and individual-deletion rights.

Destruction: Use irreversible deletion, de-identification or controlled archival transfer with processor assurance.

Local validation required Checked: Baseline generated 22 July 2026

Malta

Office of the Information and Data Protection Commissioner · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Mexico

Competent federal transparency and personal data authority · Americas

Primary law: LGPD

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Moldova

National Centre for Personal Data Protection · Europe

Primary law: Law on Personal Data

Domain lens: All record domains

Retention principle: Purpose limitation and proportional retention generally apply, with national privacy, labour, tax, corporate and archival law determining exact periods.

Operational duty: Document a purpose, trigger, statutory floor, maximum and local-law source.

Destruction: Securely erase, anonymise or transfer to an authorised archive.

Local validation required Checked: Baseline generated 22 July 2026

Morocco

National Commission for the Control of Personal Data Protection · Africa

Primary law: GDPL

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Mozambique

National Institute of Information and Communication Technologies / competent authority · Africa

Primary law: LPDA

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Netherlands

Dutch Data Protection Authority · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

New Zealand

Office of the Privacy Commissioner · Asia-Pacific

Primary law: Privacy Act 2020

Domain lens: All record domains

Retention principle: Privacy Act 2020 Principle 9 prohibits keeping personal information longer than required for a lawful purpose.

Operational duty: Link the period to the lawful purpose and validate tax, health, education, employment and public-records obligations.

Destruction: Dispose securely or anonymise when the purpose ends and no legal floor remains.

Official-source profile Checked: 22 July 2026

Official source

Nigeria

Nigeria Data Protection Commission · Africa

Primary law: NDPR

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Norway

Norwegian Data Protection Authority · Europe

Primary law: GDPR

Domain lens: All record domains

Retention principle: Purpose limitation and proportional retention generally apply, with national privacy, labour, tax, corporate and archival law determining exact periods.

Operational duty: Document a purpose, trigger, statutory floor, maximum and local-law source.

Destruction: Securely erase, anonymise or transfer to an authorised archive.

Local validation required Checked: Baseline generated 22 July 2026

Peru

National Authority for Personal Data Protection · Americas

Primary law: Law 29733

Domain lens: All record domains

Retention principle: Purpose-based retention, deletion and secure disposal duties coexist with tax, employment, financial crime, consumer and limitation requirements.

Operational duty: Determine minimum and maximum periods by country and province/state, then document disposal and exception controls.

Destruction: Secure destruction, erasure or anonymisation with audit evidence.

Local validation required Checked: Baseline generated 22 July 2026

Philippines

National Privacy Commission · Asia-Pacific

Primary law: DP Act 2012

Domain lens: All record domains

Retention principle: Retention is commonly limited to lawful business or legal need, with deletion or de-identification when no longer required.

Operational duty: Validate national privacy law, sector rules, records law, localisation and individual-deletion rights.

Destruction: Use irreversible deletion, de-identification or controlled archival transfer with processor assurance.

Local validation required Checked: Baseline generated 22 July 2026

Poland

Personal Data Protection Office · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Portugal

National Data Protection Commission · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Qatar

National Cyber Governance and Assurance Affairs / competent privacy authority · Middle East

Primary law: Data Protection Law

Domain lens: All record domains

Retention principle: Purpose limitation and deletion duties increasingly apply, often alongside localisation, government records, employment and sector-specific retention.

Operational duty: Validate the competent authority, free-zone law, sector regulator and statutory records schedule.

Destruction: Secure disposal with evidence and cross-border processor confirmation.

Local validation required Checked: Baseline generated 22 July 2026

Romania

National Supervisory Authority for Personal Data Processing · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Russian Federation

Federal Service for Supervision of Communications, Information Technology and Mass Media · Europe

Primary law: Federal Law on Personal Data

Domain lens: All record domains

Retention principle: Purpose limitation and proportional retention generally apply, with national privacy, labour, tax, corporate and archival law determining exact periods.

Operational duty: Document a purpose, trigger, statutory floor, maximum and local-law source.

Destruction: Securely erase, anonymise or transfer to an authorised archive.

Local validation required Checked: Baseline generated 22 July 2026

Saudi Arabia

Saudi Data and Artificial Intelligence Authority / National Data Management Office · Middle East

Primary law: Data Protection Law

Domain lens: All record domains

Retention principle: Purpose limitation and deletion duties increasingly apply, often alongside localisation, government records, employment and sector-specific retention.

Operational duty: Validate the competent authority, free-zone law, sector regulator and statutory records schedule.

Destruction: Secure disposal with evidence and cross-border processor confirmation.

Local validation required Checked: Baseline generated 22 July 2026

Singapore

Personal Data Protection Commission · Asia-Pacific

Primary law: PDPA

Domain lens: All record domains

Retention principle: The PDPA Retention Limitation Obligation requires retention to cease, or proper disposal, when data is no longer needed for business or legal purposes.

Operational duty: Document business/legal need, review inactive stores and apply the rule to service providers and copies.

Destruction: Dispose properly, irreversibly anonymise or cease retention through effective access and recovery controls.

Official-source profile Checked: 22 July 2026

Official source

Slovakia

Office for Personal Data Protection of the Slovak Republic · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Slovenia

Information Commissioner of the Republic of Slovenia · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

South Africa

Information Regulator · Africa

Primary law: POPIA

Domain lens: All record domains

Retention principle: POPIA retention restriction generally prohibits keeping records longer than authorised for the purpose, subject to law, contract, consent, research/archive and legal-interest exceptions.

Operational duty: Document the applicable exception and restrict use where records are retained only for proof or anticipated proceedings.

Destruction: Destroy, delete or de-identify records so they cannot be reconstructed intelligibly.

Official-source profile Checked: 22 July 2026

Official source

Spain

Spanish Data Protection Agency · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Sweden

Swedish Authority for Privacy Protection · European Union

Primary law: GDPR

Domain lens: All record domains

Retention principle: Storage limitation under GDPR Article 5(1)(e), with erasure rights and accountability.

Destruction: Erase, anonymise or archive under appropriate safeguards; validate processor and backup propagation.

Official-source profile Checked: Baseline generated 22 July 2026

Official source

Switzerland

Federal Data Protection and Information Commissioner · Europe

Primary law: Federal Data Protection Act

Domain lens: All record domains

Retention principle: The revised Federal Act on Data Protection applies proportionality, purpose and transparency, including information about retention duration or criteria where relevant.

Operational duty: Set purpose-linked periods and validate Swiss employment, financial, health, telecom, limitation and archive rules.

Destruction: Delete or anonymise after purpose and legal need end, with documented exceptions.

Official-source profile Checked: 22 July 2026

Official source

Tanzania

Personal Data Protection Commission · Africa

Primary law: DPA 2022

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

Thailand

Personal Data Protection Committee / Office of the PDPC · Asia-Pacific

Primary law: PDPA

Domain lens: All record domains

Retention principle: Retention is commonly limited to lawful business or legal need, with deletion or de-identification when no longer required.

Operational duty: Validate national privacy law, sector rules, records law, localisation and individual-deletion rights.

Destruction: Use irreversible deletion, de-identification or controlled archival transfer with processor assurance.

Local validation required Checked: Baseline generated 22 July 2026

Uganda

Personal Data Protection Office · Africa

Primary law: DPA 2019

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

United Arab Emirates

UAE Data Office · Middle East

Primary law: Data Protection Law

Domain lens: All record domains

Retention principle: Purpose limitation and deletion duties increasingly apply, often alongside localisation, government records, employment and sector-specific retention.

Operational duty: Validate the competent authority, free-zone law, sector regulator and statutory records schedule.

Destruction: Secure disposal with evidence and cross-border processor confirmation.

Local validation required Checked: Baseline generated 22 July 2026

United Kingdom

Information Commissioner's Office · Europe

Primary law: UK GDPR

Domain lens: All record domains

Retention principle: UK GDPR storage limitation: personal data must not be kept longer than needed.

Operational duty: Justify periods by purpose, maintain a retention policy, review holdings and erase or anonymise data when no longer needed. Apply the Data Protection Act 2018 and sector law.

Destruction: Erase, anonymise or securely archive with documented exceptions and deletion propagation.

Official-source profile Checked: 22 July 2026

Official source

United States - Alabama

Alabama Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Alaska

Alaska Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Arizona

Arizona Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Arkansas

Arkansas Attorney General · United States

Primary law: ACDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - California

California Privacy Protection Agency · United States

Primary law: CCPA/CPRA

Domain lens: All record domains

Retention principle: California combines CCPA/CPRA deletion rights, data-minimisation expectations, disclosure of retention periods/criteria and sector/statutory record duties.

Operational duty: Map each collection purpose, disclosed retention, deletion exception and data-broker obligation. The Delete Act mechanism has operational dates from 2026.

Destruction: Delete across service providers and contractors unless a statutory exception applies; maintain required deletion evidence without recreating deleted profiles.

Official-source profile Checked: 22 July 2026

Official source

United States - Colorado

Colorado Attorney General · United States

Primary law: CPA

Domain lens: All record domains

Retention principle: Colorado law includes privacy rights and a written policy for disposal of certain personal identifying information.

Operational duty: Map consumer deletion, statutory exceptions, sector obligations and the organisation’s written disposal schedule.

Destruction: Destroy or arrange destruction by shredding, erasing or otherwise making information unreadable or indecipherable.

Official-source profile Checked: 22 July 2026

Official source

United States - Connecticut

Connecticut Attorney General · United States

Primary law: CTDPA

Domain lens: All record domains

Retention principle: Connecticut’s privacy framework includes data minimisation and deletion rights, alongside state and federal sector recordkeeping.

Operational duty: Document collection necessity, purpose, deletion exceptions and processor propagation; validate current amendments and enforcement guidance.

Destruction: Delete or de-identify when no longer authorised, subject to statutory exceptions and holds.

