Privacy management

Probo keeps privacy records connected to the same controls, measures, risks, vendors, and evidence used by the wider compliance program.

Data and processing activities

A data record describes information handled by the organization, including its sensitivity and business impact. A processing activity explains why and how data is processed, the parties involved, and the safeguards that apply.

Publish processing activities only after the purpose, scope, legal context, recipients, and retention assumptions have been reviewed. Update the record when the actual processing changes.

Impact assessments

• A Data Protection Impact Assessment (DPIA) evaluates processing that may create a high risk to individuals.
• A Transfer Impact Assessment (TIA) evaluates an international transfer and the legal and practical safeguards around it.

These assessments are first-class records rather than attachments. Link them to the relevant processing, data, vendors, risks, and measures so reviewers can follow the decision.

Rights requests

Rights requests track requests such as access or erasure through their operational lifecycle. Limit access to the people who need to process the request, avoid placing unnecessary personal data in free-text fields, and use tasks to coordinate work with accountable owners.

Probo organizes privacy work; it does not determine which law applies or replace legal advice.