Connect risks to an impact assessment

Steps

Article 35(7) asks an assessment to state the risks to the rights and freedoms of data subjects and the measures adopted to address them. In Prudence those risks are records, not prose, so the assessment and the register cannot disagree.

1. 01Open the assessment on the activityOpen the processing activity and click its Assessment tab. The assessment belongs to the activity, so it is continued from there rather than as a standalone record.
2. 02Bring in the risks that existOn the Risks step, click Link an existing risk and choose the risks already raised against the activity, its systems or its data subject sets, rather than describing them again. Already applies to shows what the assessment holds.
3. 03Raise what the assessment revealsWhere the assessment surfaces a risk that was not on the register, click Create a new one instead on the same step. It is a full risk record, so it can be treated and reviewed after the assessment concludes.
4. 04Show the measuresOpen each linked risk; its Assessment tab already carries its treatment and its measures, which is what the assessment reports as the measures adopted. Nothing is retyped.
5. 05Conclude with a reasoned opinionOn the Assessment tab of the document, set Likely to result in high risk to rights and freedoms and give Reasons for that conclusion. Where a high risk to data subjects remains after treatment, record that prior consultation under Article 36 applies.
6. 06Freeze the versionSelect Approved on the lifecycle bar and click Record as approved. This holds a version with the risks and ratings as they stood; later changes to a risk do not rewrite what was decided.

Where a judgement can reasonably go either way

Risks can be raised first and gathered by the assessment, or raised as the assessment proceeds. Both are supported. Raising them first suits an organisation with an existing risk process; raising them during the assessment suits a new activity where the assessment is the first structured look at it.