Official-source profile Checked: 22 July 2026

Official source

United States - Delaware

Delaware Attorney General · United States

Primary law: DPDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - District of Columbia

District of Columbia Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Florida

Florida Attorney General · United States

Primary law: FDBR

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Georgia

Georgia Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Hawaii

Hawaii Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Idaho

Idaho Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Illinois

Illinois Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Indiana

Indiana Attorney General · United States

Primary law: ICDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Iowa

Iowa Attorney General · United States

Primary law: ICDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Kansas

Kansas Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Kentucky

Kentucky Attorney General · United States

Primary law: KCDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Louisiana

Louisiana Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Maine

Maine Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Maryland

Maryland Attorney General · United States

Primary law: MODPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Massachusetts

Massachusetts Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Michigan

Michigan Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Minnesota

Minnesota Attorney General · United States

Primary law: MNDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Mississippi

Mississippi Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Missouri

Missouri Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Montana

Montana Attorney General · United States

Primary law: MCDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Nebraska

Nebraska Attorney General · United States

Primary law: NDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Nevada

Nevada Attorney General · United States

Primary law: NDPP

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - New Hampshire

New Hampshire Attorney General · United States

Primary law: NHDPP

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - New Jersey

New Jersey Attorney General · United States

Primary law: NJDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - New Mexico

New Mexico Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - New York

New York Attorney General · United States

Primary law: NYDSA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - North Carolina

North Carolina Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - North Dakota

North Dakota Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Ohio

Ohio Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Oklahoma

Oklahoma Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Oregon

Oregon Attorney General · United States

Primary law: OCPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Pennsylvania

Pennsylvania Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Rhode Island

Rhode Island Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - South Carolina

South Carolina Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - South Dakota

South Dakota Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Tennessee

Tennessee Attorney General · United States

Primary law: TIPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Texas

Texas Attorney General · United States

Primary law: TDPSA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Utah

Utah Attorney General · United States

Primary law: UCPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Vermont

Vermont Attorney General · United States

Primary law: VDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Virginia

Virginia Attorney General · United States

Primary law: VCDPA

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Washington

Washington Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - West Virginia

West Virginia Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Wisconsin

Wisconsin Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

United States - Wyoming

Wyoming Attorney General · United States

Primary law: Federal Law

Domain lens: All record domains

Retention principle: No single omnibus federal retention schedule. Federal sector law, state privacy law, recordkeeping statutes, limitation periods and written disposal duties may overlap.

Operational duty: Map state and sector requirements, consumer deletion rights, litigation holds and defensible business need. Do not use a blanket national period.

Destruction: Use a written disposal policy where required and render personal information unreadable or unrecoverable.

Local validation required Checked: Baseline generated 22 July 2026

Official source

Vietnam

Ministry of Public Security / competent personal data authority · Asia-Pacific

Primary law: Law on Info Security

Domain lens: All record domains

Retention principle: Retention is commonly limited to lawful business or legal need, with deletion or de-identification when no longer required.

Operational duty: Validate national privacy law, sector rules, records law, localisation and individual-deletion rights.

Destruction: Use irreversible deletion, de-identification or controlled archival transfer with processor assurance.

Local validation required Checked: Baseline generated 22 July 2026

Zambia

Data Protection Commissioner / Data Protection Authority · Africa

Primary law: POPIA

Domain lens: All record domains

Retention principle: Many regimes require data not to be retained beyond purpose and require deletion, destruction or de-identification when no longer authorised.

Operational duty: Validate current national law, regulator guidance, sector records and public-archive obligations.

Destruction: Secure deletion or authorised archival treatment with processor controls.

Local validation required Checked: Baseline generated 22 July 2026

ID	Record type	Category	Jurisdiction	Active / archive period	Trigger	Rule	Basis	Disposition	Risk	Status	Verification
RS-001	Employee personnel file System not mapped	HR & Employment	Global operational baseline	6 years	Employment end	Maximum / defensible baseline	Employment administration, limitation and claims periods	Secure deletion or archive	High	Draft	Local validation required
RS-002	Recruitment applications - unsuccessful System not mapped	HR & Employment	Global operational baseline	6-24 months	Recruitment decision	Maximum / purpose-based	Recruitment purpose, equality monitoring and claims defence	Secure deletion or anonymisation	Medium	Draft	Local validation required
RS-003	Right-to-work and immigration checks System not mapped	HR & Employment	Global operational baseline	Statutory period by jurisdiction	Employment end or check date	Minimum	Immigration and employment law	Secure deletion	High	Draft	Local validation required
RS-004	Payroll and payslip records System not mapped	HR & Employment	Global operational baseline	5-10 years	Tax year or employment end	Minimum	Tax, employment and accounting law	Secure deletion or controlled archive	High	Draft	Local validation required
RS-005	Benefits and pension administration System not mapped	HR & Employment	Global operational baseline	6-12 years or scheme-specific	Benefit relationship end	Minimum	Pensions, tax, contract and claims law	Secure deletion or archive	High	Draft	Local validation required
RS-006	Employee health and occupational health System not mapped	HR & Employment	Global operational baseline	Purpose and sector specific	Employment end / last treatment	Maximum / minimum conflict	Employment, health and safety and medical confidentiality	Secure deletion or restricted archive	Critical	Draft	Local validation required
RS-007	Disciplinary and grievance records System not mapped	HR & Employment	Global operational baseline	6 years baseline	Case closure	Maximum / claims-based	Employment claims and fair process	Secure deletion	High	Draft	Local validation required
RS-008	Training and competence records System not mapped	HR & Employment	Global operational baseline	3-7 years / qualification life	Training date or role end	Minimum	Safety, regulated competence and assurance	Secure deletion or archive	Medium	Draft	Local validation required
RS-009	General ledger and accounting books System not mapped	Finance & Tax	Global operational baseline	6-10 years	Financial year end	Minimum	Accounting and tax statutes	Secure deletion or archive	High	Under Review	Local validation required
RS-010	Invoices, VAT/GST and receipts System not mapped	Finance & Tax	Global operational baseline	5-10 years	Transaction or tax year end	Minimum	Tax and accounting law	Secure deletion or archive	High	Under Review	Local validation required
RS-011	Bank statements and treasury records System not mapped	Finance & Tax	Global operational baseline	6-10 years	Financial year end	Minimum	Tax, accounting, audit and fraud prevention	Secure deletion or archive	High	Under Review	Local validation required
RS-012	Expense claims System not mapped	Finance & Tax	Global operational baseline	5-10 years	Financial year end	Minimum	Tax and accounting law	Secure deletion	Medium	Under Review	Local validation required
RS-013	Audit working papers System not mapped	Finance & Tax	Global operational baseline	5-10 years	Audit completion	Minimum	Professional, corporate and sector rules	Secure deletion or controlled archive	High	Under Review	Local validation required
RS-014	Commercial contracts System not mapped	Contracts & Legal	Global operational baseline	6-12 years	Contract expiry or termination	Minimum / claims-based	Limitation, commercial and evidence law	Secure deletion or archive	High	Draft	Local validation required
RS-015	Contract negotiation and drafts System not mapped	Contracts & Legal	Global operational baseline	1-6 years	Contract execution or abandonment	Maximum / claims-based	Legal privilege, evidence and minimisation	Secure deletion	Medium	Draft	Local validation required
RS-016	Litigation and dispute files System not mapped	Contracts & Legal	Global operational baseline	6-12 years or counsel-directed	Final resolution and appeal expiry	Minimum / legal hold	Limitation and legal privilege	Legal hold then secure destruction	Critical	Draft	Local validation required
RS-017	Legal advice and privileged material System not mapped	Contracts & Legal	Global operational baseline	Counsel-defined	Matter closure	Minimum / privileged	Privilege, professional and limitation rules	Secure deletion or restricted archive	High	Draft	Local validation required
RS-018	DSAR and individual-rights case files System not mapped	Privacy & Rights	Global operational baseline	3-6 years	Final response / closure	Maximum / accountability	Accountability, complaints and limitation	Secure deletion	High	Draft	Local validation required
RS-019	Consent records System not mapped	Privacy & Rights	Global operational baseline	Duration of processing plus claims period	Withdrawal or final use	Minimum	Consent accountability and marketing law	Secure deletion or archive	High	Draft	Local validation required
RS-020	Privacy complaints and regulator correspondence System not mapped	Privacy & Rights	Global operational baseline	6-10 years	Final closure	Minimum / accountability	Regulatory accountability and claims	Secure deletion or controlled archive	High	Draft	Local validation required
RS-021	DPIA, PIA and risk-assessment records System not mapped	Privacy & Rights	Global operational baseline	Lifecycle plus 6 years	System retirement / last decision	Minimum / accountability	Accountability and risk governance	Controlled archive	High	Draft	Local validation required
RS-022	RoPA and processing inventory history System not mapped	Privacy & Rights	Global operational baseline	Lifecycle plus 6 years	Superseded / processing ends	Minimum / accountability	Records of processing and governance	Controlled archive	High	Draft	Local validation required
RS-023	Authentication and access logs System not mapped	Security & Technology	Global operational baseline	90 days-2 years	Log creation	Maximum / security need	Security monitoring, incident response and sector rules	Secure deletion	High	Draft	Local validation required
RS-024	Privileged administrator logs System not mapped	Security & Technology	Global operational baseline	1-7 years	Log creation	Minimum / security assurance	Security, fraud, critical infrastructure and audit	Secure deletion	Critical	Draft	Local validation required
RS-025	Security incident records System not mapped	Security & Technology	Global operational baseline	5-10 years	Incident closure	Minimum / accountability	Breach documentation, security and limitation	Secure deletion or archive	Critical	Draft	Local validation required
RS-026	CCTV footage System not mapped	Security & Technology	Global operational baseline	24 hours-90 days	Capture date	Maximum / purpose-based	Security purpose and local surveillance rules	Secure overwrite or deletion	High	Draft	Local validation required
RS-027	Biometric templates System not mapped	Security & Technology	Global operational baseline	Immediate to short period	Purpose end / enrolment end	Maximum / purpose-based	Biometric and special-category rules	Irreversible deletion	Critical	Draft	Local validation required
RS-028	Email and collaboration content System not mapped	Security & Technology	Global operational baseline	Role and content based	Creation / matter closure	Mixed	Business need, legal hold and minimisation	Policy deletion / archive	High	Draft	Local validation required
RS-029	Backups and disaster-recovery copies System not mapped	Security & Technology	Global operational baseline	30-180 days cycle	Backup creation	Maximum / technical constraint	Resilience and storage limitation	Expiry / cryptographic erase	High	Draft	Local validation required
RS-030	Device and media disposal certificates System not mapped	Security & Technology	Global operational baseline	7-10 years	Destruction event	Minimum / evidence	Security assurance, audit and chain of custody	Controlled archive	Medium	Draft	Local validation required
RS-031	Customer account records System not mapped	Customer & Operations	Global operational baseline	2-6 years	Account closure	Maximum / claims-based	Contract, service and consumer law	Secure deletion	High	Under Review	Local validation required
RS-032	Customer support tickets System not mapped	Customer & Operations	Global operational baseline	2-3 years	Ticket closure	Maximum / purpose-based	Service quality, complaints and claims	Secure deletion	Medium	Under Review	Local validation required
RS-033	Service usage and telemetry System not mapped	Customer & Operations	Global operational baseline	30 days-2 years	Collection / service end	Maximum / purpose-based	Service delivery, security and analytics	Deletion or aggregation	High	Under Review	Local validation required
RS-034	Call recordings System not mapped	Customer & Operations	Global operational baseline	30 days-7 years	Call date	Mixed	Quality, contract evidence and sector rules	Secure deletion	High	Under Review	Local validation required
RS-035	Identity verification records System not mapped	Customer & Operations	Global operational baseline	Purpose plus statutory floor	Verification or relationship end	Mixed	Fraud prevention, KYC and onboarding	Secure deletion	Critical	Under Review	Local validation required
RS-036	Prospect and lead data System not mapped	Marketing	Global operational baseline	12-36 months	Last meaningful contact	Maximum / purpose-based	Direct marketing and legitimate interests/consent	Secure deletion	Medium	Draft	Local validation required
RS-037	Cookie and tracking consent logs System not mapped	Marketing	Global operational baseline	Consent lifecycle plus claims period	Consent event / withdrawal	Minimum	Electronic communications and consent proof	Secure deletion or archive	High	Draft	Local validation required
RS-038	Suppression lists System not mapped	Marketing	Global operational baseline	As long as needed to honour objection	Opt-out / objection	Minimum / restricted use	Direct-marketing objection compliance	Restricted minimal retention	Medium	Draft	Local validation required
RS-039	Campaign analytics System not mapped	Marketing	Global operational baseline	12-36 months	Campaign end	Maximum / purpose-based	Performance analysis and minimisation	Aggregation or deletion	Low	Draft	Local validation required
RS-040	Supplier due diligence System not mapped	Vendors & Procurement	Global operational baseline	6 years baseline	Relationship end / assessment date	Minimum / accountability	Contract, procurement and risk management	Secure deletion	High	Draft	Local validation required
RS-041	Processor and subprocessor assessments System not mapped	Vendors & Procurement	Global operational baseline	Lifecycle plus 6 years	Relationship end	Minimum / accountability	Processor governance and due diligence	Controlled archive	High	Draft	Local validation required
RS-042	Procurement bids - unsuccessful System not mapped	Vendors & Procurement	Global operational baseline	1-6 years	Award decision	Maximum / claims-based	Procurement challenge and limitation	Secure deletion	Medium	Draft	Local validation required
RS-043	AML/KYC customer due diligence System not mapped	Compliance & Risk	Global operational baseline	5-10 years	Relationship end / transaction	Minimum	AML, sanctions and financial-crime laws	Secure deletion	Critical	Under Review	Local validation required
RS-044	Sanctions screening results System not mapped	Compliance & Risk	Global operational baseline	5-10 years	Screening date / relationship end	Minimum	Sanctions and financial-crime compliance	Secure deletion	High	Under Review	Local validation required
RS-045	Whistleblowing reports System not mapped	Compliance & Risk	Global operational baseline	Purpose and local-law based	Case closure	Maximum / legal hold	Whistleblowing, employment and claims law	Secure deletion / restricted archive	Critical	Under Review	Local validation required
RS-046	Policy attestations System not mapped	Compliance & Risk	Global operational baseline	3-7 years	Attestation date / employment end	Minimum / assurance	Accountability and training evidence	Secure deletion	Medium	Under Review	Local validation required
RS-047	Patient or clinical records System not mapped	Health & Research	Global operational baseline	Jurisdiction and profession specific	Last treatment / death / age threshold	Minimum	Health-record and professional rules	Secure destruction or archive	Critical	Draft	Local validation required
RS-048	Clinical research source data System not mapped	Health & Research	Global operational baseline	10-25 years or protocol-specific	Study closure / marketing authorisation	Minimum	Clinical-trial, research and ethics rules	Controlled archive	Critical	Draft	Local validation required
RS-049	Research participant contact data System not mapped	Health & Research	Global operational baseline	Purpose based	Study end / withdrawal	Maximum	Research purpose and consent/ethics	Secure deletion	High	Draft	Local validation required
RS-050	Student academic records System not mapped	Children & Education	Global operational baseline	6 years to permanent core record	Course completion	Mixed	Education, certification and public records	Secure deletion or archive	High	Draft	Local validation required
RS-051	Safeguarding and child-protection records System not mapped	Children & Education	Global operational baseline	Long statutory periods	Case closure / child age	Minimum / legal hold	Safeguarding and child-protection law	Restricted archive	Critical	Draft	Local validation required
RS-052	Parental consent records System not mapped	Children & Education	Global operational baseline	Consent lifecycle plus claims period	Consent end / child reaches age threshold	Minimum	Children's privacy and consent accountability	Secure deletion	High	Draft	Local validation required
RS-053	AI prompts, outputs and interaction logs System not mapped	AI & Analytics	Global operational baseline	30 days-2 years	Interaction date	Maximum / purpose-based	Security, evaluation, transparency and minimisation	Deletion or de-identification	High	Draft	Local validation required
RS-054	AI training and fine-tuning datasets System not mapped	AI & Analytics	Global operational baseline	Purpose and rights based	Model retirement / purpose end	Maximum / accountable exception	Lawful basis, IP, provenance and model governance	Deletion, de-identification or controlled archive	Critical	Draft	Local validation required
RS-055	Model evaluation and red-team evidence System not mapped	AI & Analytics	Global operational baseline	Lifecycle plus 6 years	Model version retirement	Minimum / accountability	AI governance, assurance and claims	Controlled archive	High	Draft	Local validation required
RS-056	Feature store and vector embeddings System not mapped	AI & Analytics	Global operational baseline	Purpose based	Source purpose end	Maximum	Derived data governance and storage limitation	Deletion / re-indexing	High	Draft	Local validation required
RS-057	Board and committee minutes System not mapped	Corporate & Governance	Global operational baseline	Permanent or corporate-law period	Meeting date	Minimum / archive	Corporate governance and archives law	Permanent controlled archive	Medium	Draft	Local validation required
RS-058	Corporate filings and registers System not mapped	Corporate & Governance	Global operational baseline	Statutory or permanent	Filing / entity dissolution	Minimum	Corporate and registry law	Controlled archive	Medium	Draft	Local validation required
RS-059	Insurance policies and claims System not mapped	Corporate & Governance	Global operational baseline	6-15 years	Policy expiry / claim closure	Minimum / claims-based	Insurance, limitation and regulatory rules	Secure deletion or archive	High	Draft	Local validation required
RS-060	Visitor and access records System not mapped	Physical Records	Global operational baseline	30 days-2 years	Visit date	Maximum / security need	Physical security and incident investigation	Secure deletion	Medium	Draft	Local validation required
RS-061	Paper records awaiting destruction System not mapped	Physical Records	Global operational baseline	Shortest operational window	Eligibility date	Maximum	Storage limitation and security	Certified shredding / pulping	High	Draft	Local validation required

