# Privacy & compliance

> Re-scan your software inventory, run impact assessments, track data processing agreements and read your ROPA register.

- URL: https://nextit.tech/docs/privacy-and-compliance/
- Language: English
- Other language: https://nextit.tech/fr/docs/confidentialite-et-conformite/
- Publisher: NextIT (https://nextit.tech/)

---

# Privacy & compliance

Re-scan your software inventory, run impact assessments, track data processing agreements and read your ROPA register.

## What this module is for

Privacy & Compliance shows which of your software tools need privacy work, and what to do next. It has four areas: `Overview`, `Assessments`, `Agreements (DPA)` and `ROPA register`. Three terms appear on these pages:

-   An impact assessment, called EFVP in French and DPIA in English, reviews the privacy risks of a project or a software tool.
-   A data processing agreement (DPA) is a written contract that sets how a vendor handles personal information for you.
-   A record of processing activities (ROPA) is a register of each activity in which your company uses personal information.

Auditors have a read-only view of every area.

## Before you start

-   Add your software tools to the Software `Inventory` page. This module reads that list.
-   Complete the `Compliance` tab of each software item, including its data type, personal information, data location and cross-border transfer.
-   Open the `Privacy & Compliance` panel from the Software, Domains or Compliance page. The panel links to the four areas.

## Overview

The `Overview` page shows where your company stands.

-   Select `Re-scan inventory` to run the privacy checks again on your software list.
-   Read the compliance score and the DPA coverage.
-   Check `Posture by area`: `DPA coverage`, `ROPA completeness` and `Assessments resolved`.
-   Review `Upcoming reviews & expiries` for items that need attention soon.
-   Work through `Suggested updates`. For each one, confirm it, snooze it until a date you choose, or dismiss it.

## Impact assessments (EFVP / DPIA)

Law 25 requires an impact assessment before you send personal information outside Québec. It also requires one for a project that acquires, develops or overhauls an information system or an electronic service that involves personal information.

**Good to know:** This page describes the product, not the law, and it is not legal advice. Ask your privacy officer or a lawyer whether an assessment is needed.

The `Assessments` list shows each software tool that needs one.

1.  1

    Open the Assessments list

    Open the `Privacy & Compliance` panel and choose `Assessments`.

2.  2

    Start or resume the assessment

    Select `Start` for a tool with no assessment. Select `Resume` for a tool with a saved draft.

3.  3

    Answer the questions

    Open the `Privacy` tab of the software item, answer the questions and select `Save assessment` to keep your draft.

4.  4

    Preview the score

    Preview the score to see the result before you complete the assessment.

5.  5

    Complete the assessment

    Complete the assessment when every answer is final.

## Agreements (DPA)

The `Agreements (DPA)` page shows one status for each agreement: `Missing`, `Requested`, `Signed` or `Expiring`.

-   Select `Bulk request DPAs` to send one request to the vendor of each software tool whose agreement is `Missing` or `Expiring`.
-   Open a software item to record a signed agreement, then upload the signed document.

## ROPA register

The `ROPA register` has one row for each software tool that processes personal information. NextIT builds each row from the privacy profile of that tool.

-   The register is read-only. You cannot change a row in the register itself.
-   Select a row to complete the privacy profile of that tool.
-   The register has no export option.

## What you see

Privacy & Compliance Four areas

Overview Score, posture by area, reviews, suggested updates

Assessments Impact assessments (EFVP / DPIA)

Agreements (DPA) Missing, Requested, Signed, Expiring

ROPA register One row for each software tool that processes personal information

## Common tasks

-   Select `Re-scan inventory` after you add or change a software tool.
-   Start an assessment by choosing `Assessments`, then selecting `Start` next to the tool.
-   Request missing agreements by selecting `Bulk request DPAs`.
-   Complete a ROPA row by selecting it in the `ROPA register`.
-   Confirm, snooze or dismiss each item in `Suggested updates`.

## Tips

-   Check `Upcoming reviews & expiries` each month, so no agreement expires without action.
-   Add a tool to the inventory before you read the `ROPA register`. A tool that is not in the inventory does not appear there.
-   If an AI assistant is connected, you can ask it to generate privacy suggestions.

## Related

-   [Software & cost](https://nextit.tech/docs/software-cost/)
-   [Vendor management](https://nextit.tech/docs/vendor-management/)
-   [Privacy policy generator](https://nextit.tech/docs/privacy-policy-generator/)
-   [Data-subject requests](https://nextit.tech/docs/data-subject-requests/)

  Free posture report

### Is your business exposed? Find out in 5 minutes.

Enter your domain. Confirm ownership by email, then get your free security posture & compliance report.

[Book a strategic meeting](https://nextit.tech/book-a-demo/)

-   No card required
-   Hosted in Canada