Privacy assessments

The queue at /privacy/assessments tracks assessments for processing activities or vendors. Noru can open one automatically when ingestion first detects new sensitive/special-category or cross-border processing; users can also open one manually or from other signals. Automatic creation is idempotent so the same open assessment is not duplicated for one activity.

An automatic trigger is a prompt to assess, not a conclusion that a statutory DPIA is definitely required.

Assessment detail (/privacy/assessments/[id])

The detail page records:

• title, subject, source/system context, trigger, and status
• description of the processing
• necessity and proportionality analysis
• linked risks from the central risk register
• linked evidence from the Evidence Vault
• outcome and residual-risk note

The assessment deliberately reuses the main risk register rather than embedding a second scoring model. Create and treat risks there, then link the relevant entries. Evidence should support the factual inputs, consultation, controls, and decision.

Recommended method

1. Confirm the assessment subject and why the trigger applies.
2. Describe purpose, scope, data, subjects, recipients, technology, volume, geography, and lifecycle.
3. Evaluate necessity, proportionality, alternatives, transparency, rights, and foreseeable harms.
4. Identify risks and link them to assets, vendors, controls, and findings as appropriate.
5. Define mitigations and evaluate residual risk after those measures.
6. Link evidence and record consultation/approval outside the tool where your governance requires it.
7. Complete the assessment only when the outcome and follow-up responsibility are clear.

Reassess on material change; a completed assessment is not permanent permission for processing to drift.