Privacy Impact Assessment Workflow

Do I need technical skills to set this workflow up?

No — the template is ready to use as-is, so a workspace can publish it and start taking submissions through the request form within minutes. There's no installation or development project involved, and any tweaks can be made later by describing the change in plain English or editing steps directly in the workflow editor.

Can my team customise the screening or assessment questions?

Yes, the fields captured at intake, screening, assessment and acceptance can all be adjusted to match how your organisation runs privacy reviews. Changes are made either by describing what you want changed in plain English or by editing the relevant step in the workflow editor, and earlier versions are kept so you can see what changed.

What happens if the privacy officer decides a full assessment isn't needed?

The workflow routes the record straight to a Screened Out status and emails the owner with the screening notes explaining why no further assessment is required. If the officer decides a full assessment is needed instead, the record moves to Assessing status and a task is created for the privacy assessor.

Who is actually involved in running a privacy impact assessment through this workflow?

The initiative owner submits the request form and later completes a residual risk acceptance form — they never need an account for either. Inside the workspace, a privacy officer handles screening, approval, and setting the next review date, while a privacy assessor is assigned the full assessment task when one is required.

What happens if the privacy officer rejects the assessment?

If the assessment is rejected, the workflow closes that iteration and restarts from the assessment task, sending it back to the privacy assessor for rework. This loop can repeat as many times as needed until the officer approves the assessment, with each version of the assessment tracked on the record.

How does the owner accept the residual risk?

Once the assessment is approved, the owner is sent a form by email showing the residual risk and treatments identified during the assessment. They respond by confirming acceptance and recording any agreed actions, and because the workflow waits on this step, their answers are saved directly to the record.

Is this suitable for organisations handling a high volume of initiatives?

Yes — each initiative becomes its own record with a reference number, a status, and a full timeline, so table views and dashboards can show where every initiative sits, whether that's Screening, Assessing, Awaiting Acceptance or Closed. This makes it easier to track many privacy assessments running in parallel without losing visibility.

Does this workflow keep track of when an initiative needs to be reviewed again?

Yes, before closure the privacy officer records a next review date on the record, which is then shared with the owner in the closing email. Each business should confirm its own obligations around review frequency and record-keeping, but the date and all prior decisions remain visible in the record's timeline.

Can the owner track the status of their submission?

The owner receives an acknowledgement email with their reference number as soon as they submit the initial request, and further emails at key milestones such as screening outcomes and closure. They don't need to log in or create an account to take part — everything happens through the public request form and emailed forms.