💳

Financial services and payments

Accounting, tax, AML/KYC, sanctions, transaction evidence, complaints, call recording and regulated communications.

Finance & Tax · Compliance & Risk · Customer & Operations

🧬

Health, care and life sciences

Clinical records, occupational health, research, pharmacovigilance, consent, safeguarding and medical confidentiality.

Health & Research · HR & Employment · Children & Education

📡

Telecommunications and digital infrastructure

Traffic, subscriber, location, network, security, lawful-access, service and billing records with country-specific sector rules.

Security & Technology · Customer & Operations · Finance & Tax

🏛️

Public sector and archives

Public records, archival appraisal, transparency, investigations, statutory decisions and authorised permanent preservation.

Corporate & Governance · Privacy & Rights · Contracts & Legal

🎓

Education and children

Student, safeguarding, assessment, learning, parental consent and special-category data.

Children & Education · HR & Employment · Privacy & Rights

🤖

Technology, cloud and AI

Logs, backups, prompts, outputs, training data, model evidence, telemetry, vector stores and derived data.

AI & Analytics · Security & Technology · Customer & Operations

🛒

Retail, marketing and consumer

Customer accounts, purchases, loyalty, direct marketing, cookies, suppression, complaints and returns.

Marketing · Customer & Operations · Finance & Tax

⚖️

Legal and professional services

Matter files, contracts, privilege, conflicts, client due diligence, billing and claims.

Contracts & Legal · Compliance & Risk · Finance & Tax

🚆

Transport, mobility and location

Passenger, crew, booking, telemetry, location, safety, incident, CCTV and communications records.

Customer & Operations · Security & Technology · HR & Employment

🤝

Charity and membership

Donors, beneficiaries, volunteers, safeguarding, grants, consent, tax and fundraising suppression.

