Question 1

Can the Processing Activity Import Assessment be amended?

Accepted Answer

Yes, by duplicating the DPOrganizer template you create your own template that will be open as a draft. Important: Do not remove any of the “smart questions” since they are needed to be able to import the responses later on in to your RoPA. Smart questions are all question types in the list except the first three (Multiple choice, Checkboxes, Free text)

Question 2

Common SSO login issues!

Accepted Answer

The user has another email domain than the rest of the users. If so, please ask your customer success manager at DPOrganizer to add the new domain(s) in the setup. You might have a strict SSO setup that requires a two-step access granting. Please check with the person responsible for your SSO solution internally to also grant access for the new user via your SSO solution, as it might not be enough that they have been added as a user in the DPOrganizer via the app.  To adjust or check your SSO setup in DPOrganizer, Go to Setup in the menu to the left, and in the submenu that pops up, go to Single Sign-on.

Question 3

I am trying to register a new entity (DSC, DP, System), but I cannot find an “Add” button?

Accepted Answer

New Data Subject Categories or Data Processors (or any other entity, such as systems and Data Storages) are added as a connected entity through your Processing Activities. Go into a relevant Processing Activity (Action > Edit) and add a new connected entity there. After the entity is added once, you can connect it to more processing activities as well, if e.g. the Data Processor is part of multiple activities.

Question 4

Who is the Owner of a System/Data storage/Data Access Point?

Accepted Answer

You can choose a Data Controller or a Data Processor as the owner of an IT-asset. The ownership is about who is in technical control of the system. In general, one could assume that all cloud solutions from an external party are “owned” by the external party (a specific data processor).   If you run a system in your own data centre, then one of your data controllers would be the owner. Some solutions delivered from an external party are installed and run in a company's own IT environment. In such cases, one of your data controllers would be the owner.  If you set a Data Processor as owner, the Data Subject Categories that can be processed are limited to those that are specified / defined for that specific Data Processor.  If you decide to change who is the owner at some point, what you have mapped out for that asset is also reset, and you have to start from the beginning with which data subject categories are processed.

Question 5

How can the Department field be used effectively?

Accepted Answer

The department field is not only useful for indicating which department is responsible for a processing activity but can also serve as a powerful filtering tool. It can be used for other segmentation purposes, such as filtering by country/region, service, or data controller (e.g., a specific company within a group). This is especially helpful when assigning access rights to other users in your account, as it allows you to grant permissions not just by department but also based on other segments of your choice. You can assign multiple "departments" to a single processing activity, making access control more flexible. For example:  Processing activity: Recruitment Department(s): HR, United Kingdom  This makes it easier to navigate and manage activities based on different organizational structures.

Question 6

What is “?” in DPOrganizer?

Accepted Answer

This is our guidance & Support feature, where you find explanations of features and various privacy concepts found in DPOrganizer, as well as a knowledge base with more in-depth information and how-tos. You are also able to submit a support ticket if you can’t find the information you’re looking for. The information in the panel will adjust to where you are working in the tool when you open up the Guidance & Support panel. You’ll find the Guidance & Support feature in the top right corner of the application.

Question 7

What is the difference between Systems, Data storages and Data access points?

Accepted Answer

Your IT-Assets documents how personal data is stored, accessed and transferred in Systems, Data Storages, Data Access Points and Data Flows. The differences between these entities are:  Systems refers to an information asset which in different ways is used to process personal data. The entity can be regarded as a mix of both Data Storages and Data Access Points. Data Storage refers to where personal data is physically and geographically stored.  Examples of assets to include can be a server or an archive at your office. Data Access Points refers to an access point/application through which personal data is available but does not store the data, e.g. a portal that links to different Data Storages.  We recommend using Systems as the go-to asset. Data flows allow you to map how two assets are connected to each other.

Question 8

What is the difference between User management and Contact details

Accepted Answer

Under user management new users are added to have access to the tool. Under Contact details you add contact cards for internal comunication to identify who or what department is responsible for what Processing Activty or Entity

Question 9

What is the difference between ‘Person responsible’ and ‘Contact person’?

Accepted Answer

Person Responsible is an internal person at your company that is responsible for a specific Data Subject Category, Data Processor, Other Recipient, System etc. Contact Person is an external person (e.g. your main point of contact) at a Data Processor or Other Recipient company. Appoint them in your mapping if possible.

Question 10

What is the difference between location of Data Subject Categories and location of processing for Processor or System?

Accepted Answer

The location you add for a Data subject category indicates the geographical location where the subjects are located. Location of processing, on the other hand, refers to the location (of the data centre) where the data is processed/stored by a Data Processor or System / Data Storage / Data Access Point.

Question 11

How do I add additional users in my DPOrganizer account?

Accepted Answer

To add additional users to your DPOrganizer account, as an Admin or Officer, click on Setup in the menu on the left-hand side of your account and then go to User management in the Setup submenu. When setting up a new user profile, you can choose what type of access the user should have. If you choose to set the access as User or Limited user, you can specify whether the person only should have access to a certain department (only if you have the feature Processing Activity available) or data subject category, as well as if they should be restricted in what they can see and/or be able to do in your DPOrganizer account.

Question 12

How do I assess the risk level of my personal data types?

