Privacy settings

Privacy Settings at /privacy/settings supplies the context that the overview, RoPA exports, monitoring, and readiness checks evaluate against. Complete it before interpreting privacy metrics.

Organization and contact

Record the legal entity name, registered address, jurisdiction, privacy contact, and—where applicable—DPO and EU representative details. These fields appear in register/export context; verify the legal entity and contact authority rather than copying marketing information.

Set the default processing role to controller, processor, or joint controller. Individual RoPA activities can override the default. An inherited role is shown as such so reviewers know it was not decided uniquely for that record.

Regulation coverage and regions

Select the privacy regimes you intend Noru to assess and record the countries/regions of relevant data subjects. Regulation cards describe mapped obligations and signals such as sensitive data, sale/share opt-out, assessments, and Global Privacy Control.

Selection is an evaluation scope, not legal advice that the law applies. Determine applicability with counsel based on establishment, targeting, thresholds, roles, exemptions, and processing context.

Security measures (TOMs)

Build a catalog of technical and organizational measures, grouped by category. Each measure can include a description and map to a Noru control. Measures apply across processing records unless a record-specific relationship says otherwise.

Good measures are concrete and testable—for example, encryption at rest with named systems and key management—not merely “industry-standard security.” Map each measure to the control that governs it and confirm evidence exists in the Evidence Vault. Archiving a measure removes it from the active catalog; first review affected RoPA records and exports.

Setup order

1. Confirm organization and jurisdiction.
2. Name the responsible privacy contact and optional statutory roles.
3. Set the default activity role.
4. Select regulations and data-subject regions deliberately.
5. Create security measures and map them to controls.
6. Return to RoPA to resolve record-specific legal and operational facts.