Customer & Operations · Marketing · Children & Education

Programme settings

Programme start date

Target completion date

Executive sponsor role

Programme lead role

Governance forum

Review cadence

Scope and jurisdictions

Target maturity

Budget / resource assumption

75controls

0%overall progress

0complete

0in progress

0overdue

0blocked / at risk

Control	Description	Workstream	Phase	Priority	Status	Progress	Owner	Due	Risk	Next action
DR-01	Establish an organisation-wide Data Retention Policy aligned with GDPR, and telecom regulations. Draft or revise the organisation-wide data retention policy in coordination with Legal and Compliance, ensuring it is aligned with GDPR, DORA, and telecom regulatory requirements. Upload the approved policy into the approved retention rules repository as the top-level reference.	Governance & Accountability	Phase 1 · Foundation Months 0-3	High	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-02	Develop and publish a standard operating procedure (SOP) for enforcing retention periods by data category. Publish an SOP that defines trigger events, approval steps, exception handling, evidence capture, and enforcement responsibilities by data category; store the controlled SOP in the approved privacy governance platform and align operational execution with the approved retention rules repository.	Governance & Accountability	Phase 1 · Foundation Months 0-3	High	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-03	Ensure each data processing activity has a clearly defined and documented retention rule. Record a retention rule for each processing activity in the ROPA or data inventory in the approved privacy governance platform and ensure the approved rule is reflected in the approved retention rules repository or the relevant source system.	Governance & Accountability	Phase 1 · Foundation Months 0-3	High	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-04	Map all regulatory and legal obligations affecting retention by jurisdiction and business domain. Build and maintain a jurisdiction-by-business-domain obligations matrix in the approved privacy governance platform and use it to validate or update retention schedules in the approved retention rules repository.	Governance & Accountability	Phase 1 · Foundation Months 0-3	Critical	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-05	Create centralised governance for approving and updating retention schedules annually. Establish a Data Retention Governance organisation to meet quarterly and review any changes in regulations or retention rules configured in the approved retention rules repository.	Governance & Accountability	Phase 1 · Foundation Months 0-3	High	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-06	Ensure all structured and unstructured data systems are covered under retention controls. Configure system connectors from the approved retention rules repository to enterprise collaboration and business systems to apply policy-based deletion schedules. Conduct pilot testing for each integration path.	Governance & Accountability	Phase 1 · Foundation Months 0-3	High	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-07	Assign ownership of retention policies to domain-specific business and compliance owners. Assign named business, legal, privacy, and IT owners for each retention domain, record ownership in the approved privacy governance platform, and require periodic sign-off for schedules enforced through the approved retention rules repository.	Governance & Accountability	Phase 1 · Foundation Months 0-3	Medium	Not Started	0%	Privacy	2026-10-22	Medium	Confirm owner and implementation date.
DR-08	Maintain a comprehensive legal basis repository with citations for each retention rule. Use embedded legal references to map each data category to its statutory or contractual retention basis. Validate with internal legal counsel and assign reference IDs for tracking.	Legal Rules & Schedule	Phase 1 · Foundation Months 0-3	Medium	Not Started	0%	Privacy	2026-10-22	Medium	Confirm owner and implementation date.
DR-09	Incorporate data minimisation and lifecycle management into retention planning. Ensure all data processing lifecycle stages are mapped to corresponding retention rules in the approved retention rules repository, including data creation, storage, use, archiving, and deletion.	Disposition & Destruction	Phase 1 · Foundation Months 0-3	Critical	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-10	Establish a consistent method for classifying data assets by retention class and lifecycle stage. Ensure all data processing lifecycle stages are mapped to corresponding retention rules in the approved retention rules repository, including data creation, storage, use, archiving, and deletion.	Disposition & Destruction	Phase 1 · Foundation Months 0-3	Medium	Not Started	0%	Privacy	2026-10-22	Medium	Confirm owner and implementation date.
DR-11	Ensure backup systems and cold storage repositories are subject to applicable retention rules. Document retention rules for backup systems and define purge cycles. Coordinate with infrastructure teams to ensure backups are included in the approved retention rules repository enforcement and reporting.	Disposition & Destruction	Phase 1 · Foundation Months 0-3	High	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-12	Design retention controls that respect litigation holds, audits, or investigation freezes. Enable audit logging for all retention rule changes and deletion activities within the approved retention rules repository. Ensure reports are accessible to DPO and internal audit teams.	Disposition & Destruction	Phase 1 · Foundation Months 0-3	Critical	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-13	Define metadata standards for tagging documents/files with retention attributes. Define metadata taxonomy to classify files by retention category. Work with IT to automate metadata tagging and enable enforcement triggers via the approved retention rules repository.	Technology & Enforcement	Phase 1 · Foundation Months 0-3	Medium	Not Started	0%	Privacy	2026-10-22	Medium	Confirm owner and implementation date.
DR-14	Ensure legacy systems and exports from decommissioned platforms are assessed for retention obligations. Configure system connectors from the approved retention rules repository to enterprise collaboration and business systems to apply policy-based deletion schedules. Conduct pilot testing for each integration path.	Governance & Accountability	Phase 1 · Foundation Months 0-3	Critical	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-15	Establish exception handling workflows for retention overrides with legal justification logging. Use embedded legal references to map each data category to its statutory or contractual retention basis. Validate with internal legal counsel and assign reference IDs for tracking.	Legal Rules & Schedule	Phase 1 · Foundation Months 0-3	High	Not Started	0%	Privacy	2026-10-22	High	Confirm owner and implementation date.
DR-16	Integrate the retention rules repository with the privacy inventory, to synchronise retention schedules and ROPA. Integrate the retention rules repository with the privacy inventory, so that retention schedules, ROPA entries, and data inventory records stay synchronised.	Governance & Accountability	Phase 2 · Design Months 4-6	Medium	Not Started	0%	Privacy	2027-01-22	Medium	Confirm owner and implementation date.
DR-17	Ensure file shares, cloud drives, and collaborative platforms (e.g., Teams, controlled document repository) have enforceable policies. Apply enforceable retention rules to file shares, cloud drives, Teams, controlled document repository, and similar repositories, using the approved retention rules repository where feasible and native controls where direct enforcement is required.	Technology & Enforcement	Phase 2 · Design Months 4-6	Critical	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-18	Review HR data retention schedules against employment, tax, and pension requirements per country. Establish a Data Retention Governance organisation to meet quarterly and review any changes in regulations or retention rules configured in the approved retention rules repository.	Governance & Accountability	Phase 2 · Design Months 4-6	Critical	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-19	Review CCTV, biometrics, and physical security data for legal retention limits and justification. Use embedded legal references to map each data category to its statutory or contractual retention basis. Validate with internal legal counsel and assign reference IDs for tracking.	Legal Rules & Schedule	Phase 2 · Design Months 4-6	Critical	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-20	Include retention rules in third-party processor contracts and conduct audit sampling for compliance. Amend third-party data processing agreements to include specific retention clauses. Link retention responsibilities in the approved retention rules repository to each vendor profile, with evidence uploaded.	Legal Rules & Schedule	Phase 2 · Design Months 4-6	Critical	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-21	Ensure marketing and consent-based processing includes expiry dates aligned with business justification. Use embedded legal references to map each data category to its statutory or contractual retention basis. Validate with internal legal counsel and assign reference IDs for tracking.	Legal Rules & Schedule	Phase 2 · Design Months 4-6	Medium	Not Started	0%	Privacy	2027-01-22	Medium	Confirm owner and implementation date.
DR-22	Ensure financial records, invoices, and transaction data align with tax and accounting laws globally. Map finance record classes to country-specific tax, accounting, and audit retention requirements, validate with Finance and Legal, and configure the approved schedule in the approved retention rules repository or the source finance system.	Legal Rules & Schedule	Phase 2 · Design Months 4-6	High	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-23	Classify vendor contracts and legal agreements and retain based on enforceability and auditability timelines. Amend third-party data processing agreements to include specific retention clauses. Link retention responsibilities in the approved retention rules repository to each vendor profile, with evidence uploaded.	Legal Rules & Schedule	Phase 2 · Design Months 4-6	High	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-24	Apply shorter retention for access logs, telemetry, and diagnostic files per data minimisation principles. Define reduced retention periods for logs, telemetry, and diagnostics based on necessity, security, and troubleshooting needs, and implement the approved schedule in the approved retention rules repository or native logging controls.	Technology & Enforcement	Phase 2 · Design Months 4-6	Critical	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-25	Ensure encryption and anonymisation do not prevent timely deletion of personal data under retention rules. Confirm that encryption, pseudonymisation, and anonymisation designs do not block deletion, de-linking, or expiry actions and document the approved approach in architecture standards.	Legal Rules & Schedule	Phase 2 · Design Months 4-6	High	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-26	Review all DPIAs to ensure they include retention analysis and risk mitigation strategies. Establish a Data Retention Governance organisation to meet quarterly and review any changes in regulations or retention rules configured in the approved retention rules repository.	Governance & Accountability	Phase 2 · Design Months 4-6	Medium	Not Started	0%	Privacy	2027-01-22	Medium	Confirm owner and implementation date.
DR-27	Integrate deletion logs into security and audit dashboards to provide evidence of retention enforcement. Enable audit logging for all retention rule changes and deletion activities within the approved retention rules repository. Ensure reports are accessible to DPO and internal audit teams.	Disposition & Destruction	Phase 2 · Design Months 4-6	High	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-28	Create a standard taxonomy for retention policy naming, versioning, and communication. Draft or revise the organisation-wide data retention policy in coordination with Legal and Compliance, ensuring it is aligned with GDPR, DORA, and telecom regulatory requirements. Upload the approved policy into the approved retention rules repository as the top-level reference.	Governance & Accountability	Phase 2 · Design Months 4-6	High	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-29	Implement a quarterly governance board to approve retention updates and audit controls. Enable audit logging for all retention rule changes and deletion activities within the approved retention rules repository. Ensure reports are accessible to DPO and internal audit teams.	Governance & Accountability	Phase 2 · Design Months 4-6	Critical	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-30	Ensure business continuity and disaster recovery plans include data retention compliance checkpoints. Embed retention compliance checkpoints into business continuity and disaster recovery plans, including backup restoration testing, post-recovery purge steps, and evidence requirements.	Disposition & Destruction	Phase 2 · Design Months 4-6	Critical	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-31	Assign retention categories during initial data classification and system onboarding processes. Configure system connectors from the approved retention rules repository to enterprise collaboration and business systems to apply policy-based deletion schedules. Conduct pilot testing for each integration path.	Governance & Accountability	Phase 2 · Design Months 4-6	Medium	Not Started	0%	Privacy	2027-01-22	Medium	Confirm owner and implementation date.
DR-32	Ensure data retention rules are included in system procurement criteria and vendor assessments. Amend third-party data processing agreements to include specific retention clauses. Link retention responsibilities in the approved retention rules repository to each vendor profile, with evidence uploaded.	Disposition & Destruction	Phase 2 · Design Months 4-6	High	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-33	Evaluate retention automation capabilities during application design and migration planning. Assess retention automation, event triggers, metadata quality, and deletion capability during solution design, procurement, and migration planning before systems go live.	Disposition & Destruction	Phase 2 · Design Months 4-6	High	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-34	Conduct annual data mapping to support lifecycle enforcement of retention policies. Ensure all data processing lifecycle stages are mapped to corresponding retention rules in the approved retention rules repository, including data creation, storage, use, archiving, and deletion.	Disposition & Destruction	Phase 2 · Design Months 4-6	High	Not Started	0%	Privacy	2027-01-22	High	Confirm owner and implementation date.
DR-35	Ensure policies support the principle of 'storage limitation' across all regions and departments. Document how each policy and schedule supports the storage-limitation principle and ensure the rationale is traceable in governance records and supporting standards.	Governance & Accountability	Phase 2 · Design Months 4-6	Medium	Not Started	0%	Privacy	2027-01-22	Medium	Confirm owner and implementation date.