Accepted Answer

To assess the risk of your personal data types, you click on Add/Edit personal data types. In the drop-down of Risk Level you can choose to set the Risk Level as Low, High and Very High. The Risk Level is associated with the risk of a certain personal data type to get into the hands of non-authorized people. According to Article 9 of the GDPR, there are some personal data which are regarded as Special Categories and require extra safeguards in regard to their processing. These personal data types are data revealing: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (uniquely identifying a natural person), health data, sexual orientation or concerning a natural person’s sex life. We recommend marking these Special Categories of Personal Data as ‘Very High’ risk. Other personal data types such as financial data are not considered to be Special Categories. However, due to their sensitive nature, you may still want to process them extra carefully. One way to do that is to mark them as ‘High’ risk.

Question 13

How do I edit an activated Assessment template?

Accepted Answer

An already activated cannot be edited, but it can be duplicated and then edited. To do so, you go into Assessments > Manage Templates > Own templates; and for the template in question, you click on Action > Duplicate. This will generate a copy of the existing template and in the copy you can now edit.

Question 14

How do I add additional request types/options into the DSR portal?

Accepted Answer

To add a new request type, navigate to the Data Subject Request Module and in the submenu, select Data Subject Requests (note: do not select the Portal option). Click on + New Data Subject Request to open the creation form. Under Type of request(s), click on the dropdown menu, and select Add new type of request. Enter your new request types one at a time and save your changes. If you are using the portal feature, make sure the new request types are now available there. Ensure that your current portal setup shows the newly added types correctly. And that’s it! Your new request types should now be available in the system. Will the new request types automatically show in the portal? If you’re using the portal feature, the new request types will also appear there. Be sure to check that the portal reflects these updates after you’ve added them.

Question 15

How do I duplicate a Processing Activity?

Accepted Answer

At the moment, DPOrganizer does not have a built-in feature to copy or duplicate a processing activity directly. However, there are a couple of workarounds that can help you speed up the process depending on how you've mapped these activities. This guide provides step-by-step instructions on two available methods for handling this task. Method 1: Re-importing an Assessment If you originally imported the processing activities via an Assessment, you can re-import the same form and make adjustments before finalizing the new import. Steps:  Locate the Assessment: Go to the Assessments module switch to the ‘Approved’ tab Re-import the Assessment: Select the form you want to re-import. Make Adjustments: Before importing again, make necessary changes, such as renaming the activity (mandatory) and potentially adjusting minor details. Import: Proceed with the import as you normally would.  Method 2: Using the Data Extract and Re-import A more detailed method involves downloading the Processing Activities through a Data Extract, modifying it in Excel, and then re-importing the adjusted data. Steps:  Download the RoPA Data:  Navigate to the Reporting section. Select Data Extract and choose Processing Activities (Excel) from the dropdown menu. Download the file.   Modify the Excel File:  Open the downloaded Excel file. Remove any rows that you don’t want to re-import. Make necessary adjustments, such as renaming the activities or modifying the data.   Prepare for Import:  Go to Setup > Data Import > Start Importing > RoPA Import. Follow the link provided for a detailed guide and example sheet to ensure your data is formatted correctly for re-importing.   Re-import the Adjusted Data:  Upload the updated file, ensuring that the format matches the required structure. If the formatting is incorrect, the import will fail, so double-check your changes before uploading.    This method is more time-consuming and requires precision, but it allows for extensive modifications to the processing activities.

Question 16

How do I download a DPIA or Assessment?

Accepted Answer

The method to download depends on the module you are using. Follow the instructions below based on your situation: Via the Assessments Module:  For Approved Assessments: Navigate to Assessments in the left menu. Select Manage Assessments from the submenu. Go to the Approved tab. Find the relevant assessment and click Details. Scroll down, click Action (blue button), and choose View. In the Full Assessment tab, click the Print button at the top-left, then select Download as PDF or Save as PDF.   For Pending Assessments (Inbox): Go to Assessments > Manage Assessments > Inbox. Select the relevant assessment and click Details & Evaluate. Scroll down, choose the correct response, click Action, and select Evaluate. View the full DPIA, then right-click on the page, select Print, and choose Download as PDF or Save as PDF.  Via the DPIA Module:  Navigate to the DPIA module in the left menu. Open the relevant DPIA from the list. On the summary page, click the Print button at the top and select Save as PDF.  Alternative: Export Data to CSV/Excel:  Go to Reporting & Visualization > Report. Select the Data Extract tab. Choose DPIA or Assessments from the Feature dropdown, then download the data in CSV or Excel format.

Question 17

What do Other Recipients refer to?

Accepted Answer

Other Recipients determine their own means and purposes for the processing of the personal data that you share with them, and thus act as Data Controllers towards this data. In other words, Other Recipients are organizations that you share personal data with that do not fulfil the conditions of being Data Processors for this processing. For Data Processors, you have a DPA in place. For Other Recipients, you do not — instead a Data Sharing/Transfer Agreement may be used.

Question 18

Abbreviations

Accepted Answer

DC > Data Controller DP > Data Processor DSC > Data Subject Category DSR > Data Subject Request OR > Other Recipient PA > Processing Activity PDT > Personal Data Type

Question 19

Terminology

Accepted Answer

Entity > Any ingoing party or asset in a Processing Activity (not a legal entity) Legal Entity > Company (Data controller)

DPOrganizerFrequently asked questions