# Privacy Impact Assessments

Source: https://www.orthalon.com/it/docs/configure/privacy-impact-assessments

Enable the privacy pilot, assign review responsibilities, and build an evidence-linked assessment.

Privacy impact assessments are available on **Business and Enterprise** for organizations enrolled in the privacy pilot. Ask your Orthalon administrator to enable the workspace before you begin.

## Set up your privacy team

Open **Privacy impact assessments → Workspace settings**. An organization owner or administrator can enable source imports, choose evidence retention, enable approved exports, and assign responsibilities:

- **Privacy analyst:** drafts assessments and manages activities and risks.
- **DPO reviewer:** reviews the assessment, records an opinion, and records consultation dispositions.
- **Accountable approver:** approves the assessment after review.
- **Auditor:** reads assessments, evidence, and history.

Processing owners can draft the activities assigned to them. Keep separation of duties enabled so an author cannot approve their own assessment. Organization administration does not grant approval authority by itself.

## Create an assessment

Add a processing activity, describe its business purpose, select a jurisdiction, and assign an owner. Link the observed tools used in that activity only after confirming the grouping. Discovery alone cannot establish business purpose or lawful basis.

Refresh source evidence and complete screening. Orthalon shows source references, observation dates, confidence, expiry, and coverage. Imported evidence contains selected security metadata rather than prompts, matched personal values, or uploaded files. Internal assistant retrieval remains **Not observed** when the connected source does not establish it.

Complete the processing statements and assessment sections, then record inherent and residual risks. Assign mitigation owners and due dates. Link verified evidence before lowering a residual score. Explain evidence gaps rather than treating missing telemetry as proof that risk is absent.

The editor saves draft changes and checks the revision. If another reviewer changes the assessment, keep your local edits while deciding whether to reload the saved version.

## Review and export

Submit the assessment for review. A DPO reviewer records an opinion and any consultation disposition needed for high residual risk. An accountable approver then signs off. Screening supports human judgment; it does not determine legal compliance or replace jurisdiction-specific review.

Approved versions preserve their assessment, approval history, and evidence manifest. Authorized users can download signed JSON or PDF through a short-lived export grant. PDF includes the full signed JSON as an attachment; some characters in the visible text report use a standard-font fallback. Use JSON when exact Unicode text matters.

Changed policies, app restrictions, vendor facts, data categories, or expired evidence can enter **Changes to review**. Your administrator can test these in shadow mode before requiring reassessment. Acknowledging a change does not approve the assessment or replace its previous version.

Your deployment administrator must configure the additive database migration, organization pilot eligibility, assessment signing key, and scheduled reconciliation task. The implementation and testing guides in the repository describe those steps. Counsel review and pilot acceptance remain required before wider deployment.