DR-36	Map retention dependencies in federated systems to avoid inconsistent application across data flows. Configure system connectors from the approved retention rules repository to enterprise collaboration and business systems to apply policy-based deletion schedules. Conduct pilot testing for each integration path.	Governance & Accountability	Phase 3 · Implementation Months 7-12	High	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-37	Develop tools for exception management, legal hold tracking, and retention schedule overrides. Implement controlled workflows for exceptions, legal holds, and schedule overrides, with approvals recorded in the approved privacy governance platform and execution tracked in the approved retention rules repository where applicable.	Governance & Accountability	Phase 3 · Implementation Months 7-12	Critical	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-38	Monitor regulatory updates from supervisory authorities for changes to data retention requirements. Monitor guidance and enforcement developments from supervisory authorities and update retention rules, policies, or schedules where regulatory change affects the control environment.	Legal Rules & Schedule	Phase 3 · Implementation Months 7-12	High	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-39	Assign SME (Subject Matter Expert) ownership of legal basis and retention by data type. Use embedded legal references to map each data category to its statutory or contractual retention basis. Validate with internal legal counsel and assign reference IDs for tracking.	Governance & Accountability	Phase 3 · Implementation Months 7-12	Critical	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-40	Evaluate cross-border data flows and applicable local retention rules for multi-national operations. Assess cross-border data flows to identify conflicting local retention, localisation, employment, telecom, or evidence-preservation requirements and reflect the outcome in the approved schedule set.	Assurance & Monitoring	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-41	Conduct training and simulations for IT teams to practise policy-based deletion and reporting. Draft or revise the organisation-wide data retention policy in coordination with Legal and Compliance, ensuring it is aligned with GDPR, DORA, and telecom regulatory requirements. Upload the approved policy into the approved retention rules repository as the top-level reference.	Governance & Accountability	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-42	Ensure business owners review retention categories quarterly and submit updates. Establish a Data Retention Governance organisation to meet quarterly and review any changes in regulations or retention rules configured in the approved retention rules repository.	Governance & Accountability	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-43	Build version history and changelog auditability into the retention policy lifecycle. Draft or revise the organisation-wide data retention policy in coordination with Legal and Compliance, ensuring it is aligned with GDPR, DORA, and telecom regulatory requirements. Upload the approved policy into the approved retention rules repository as the top-level reference.	Governance & Accountability	Phase 3 · Implementation Months 7-12	High	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-44	Ensure senior management reviews and signs off annual retention compliance reports. Establish a Data Retention Governance organisation to meet quarterly and review any changes in regulations or retention rules configured in the approved retention rules repository.	Governance & Accountability	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-45	Define rules for personal data in clinical trial and research datasets. Define retention rules for clinical trial and research datasets based on protocol, ethics, pharmacovigilance, and legal requirements, with separate handling for identifiable and anonymised data.	Legal Rules & Schedule	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-46	Align data retention with whistleblowing and ethics line obligations. Set retention and access rules for whistleblowing and ethics line records that balance confidentiality, investigation needs, statutory requirements, and defensible deletion.	Legal Rules & Schedule	Phase 3 · Implementation Months 7-12	High	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-47	Define retention for grievance, complaint, and disciplinary records. Define retention periods for grievance, complaint, disciplinary, and employee-relations records by case type, jurisdiction, and litigation risk, with clear closure triggers.	Legal Rules & Schedule	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-48	Ensure all legacy contracts and email archives are reviewed and archived or deleted. Document retention rules for backup systems and define purge cycles. Coordinate with infrastructure teams to ensure backups are included in the approved retention rules repository enforcement and reporting.	Disposition & Destruction	Phase 3 · Implementation Months 7-12	High	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-49	Ensure password reset logs, access recovery data follow minimal retention practices. Set minimal retention periods for password reset logs, access recovery data, and related support artefacts, ensuring they are kept only as long as needed for security, fraud, and audit purposes.	Governance & Accountability	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-50	Link all systems handling customer data to active retention rules in metadata repositories. Define metadata taxonomy to classify files by retention category. Work with IT to automate metadata tagging and enable enforcement triggers via the approved retention rules repository.	Technology & Enforcement	Phase 3 · Implementation Months 7-12	Critical	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-51	Ensure regulators can request a full retention audit trail across all business areas. Enable audit logging for all retention rule changes and deletion activities within the approved retention rules repository. Ensure reports are accessible to DPO and internal audit teams.	Disposition & Destruction	Phase 3 · Implementation Months 7-12	Critical	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-52	Align product lifecycle management systems with document and asset retention policies. Configure system connectors from the approved retention rules repository to enterprise collaboration and business systems to apply policy-based deletion schedules. Conduct pilot testing for each integration path.	Governance & Accountability	Phase 3 · Implementation Months 7-12	Critical	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-53	Ensure AI/ML model training datasets include retention controls for training data. Develop retention-specific training modules and reference the approved retention rules repository examples. Distribute to relevant staff and record completions in LMS for audit readiness.	Disposition & Destruction	Phase 3 · Implementation Months 7-12	Critical	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-54	Define minimum and maximum retention durations for internal audit records. Enable audit logging for all retention rule changes and deletion activities within the approved retention rules repository. Ensure reports are accessible to DPO and internal audit teams.	Disposition & Destruction	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-55	Ensure geolocation and mobile device data are reviewed for proportionality and necessity in retention. Establish a Data Retention Governance organisation to meet quarterly and review any changes in regulations or retention rules configured in the approved retention rules repository.	Governance & Accountability	Phase 3 · Implementation Months 7-12	Critical	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-56	Ensure GDPR Art.5(1)(e) is explicitly mapped in the retention compliance documentation. Map GDPR Article 5(1)(e) explicitly into the retention framework, policy rationale, and control library so the storage-limitation principle is evidenced in documentation and review activity.	Governance & Accountability	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-57	Develop workflow and escalation if a system lacks automated retention enforcement. Configure system connectors from the approved retention rules repository to enterprise collaboration and business systems to apply policy-based deletion schedules. Conduct pilot testing for each integration path.	Governance & Accountability	Phase 3 · Implementation Months 7-12	High	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-58	Ensure management dashboards surface non-compliance or overdue retention triggers. Configure dashboards and reporting to highlight overdue deletion events, missing schedules, legal hold conflicts, exception backlogs, and other retention non-compliance indicators.	Legal Rules & Schedule	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-59	Ensure old business data in legacy software is decommissioned with defensible deletion evidence. Plan and execute legacy-system decommissioning with inventory validation, retention review, secure archival where justified, and defensible deletion evidence for data removed.	Disposition & Destruction	Phase 3 · Implementation Months 7-12	Critical	Not Started	0%	Privacy	2027-07-22	High	Confirm owner and implementation date.
DR-60	Develop audit plan for random sampling of systems to verify retention compliance quarterly. Enable audit logging for all retention rule changes and deletion activities within the approved retention rules repository. Ensure reports are accessible to DPO and internal audit teams.	Disposition & Destruction	Phase 3 · Implementation Months 7-12	Medium	Not Started	0%	Privacy	2027-07-22	Medium	Confirm owner and implementation date.
DR-61	Include retention score as part of vendor onboarding and annual third-party reviews. Amend third-party data processing agreements to include specific retention clauses. Link retention responsibilities in the approved retention rules repository to each vendor profile, with evidence uploaded.	Legal Rules & Schedule	Phase 4 · Validation & Maturity Months 13-18	Critical	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.
DR-62	Ensure right of erasure and retention are reconciled in DSAR processes and tooling. Define how right-of-erasure requests interact with legal retention duties, legal holds, and statutory recordkeeping, and embed the decision logic into DSAR procedures and tooling.	Governance & Accountability	Phase 4 · Validation & Maturity Months 13-18	Critical	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.
DR-63	Ensure voice recordings, call logs and chat transcripts follow telecom and privacy law retention. Apply documented retention rules to voice recordings, call logs, and chat transcripts, taking account of telecom, employment, customer-service, and regulatory requirements.	Legal Rules & Schedule	Phase 4 · Validation & Maturity Months 13-18	High	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.
DR-64	Develop shared service guidance for data retention across multi-entity organisation structures. Issue organisation-wide shared-services guidance that clarifies which entity owns retention decisions, which entity executes them, and how evidence is maintained across multi-entity operations.	Assurance & Monitoring	Phase 4 · Validation & Maturity Months 13-18	Critical	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.
DR-65	Implement machine-readable retention tagging in enterprise content management systems. Define metadata taxonomy to classify files by retention category. Work with IT to automate metadata tagging and enable enforcement triggers via the approved retention rules repository.	Technology & Enforcement	Phase 4 · Validation & Maturity Months 13-18	Critical	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.
DR-66	Ensure E2EE (end-to-end encrypted) systems include admin policies for defensible data deletion. Configure system connectors from the approved retention rules repository to enterprise collaboration and business systems to apply policy-based deletion schedules. Conduct pilot testing for each integration path.	Governance & Accountability	Phase 4 · Validation & Maturity Months 13-18	High	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.
DR-67	Develop technical standard for retention and deletion by file type and risk category. Publish a technical standard covering retention and deletion controls by file type, repository, and risk category, including trigger events, metadata requirements, and evidence expectations.	Governance & Accountability	Phase 4 · Validation & Maturity Months 13-18	Medium	Not Started	0%	Privacy	2028-01-22	Medium	Confirm owner and implementation date.
DR-68	Ensure training materials and corporate communications are appropriately categorised for retention. Develop retention-specific training modules and reference the approved retention rules repository examples. Distribute to relevant staff and record completions in LMS for audit readiness.	Governance & Accountability	Phase 4 · Validation & Maturity Months 13-18	High	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.
DR-69	Audit high-volume systems for data hoarding or overly long retention categories. Enable audit logging for all retention rule changes and deletion activities within the approved retention rules repository. Ensure reports are accessible to DPO and internal audit teams.	Governance & Accountability	Phase 4 · Validation & Maturity Months 13-18	Medium	Not Started	0%	Privacy	2028-01-22	Medium	Confirm owner and implementation date.
DR-70	Ensure alignment between privacy notice timelines and actual system retention behaviour. Configure system connectors from the approved retention rules repository to enterprise collaboration and business systems to apply policy-based deletion schedules. Conduct pilot testing for each integration path.	Governance & Accountability	Phase 4 · Validation & Maturity Months 13-18	Critical	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.
DR-71	Implement review process for non-personal but sensitive commercial data retention. Establish a Data Retention Governance organisation to meet quarterly and review any changes in regulations or retention rules configured in the approved retention rules repository.	Governance & Accountability	Phase 4 · Validation & Maturity Months 13-18	Medium	Not Started	0%	Privacy	2028-01-22	Medium	Confirm owner and implementation date.
DR-72	Ensure transparency logs for retention schedule changes are published internally. Maintain internal transparency logs for retention schedule changes, including the rationale, approver, effective date, impacted records, and evidence of implementation.	Assurance & Monitoring	Phase 4 · Validation & Maturity Months 13-18	Medium	Not Started	0%	Privacy	2028-01-22	Medium	Confirm owner and implementation date.
DR-73	Ensure internal communications platforms (e.g. Slack, Teams) follow known retention rules. Define and enforce retention rules for Slack, Teams, and other collaboration platforms, including channels, direct messages, shared files, exports, and legal-hold scenarios.	Legal Rules & Schedule	Phase 4 · Validation & Maturity Months 13-18	Critical	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.
DR-74	Map retention obligations to multi-jurisdictional eDiscovery laws and regulatory retention. Map eDiscovery, litigation-hold, and regulatory-preservation obligations across relevant jurisdictions and ensure they can temporarily override normal retention and deletion schedules.	Legal Rules & Schedule	Phase 4 · Validation & Maturity Months 13-18	High	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.
DR-75	Conduct cross-functional working organisation review of policies every 6 months. Establish a Data Retention Governance organisation to meet quarterly and review any changes in regulations or retention rules configured in the approved retention rules repository.	Governance & Accountability	Phase 4 · Validation & Maturity Months 13-18	High	Not Started	0%	Privacy	2028-01-22	High	Confirm owner and implementation date.

