Privacy & compliance

What this module is for

Privacy & Compliance shows which of your software tools need privacy work, and what to do next. It has four areas: Overview, Assessments, Agreements (DPA) and ROPA register. Three terms appear on these pages:

• An impact assessment, called EFVP in French and DPIA in English, reviews the privacy risks of a project or a software tool.
• A data processing agreement (DPA) is a written contract that sets how a vendor handles personal information for you.
• A record of processing activities (ROPA) is a register of each activity in which your company uses personal information.

Auditors have a read-only view of every area.

Before you start

• Add your software tools to the Software Inventory page. This module reads that list.
• Complete the Compliance tab of each software item, including its data type, personal information, data location and cross-border transfer.
• Open the Privacy & Compliance panel from the Software, Domains or Compliance page. The panel links to the four areas.

Overview

The Overview page shows where your company stands.

• Select Re-scan inventory to run the privacy checks again on your software list.
• Read the compliance score and the DPA coverage.
• Check Posture by area: DPA coverage, ROPA completeness and Assessments resolved.
• Review Upcoming reviews & expiries for items that need attention soon.
• Work through Suggested updates. For each one, confirm it, snooze it until a date you choose, or dismiss it.

Impact assessments (EFVP / DPIA)

Law 25 requires an impact assessment before you send personal information outside Québec. It also requires one for a project that acquires, develops or overhauls an information system or an electronic service that involves personal information.

The Assessments list shows each software tool that needs one.

1. 1
   Open the Assessments list

   Open the Privacy & Compliance panel and choose Assessments.

2. 2
   Start or resume the assessment

   Select Start for a tool with no assessment. Select Resume for a tool with a saved draft.

3. 3
   Answer the questions

   Open the Privacy tab of the software item, answer the questions and select Save assessment to keep your draft.

4. 4
   Preview the score

   Preview the score to see the result before you complete the assessment.

5. 5
   Complete the assessment

   Complete the assessment when every answer is final.

Agreements (DPA)

The Agreements (DPA) page shows one status for each agreement: Missing, Requested, Signed or Expiring.

• Select Bulk request DPAs to send one request to the vendor of each software tool whose agreement is Missing or Expiring.
• Open a software item to record a signed agreement, then upload the signed document.

ROPA register

The ROPA register has one row for each software tool that processes personal information. NextIT builds each row from the privacy profile of that tool.

• The register is read-only. You cannot change a row in the register itself.
• Select a row to complete the privacy profile of that tool.
• The register has no export option.

What you see

Common tasks

• Select Re-scan inventory after you add or change a software tool.
• Start an assessment by choosing Assessments, then selecting Start next to the tool.
• Request missing agreements by selecting Bulk request DPAs.
• Complete a ROPA row by selecting it in the ROPA register.
• Confirm, snooze or dismiss each item in Suggested updates.

Tips

• Check Upcoming reviews & expiries each month, so no agreement expires without action.
• Add a tool to the inventory before you read the ROPA register. A tool that is not in the inventory does not appear there.
• If an AI assistant is connected, you can ask it to generate privacy suggestions.

Related

• Software & cost
• Vendor management
• Privacy policy generator
• Data-subject requests