Create disposition event

Schedule rule

Repository / system

Eligible population

Method

Data owner role

Approver role

Planned date

Validation method

Exclusions, holds and dependencies

Destruction method coach

Step 1

Use approved deletion commands and verify data is no longer accessible through normal or privileged interfaces.

Step 2

Check replicas, indexes, exports, caches and processor copies.

Step 3

Retain job logs, samples and failed-record remediation.

ID	Record set	Repository	Method	Planned	Owner	Approver	Status	Validation
No disposition events yet.

Create legal or regulatory hold

Matter / hold title

Hold authority

Issued date

Review date

Legal owner role

Custodians / systems

Scope, search terms and preservation instructions

Hold decision tree

1. Confirm a credible matter or duty. 2. Identify custodians, repositories and date ranges. 3. suspend deletion without over-preserving. 4. notify owners and preserve evidence. 5. review periodically. 6. release formally and return records to the normal schedule.

ID	Matter	Type	Issued	Review	Owner	Scope	Status
No holds recorded.

1. Is there an approved organisation-wide retention and destruction policy with defined scope, triggers, exceptions and review cadence?Governance

2. Does every processing activity and data store have a mapped owner, purpose, jurisdiction, trigger and retention rule?Inventory

3. Are statutory floors, maximum periods, limitation rules, sector requirements and archival duties separately recorded with official citations?Legal rules

4. Do privacy notices and internal records accurately describe retention periods or objective criteria?Notices

5. Are retention rules technically enforced across structured data, collaboration tools, email, cloud, endpoints, archives and shadow stores?Systems

6. Are backups, snapshots, replicas and disaster-recovery copies covered by documented expiry and restore controls?Backups

7. Do contracts, due diligence and assurance confirm processor and subprocessor retention, deletion and evidence obligations?Third parties

8. Is there a formal, targeted hold process that suspends deletion, preserves chain of custody and releases records back to schedule?Legal holds

9. Are deletion, anonymisation, cryptographic erase, purge and physical destruction methods selected and validated by media and sensitivity?Disposition

10. Are deletion jobs, approvals, exceptions, certificates, test results and failed events retained in a chronological audit trail?Evidence

11. Can erasure, objection and withdrawal outcomes propagate to source data, copies, derived data and processors without defeating lawful holds?Rights

12. Are obsolete, duplicate, inactive and dark-data holdings identified and removed rather than indefinitely archived?Data minimisation

13. Are training datasets, prompts, outputs, embeddings, feature stores and model-lineage evidence governed by explicit rules?AI and analytics

14. Do data owners, records management, privacy, legal, IT/security, approvers and audit understand role-specific decisions and hand-offs?Roles

15. Are rules reviewed on legal change, system change, purpose change, incident, acquisition, migration and at a defined periodic cadence?Monitoring

Maturity result

Initial

Prioritise governance, inventory, official legal mapping, owners and one controlled disposition pilot.

Role queue

Programme · DR-01 · Establish an organisation-wide Data Retention Policy aligned with GDPR, and telecom regulations.

Due: 2026-10-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-09 · Incorporate data minimisation and lifecycle management into retention planning.

Due: 2026-10-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-11 · Ensure backup systems and cold storage repositories are subject to applicable retention rules.

Due: 2026-10-22 · Status: Not Started
Next: Confirm owner and implementation date.

Schedule · RS-001 · Employee personnel file

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-002 · Recruitment applications - unsuccessful

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-003 · Right-to-work and immigration checks

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-004 · Payroll and payslip records

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-005 · Benefits and pension administration

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-006 · Employee health and occupational health

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-007 · Disciplinary and grievance records

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-008 · Training and competence records

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-009 · General ledger and accounting books

Due: 2026-10-22 · Status: Under Review
Next: Validate source, owner, system scope and approval.

Schedule · RS-010 · Invoices, VAT/GST and receipts

Due: 2026-10-22 · Status: Under Review
Next: Validate source, owner, system scope and approval.

Schedule · RS-011 · Bank statements and treasury records

Due: 2026-10-22 · Status: Under Review
Next: Validate source, owner, system scope and approval.

Schedule · RS-012 · Expense claims

Due: 2026-10-22 · Status: Under Review
Next: Validate source, owner, system scope and approval.

Schedule · RS-013 · Audit working papers

Due: 2026-10-22 · Status: Under Review
Next: Validate source, owner, system scope and approval.

Schedule · RS-014 · Commercial contracts

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-015 · Contract negotiation and drafts

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-016 · Litigation and dispute files

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-017 · Legal advice and privileged material

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-018 · DSAR and individual-rights case files

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-019 · Consent records

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-020 · Privacy complaints and regulator correspondence

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-021 · DPIA, PIA and risk-assessment records

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-022 · RoPA and processing inventory history

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-023 · Authentication and access logs

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-024 · Privileged administrator logs

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-025 · Security incident records

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-026 · CCTV footage

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-027 · Biometric templates

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-028 · Email and collaboration content

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-029 · Backups and disaster-recovery copies

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Schedule · RS-030 · Device and media disposal certificates

Due: 2026-10-22 · Status: Draft
Next: Validate source, owner, system scope and approval.

Programme · DR-16 · Integrate the retention rules repository with the privacy inventory, to synchronise retention schedules and ROPA.

Due: 2027-01-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-30 · Ensure business continuity and disaster recovery plans include data retention compliance checkpoints.

Due: 2027-01-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-34 · Conduct annual data mapping to support lifecycle enforcement of retention policies.

Due: 2027-01-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-44 · Ensure senior management reviews and signs off annual retention compliance reports.

Due: 2027-07-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-46 · Align data retention with whistleblowing and ethics line obligations.

Due: 2027-07-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-49 · Ensure password reset logs, access recovery data follow minimal retention practices.

Due: 2027-07-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-51 · Ensure regulators can request a full retention audit trail across all business areas.

Due: 2027-07-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-53 · Ensure AI/ML model training datasets include retention controls for training data.

Due: 2027-07-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-66 · Ensure E2EE (end-to-end encrypted) systems include admin policies for defensible data deletion.

Due: 2028-01-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-68 · Ensure training materials and corporate communications are appropriately categorised for retention.

Due: 2028-01-22 · Status: Not Started
Next: Confirm owner and implementation date.

Programme · DR-75 · Conduct cross-functional working organisation review of policies every 6 months.

Due: 2028-01-22 · Status: Not Started
Next: Confirm owner and implementation date.

Role-specific coached guidance

What to do

Maintain the schedule, classification, lifecycle states, review calendar, archival decisions and evidence standards.

What not to do

Do not treat a schedule as complete without system mapping and accountable owners.

Evidence to retain

Controlled schedule, review minutes, disposition certificates, hold releases and quality checks.

When to escalate

Escalate unmapped stores, repeated failed deletion and inconsistent local rules.

Chronological audit record

25/07/2026, 14:16:59 · Report rendered

System · Executive retention report

25/07/2026, 14:10:17 · Report rendered

System · Executive retention report

25/07/2026, 12:31:37 · Report rendered

System · Executive retention report

25/07/2026, 07:10:15 · Report rendered

System · Executive retention report

25/07/2026, 07:09:58 · Report rendered

System · Executive retention report

24/07/2026, 20:33:45 · Report rendered

System · Executive retention report

24/07/2026, 20:23:41 · Report rendered

System · Executive retention report

24/07/2026, 20:23:27 · Report rendered

System · Executive retention report

24/07/2026, 20:23:27 · Report rendered

System · Executive retention report

24/07/2026, 20:23:18 · Report rendered

System · Executive retention report

24/07/2026, 20:23:18 · Report rendered

System · Executive retention report

24/07/2026, 20:23:08 · Report rendered

System · Executive retention report

24/07/2026, 20:23:08 · Report rendered

System · Executive retention report

24/07/2026, 20:18:00 · Report rendered

System · Executive retention report

24/07/2026, 20:18:00 · Report rendered

System · Executive retention report

22/07/2026, 21:33:30 · Report rendered

System · Executive retention report

22/07/2026, 21:30:25 · Report rendered

System · Executive retention report

22/07/2026, 21:04:48 · Report rendered

System · Executive retention report

22/07/2026, 20:53:39 · Report rendered

System · Executive retention report

22/07/2026, 20:53:10 · Sector pack applied

Records Management · Financial services and payments · 14 rules moved to review

22/07/2026, 20:52:59 · Programme settings updated

Records Management · Programme dates and governance settings saved

22/07/2026, 20:52:01 · Workspace initialised

System · Global retention and destruction workspace created with 75 programme controls.

Report controls

Report Presentation

Reporting start

Reporting end

Email recipient Email subject

PRIVASTU · Governance report

Executive retention report

Reporting period 2026-07-22 to 2028-01-22

Generated 25/07/2026, 14:16:59

Reliance: Jurisdiction profiles and schedule examples require validation against current official law, sector obligations, limitation rules and the organisation’s facts before approval.

143
Jurisdictions

61
Schedule rules

0%
Programme progress

0
Active holds

Executive assessment

The retention framework combines purpose-based rules, local-law validation, system enforcement, legal holds, secure destruction and auditable evidence. Priority is determined by unverified high-risk rules, overdue controls, failed disposition and unresolved holds.

Priority actions

Approve the first schedule baseline

Select priority record classes, validate official sources and obtain owner/legal approval.

Configure legal hold governance

Create the hold roles, notice template, periodic review and formal release process.

Run a controlled disposition pilot

Select a low-complexity repository, document exclusions, validate deletion and issue a certificate.

14 rules are due for review

Revalidate purpose, law, system scope, notices and technical enforcement.

Method and auditability

This report is generated from the current retention schedule, programme, disposition, hold, assessment and chronological audit records. Changes should be made in the governed workspace rather than editing the report output.

PRIVASTU AI Governance Hub

The full evidence-led AI governance operating environment is embedded here. Existing Registry & Compliance, AI Use Detection and AI Infrastructure Map modules remain available in the AI Governance menu.

Ready to load

AI Governance Programme Intelligence

150-control AI governance command view

The full implementation programme sits in PROPELLOR. This AI Governance view deliberately presents only the higher-level intelligence needed by AI owners, risk leaders and executive oversight: delivery health, EU AI Act readiness, AIGP coverage, critical gaps and regulator-guidance currency.

150Programme controls

0%Overall progress

0Complete

0In progress / review

0Blocked

0Overdue

Programme architecture

Strategy, Accountability & Governance

AI Inventory & Classification

Legal Applicability & Regulatory Change

Prohibited Practices & Rights Protection

High-Risk AI System Controls

Data Governance & Data Quality

Technical Documentation & Recordkeeping

Human Oversight & Transparency

Seven further programme domains are managed in the full PROPELLOR board.

Executive signals and next steps

0 blocked controls require accountable intervention.

0 controls are beyond their recommended due date.

150 controls require evidence validation or completion.

Next step: open PROPELLOR and work the current 90-day sprint, starting with critical and high-priority controls.

EU AI Act control spine

The control board covers governance, prohibited practices, high-risk systems, GPAI, transparency, data governance, technical documentation, logging, human oversight, accuracy, robustness, cybersecurity, conformity, registration, post-market monitoring and incidents.

15 domains12 sprints4 phases150 controls

Regulator and professional interoperability

Every control retains its IAPP AIGP domain, competency and performance indicator mapping. The programme also contains the reviewed European DPA guidance library and control-level mapping from EDPB, ICO, CNIL, Garante, German DSK and other European authorities.

27 DPA sources4 AIGP domainsEU AI Act articles

AI Use Detection & Discovery

Discover, evidence and govern potential AI usage across documents, websites, software artefacts and enterprise workflows. Technical evidence is separated from probabilistic indicators and all conclusions remain subject to human validation.

2SCANS COMPLETEDFiles, URLs and evidence bundles

1CONFIRMED AI USESDirect machine-verifiable evidence

0SHADOW AI SIGNALSUnapproved or unregistered use

3AWAITING REVIEWHuman validation required

1. Upload documents or technical artefacts

Select files first. Nothing is analysed until the visible Submit & Scan button is pressed.

⌁

Drop files here or click to choose PDF, DOCX, PPTX, XLSX, HTML, JSON, source code, manifests, images and evidence bundles

No files selected

2. Website, URL or pasted source assessment

Enter a URL and optionally paste source, a manifest, policy text or a network extract to materially strengthen the evidence scan.

Website or URL

Optional page source, manifest or evidence text

3. Scan context and governance routing

Business area

Jurisdiction

System or process owner

Scan depth

Known content provenance

Preparing scan0%

Evidence findings

Review each signal, validate or reject it and route confirmed use into governance.

Source	Finding	Evidence	Confidence	Risk	Review status
DORA Implementation Plan.docx 22/07/2026, 15:59:14	No reliable AI indicator found No finding	The extracted material did not contain direct or corroborating evidence. This is not proof that AI is absent.	Inconclusive 12%	Low	Routed to AI Governance
LOA Master Classification Tool - Operational Guide & Technical Analysis.pdf 22/07/2026, 11:15:15	AI subject-matter reference AI subject matter	Matched ai subject matter indicator “AI-powered” in extracted document content.	Indicative 48%	Low	Awaiting human review
LOA Master Classification Tool - Operational Guide & Technical Analysis.pdf 22/07/2026, 11:15:15	Planned or future AI capability Planned AI	Matched planned ai indicator “Phase 1: Manual Foundation (Current Implementation) 247 core elements pre-class” in extracted document content.	Strongly indicated 78%	Medium	Awaiting human review
LOA Master Classification Tool - Operational Guide & Technical Analysis.pdf 22/07/2026, 11:15:15	Explicit rule-based or non-AI disclosure Non-AI disclosure	Matched non-ai disclosure indicator “SIMULATION ONLY” in extracted document content.	Confirmed 92%	Low	Awaiting human review

Shadow AI discovery

Signals from unapproved providers, API keys, model endpoints, AI-enabled SaaS features, agent frameworks and unregistered workflows.

No shadow AI signals detected.

Content provenance laboratory

Metadata, generator identifiers, content credentials, revision artefacts, AI disclosures and synthetic-content indicators are shown separately from technical proof of AI system use.

No provenance or synthetic-content indicators recorded.

AI Use Detection Report Studio

Generate the same two output formats used throughout AI Governance.

Two report outputs are available for every report type. Structured HTML is optimised for working review, evidence interrogation and data extraction. Polished HTML uses the high-spec PRIVASTU presentation format with a branded cover, executive summary, analysis cards, detailed evidence tables, methodology, reliance statement and print-ready styling.

◉

Complete AI Use Discovery Report

All scans, findings, evidence strength, governance triggers and recommended actions.

◆

Executive AI Discovery Summary

Board-ready exposure, confidence, shadow AI and remediation priorities.

▤

Document and Artefact Assessment

File-level technical indicators, metadata, provenance and limitations.

◎

Website AI Surface Report

URL, source, endpoint, SDK, disclosure and crawler escalation evidence.

⌁

AI Evidence Chain Report

Traceable evidence hierarchy, confidence rationale and reviewer status.

◐

Shadow AI Exposure Report

Unapproved services, model endpoints, API-key indicators and ownership gaps.

◇

Content Provenance Report

Metadata, C2PA-style indicators, generator references and authenticity limits.

▦

AI System Bill of Materials

Providers, models, frameworks, tools, vector stores and detected dependencies.

⚖

Regulatory Trigger Assessment

Potential EU AI Act, UK GDPR, DPIA, FRIA, transparency and vendor triggers.

✓

Registration and Remediation Plan

Prioritised actions, accountable owners, evidence requests and closure route.

◎

AI Infrastructure Intelligence Map

Trace each AI system and agent through models, data stores, APIs, cloud regions, edge infrastructure, satellite links, encryption keys and human control points. Evaluate sovereignty, concentration, resilience, change impact and regulatory evidence from one governed map.

Global Geographic Intelligence Console

Infrastructure, AI, physical routes, sovereignty, resilience, incidents and accountability in one governed layer

Visible points12

High / critical6

Countries12

Single points of failure4

Ask the globe

Select layers or ask a geographic governance question.

Time state2026

Scenario simulation

No scenario active.

Priority geographic signals

Open AI Transfer Finding · 86Unresolved transfer evidence and provider-change exposure

LEO AI Telemetry Satellite · 74Onboard anomaly detection · signed telemetry · ground-controlled keys

Virginia Foundation Model Endpoint · 72External LLM API · transfer and subprocessor controls

Cape Town Warm Disaster Recovery · 67Encrypted recovery copies · tested restoration required

Singapore Edge Inference · 61Local intent classification and minimisation

Frankfurt High-Risk Cluster · 58Restricted Annex III workloads

Incidents

Response and escalation

Incident response is tracking 3 live records. Immediate focus should remain on escalated matters, running regulatory clocks and repeat control failures.

Reference	Incident	Severity	Jurisdiction	72h Clock	Owner	Status
INC-1442	Misdirected email with HR data	Medium	UK	Running	Security	Investigating
INC-1443	Lost encrypted laptop	Low	France	Not started	IT	Contained
INC-1444	Improper access to customer export	High	Germany	Running	Privacy + Legal	Escalated

📊

PRIVASTU Reports

12 board and compliance reports · Live data · ICO-aligned

Reports Available

Live

Data Source

ICO

Aligned

📊

Loading Report Suite

Privacy Risk · DSAR Pipeline · Breach Log · Consent Health · Maturity Score

🧰

Toolkits & Decision Pathways

Interactive decision trees, guided wizards, and visual tree builder for building your own

⚖️

Lawful Basis Finder

Interactive guide to the 6 legal grounds under Article 6 GDPR

5 stepsGDPR

🔍

DPIA Trigger Tool

Determine if a Data Protection Impact Assessment is required under Art 35

6 stepsArt 35

⏰

Retention Calculator

Compute safe retention periods based on data category and legal obligations

4 stepsArt 5(1)(e)

🚨

Breach Notifier

72-hour breach notification decision path - notify authority or not?

5 stepsArt 33/34

🛡️

Transfer Safeguard Checker

Verify international transfers are lawful under Chapter V GDPR

5 stepsCh. V

✅

Consent Validity

Check whether consent meets GDPR's strict validity requirements

5 stepsArt 7

👤

DSAR Response Type

Identify the right response to a data subject rights request

5 stepsCh. III

✦

AI Risk Classifier

Classify an AI system under the EU AI Act risk framework

5 stepsEU AI Act

⚠️

Article 9 Condition Finder

Find the correct Article 9(2) condition for special-category data.

9 stepsArt 9

💼

Vendor Risk Tier

Tier a processor and scope Article 28 diligence, contracts and assurance.

4 stepsArt 28

🍪

Cookie Classifier

Decide which technologies need consent under PECR and national guidance.

3 stepsPECR

🔒

LOA / Restricted Data Router

Route US, LOA, CPNI and restricted-data processing to the right control tier.

4 stepsLOA

Interactive Decision Trees

Step-by-step guided pathways for complex privacy decisions. Each tree captures reasoning, suggests actions, and documents outcomes.

⚖️

Lawful Basis Finder

Which of the 6 lawful bases applies to your processing activity? Walks through consent, contract, legal obligation, vital interests, public task, legitimate interests.

5 stepsArt 6GDPR

🔍

DPIA Trigger Tool

Is a Data Protection Impact Assessment required? Tests against the 9 WP29 criteria and Art 35(3) high-risk triggers.

6 stepsArt 35WP29

⏰

Retention Period Calculator

Determine a safe, defensible retention period for a data category considering legal, operational, and disposal obligations.

4 stepsArt 5(1)(e)

🚨

72h Breach Notifier

Was this incident a personal data breach? Must we notify the supervisory authority within 72 hours? Must we notify affected individuals?

5 stepsArt 33/34

🛡️

International Transfer Safeguards

Can we lawfully transfer personal data out of the UK/EEA? Adequacy decisions, SCCs, BCRs, and derogations.

5 stepsCh. V

✅

Is Consent Valid?

Test consent against GDPR's strict validity requirements: freely given, specific, informed, unambiguous and with a clear affirmative action.

5 stepsArt 7

👤

DSAR Response Type

Identify whether this is an access, rectification, erasure, restriction, portability, or objection request, and the right response path.

5 stepsArt 15-22

✦

EU AI Act Risk Classifier

Determine whether an AI system is prohibited, high-risk, limited-risk or minimal-risk under the EU AI Act.

5 stepsEU AI Act

⚠️

Article 9 Condition Finder

Walk through all Article 9(2) conditions and identify the evidence and safeguards needed.

9 stepsArt 9GPO Data Hub

💼

Vendor Risk Tier

Classify processors into critical, elevated, standard or no-personal-data tiers.

4 stepsArt 28GPO Data Hub

🍪

Cookie Classification

Classify essential, exempt analytics, consented analytics and marketing technologies.

3 stepsPECRGPO Data Hub

🔒

LOA / Restricted Data Router

Apply the dual-track LOA and privacy routing model to US and restricted data.

4 stepsLOAGPO Data Hub

Visual Decision Tree Builder

Build your own custom decision trees. Add questions, options, and outcomes. Save, export, and deploy to the gallery.

Add Nodes

Templates

Blank TreeStart from scratch

Yes/No TemplateBinary decision path

Multi-choice Template4-option branching

Scored AssessmentCumulative risk scoring

My Trees

🌲

No tree yet

Click "+ New Tree" or choose a template to begin building

Tree Settings

Tree Name

Description

Selected Node

Select a node to edit

📘

Privacy Fundamentals

8 modules · ~4 hours · Foundation-level certification covering GDPR principles, data subject rights, lawful bases, and privacy by design.

🎓

DPO Certification

16 modules · ~32 hours · Professional certification aligned to IAPP CIPP/E syllabus. DPO responsibilities, Art 35, international transfers, enforcement.

✦

AI Governance

10 modules · ~18 hours · EU AI Act readiness, risk classification, conformity assessments, transparency, and AI system registration.

🚨

Incident Response

6 modules · ~8 hours · 72-hour breach workflow, containment, impact assessment, regulator and individual notification templates.

Controller / Processor Role Qualification

A seven-stage operational assessment for controller, processor, joint-controller, independent-controller and layered-role determinations. It includes all 27 EU Member States, national supplementary-law prompts, sector overlays, clause guidance, a polished result page and full report exports.

27EU Member State supplementary-law and DPA contexts

29Sector contexts with relevant EU instruments and role questions

7Guided stages from scope through determination and record

8Operational outputs including polished and structured HTML, JSON, Word-style, CSV and clause packs

Use: assess one defined processing operation at a time. The tool preserves the factual GDPR purpose and essential-means test then adds country, employment, health, financial, communications, public-sector, AI, cybersecurity and product-law context. Local legal verification remains required.

⚖

Role Qualification Workspace

Select Load workspace to initialise the full assessment.

Settings

Connectivity

Governance

Display

Deployment

Settings Operations Centre

Govern organisation structure, access, integrations, alerts, deployment and evidence from one controlled workspace.

0Entities and sites

0Users

0Connected systems

0Enabled frameworks

0Active alert rules

Organisation

Core identity, legal entity and primary contacts.

Identity

Organisation name

Trading name

Company registration

Country of incorporation

Primary data law

ICO / DPA registration

Data Protection Officer

DPO name

DPO email

DPO phone

External DPO provider

Global Corporate Hierarchy

Build your multi-entity structure - parent group, subsidiaries, branches and joint ventures. Each entity inherits or overrides its privacy configuration.

Users & Roles

Manage system users, invite team members, assign roles that propagate permissions across all modules.

User	Email	Role	Entity	Status	Last active	MFA
Stewart Haynes	s.haynes@example.com	Super Admin	PRIVASTU Group Ltd	Active	Today	On
Anna Müller	a.muller@eu.example.com	DPO / Privacy Lead	PRIVASTU EU GmbH	Active	Yesterday	On
James Chen	j.chen@sg.example.com	Privacy Manager	PRIVASTU Asia Pte Ltd	Active	2 days ago	Off
Sarah Okafor	s.okafor@example.com	Legal Counsel	PRIVASTU Group Ltd	Active	3 days ago	On
Mark Rossi	m.rossi@eu.example.com	CISO / Security	PRIVASTU EU GmbH	Inactive	2 weeks ago	Off

Role Management

Define roles, set module-level permissions, control what each role can see, create, edit and approve across the system.

Super Admin

Full system access - all modules, settings and user management.

Data Mapping: fullDSAR: fullAssessments: fullVendors: fullSettings: fullSignals: full

DPO / Privacy Lead

All privacy modules. Full read/write on assessments, RoPA, DSAR and signals. No settings.

Data Mapping: fullDSAR: fullAssessments: fullVendors: fullSettings: readSignals: full

Privacy Manager

Operational privacy management. Create and edit records. No system settings.

Data Mapping: fullDSAR: fullAssessments: fullVendors: readSettings: noneSignals: read

Legal Counsel

Read access to all modules. Can comment on assessments and sign off on LIAs/DPIAs.

Data Mapping: readDSAR: readAssessments: fullVendors: readSettings: noneSignals: read

CISO / Security

Access to incidents, vendor risk, AI governance and security-relevant assessments.

Data Mapping: readDSAR: readAssessments: readVendors: fullSettings: noneSignals: read

HR Administrator

Access to DSAR (employee requests), training and people-related RoPA records only.

Data Mapping: restrictedDSAR: fullAssessments: readVendors: noneSettings: noneSignals: none

Read Only

View all privacy records. Cannot create, edit, or approve anything.

Data Mapping: readDSAR: readAssessments: readVendors: readSettings: noneSignals: read

APIs & Integrations

API keys, webhooks and SSO configuration.

REST API Keys

Production API Key

prv_prod_••••••••••••••••••••••••

Sandbox API Key

prv_test_••••••••••••••••••••••••

Endpoint: https://api.privastu.com/v1/

Webhooks

https://hooks.slack.com/services/T00/B00/xxx…

Events: New DSAR, Incident escalation

Active

https://outlook.office.com/webhook/xxx…

Events: Assessment overdue

Inactive

SSO / OAuth

SSO provider

Client ID

Tenant / Directory ID

Metadata URL

Data Import & Export

Bulk import records and export the full privacy estate for audit or migration.

Import by module

▣

RoPA / Data Mapping

CSV or XLSX with processing activities, purposes, legal bases and transfers.

👤

DSAR Register

Existing DSAR records with requester, type, status and deadline.

▥

Vendor Register

Vendor list with DPA status, risk tier and service details.

▤

Assessment Register

DPIA, LIA, TRA records with status, owner and risk rating.

⚠

Incident Log

Historic incidents with severity, status and jurisdiction.

≣

Policy Library

Policy metadata including version, owner, review dates.

Export

Import history

System Connectors

Pre-built integrations with enterprise systems to keep PRIVASTU data current automatically.

☁

Salesforce

CRM

Connected

Processing activities, data subject lists and vendor contracts

Last sync: 2 hours ago

👥

Workday

HRIS

Connected

Employee and applicant data, processing activities, training records

Last sync: 4 hours ago

🔧

ServiceNow

ITSM

Connected

Incident records, case data and DSAR workflow integration

Last sync: 1 hour ago

❄

Snowflake

Data Warehouse

Attention

Analytics and AI model feature data - transfer and minimisation review

Last sync: 3 days ago

🔐

Microsoft Azure AD

Identity

Connected

Single sign-on, user provisioning and group-based role assignment

Last sync: Active

💬

Slack

Notifications

Connected

Deadline alerts, new DSAR notifications and system health alerts

Last sync: Active

📋

Jira / Confluence

Project Management

Not connected

Assessment tasks, remediation tickets and policy approval workflows

🔒

OneTrust

Privacy Platform

Not connected

Data migration and RoPA import from existing OneTrust implementation

✍

DocuSign

eSignature

Not connected

DPA and assessment approval workflows with digital signatures

Notifications & Alerts

Alert triggers, recipients and channels.

Channels

Primary email

CC addresses

Slack webhook

Teams webhook

Alert rules

DSAR approaching deadline (7 days)

Email + Slack → DPO, Privacy Manager

New high-risk incident logged

Email + Slack → DPO, CISO

Assessment overdue

Email → DPO

Vendor DPA expiring (30 days)

Email → Privacy Manager

Training completion below 80%

Email → HR Administrator

Audit Log

Immutable record of all actions, data changes and user activity. Exportable for regulatory and internal audit.

Timestamp	User	Module	Action	Record	IP
2026-03-21 09:14	Stewart Haynes	DSAR Manager	Record created	PRIV-DSAR-20260321-X9B3	192.168.1.10
2026-03-21 09:00	Anna Müller	Assessment Manager	Status updated	AM-004 → Mitigation Planning	10.0.1.45
2026-03-20 16:30	System	Vendors	DPA expiry flagged	Cloud AI Labs - DPA due for renewal	-
2026-03-20 15:44	James Chen	Data Mapping	Record updated	Behavioural Analytics - risk HIGH	172.16.0.22
2026-03-20 14:12	Sarah Okafor	Incidents	Severity escalated	INC-1444 → Critical	192.168.1.15
2026-03-20 11:00	System	Training	Completion milestone	DSAR Handling - 74/82 complete	-
2026-03-19 09:30	Stewart Haynes	Settings	User invited	mark.rossi@eu.example.com	192.168.1.10

Deployment Setup

Configure PRIVASTU for client deployment - environment, licensing, onboarding and go-live checklist.

Environment

Instance subdomain

Data residency

Backup frequency

Data retention (logs)

Encryption

Client onboarding checklist

Licence & subscription

Licence tier

Licensed users

Contract start

Contract renewal

Account manager

Client success contact

Security & Authentication

MFA, session controls and access restrictions.

Authentication

Enforce MFA for all users

Required for all roles on first login.

SSO required (disable password login)

Force all users through SSO provider.

IP allowlist enforcement

Restrict access to approved IP ranges only.

Session & password policy

Session timeout (mins)

Max concurrent sessions

Password minimum length

Password expiry (days)

Branding

Customise PRIVASTU for your organisation or client. Applied to reports, exports and the portal header.

Identity

Product label

Tagline

Primary colour

Logo URL

Live preview:

PRIVASTU

360° Enterprise Privacy Management

Environment Status

Live health indicators for all PRIVASTU system components.

System information

PRIVASTU version

Environment

Data residency

Last system check

Tint My Display

Personalise your workspace - themes, tints, layout and font size. All changes apply instantly.

Theme presets

Deep Space

Default dark

Midnight

Rich dark blue

Obsidian

Near-black grey

Forest Night

Eye-friendly green

Aurora

Deep teal dark

Dusk

Warm purple dark

Solar Dark

Amber warm dark

Eye Comfort

Low-contrast warm

Slate

Blue-grey pro

Light

Clean light mode

Light Warm

Warm paper white

High Contrast

Max readability

Tint colour

Apply a colour wash over your display. Adjust intensity with the slider.

Custom:

Intensity - 0%

Navigation layout

Left sidebar

Default PRIVASTU layout

Right sidebar

Content-first view

Top navigation

Max vertical space

Font size & density

Font size - 14px

12px18px

Density

PRIVASTU Settings

PRIVASTU Command Center

Privacy Risk Radar

Privacy Maturity Score

Activity Timeline

DSAR Pipeline

Horizon Watchlist

Module Health

Global Geographic Intelligence Console

Ask the globe

Scenario simulation

Priority geographic signals

Dashboard Map Intelligence Workspace

Cross-Module Risk Heat Map

Programme Trends

Regulatory Calendar

Data Mapping

Processing inventory and RoPA control plane

Customer lifecycle management

Workforce administration

Customer support case handling

Behavioural analytics and model features

Maintenance and drift queue

Workforce administration

Customer lifecycle management

Behavioural analytics and model features

Customer support case handling

What PRIVASTU should build

Discovery triad

Evidence confidence per field

Operational and legal views

Market benchmark

OneTrust

Ketch

TrustArc

BigID / Securiti

Connector studio

Salesforce

Workday

ServiceNow

Snowflake

Microsoft 365

Owner attestation

Salesforce deployment detail

What we pull

Privacy outputs

Connector evidence

AI enrichment

Human acceptance

Run discovery simulation

AI RoPA copilot

Draft output

Suggested purpose

Legal basis

Confidence

Data subjects

Data categories

Special categories

Retention starter

Next actions

ICO, CNIL and EDPB fit

Start with data mapping and keep it current

Article 30 completeness

Register as inventory and analysis

Who / What / Why / Recipient / Retention / Security

Controller and processor records ready for supervisory access

Article 30 checklist and maintenance method

Required field families

Event-driven review

Human attestation

Jurisdiction overlays

Assistive AI, never blind AI

Deployment blueprint

Phase 1 - Core control plane

Phase 2 - High-value connectors

Phase 3 - AI copilot and drift control

Phase 4 - Deployment and operating cadence

Operating model required to sustain it

Know every asset. Map every flow. Control every risk.

Add Information Asset