Creating a Custom Assessment Template

DataGrail's Template Editor allows you create custom risk assessment templates to meet your organization's use case, whether that is evaluating new tools or conducting DPIAs on high risk processing activities.

The Template Editor allows you to build custom Risk Assessment Templates with the following functionality:

• Multiple Question Types: Choose from multiple question types, including multi-select, radios, drop-downs and more.
• Pre-filled Answers: Auto-populate fields from DataGrail's Intelligence Library or from existing system reports to streamline reporting.
• Nested Conditional Questions: Create workflow logic to show/hide nested questions based on answers to parent questions.

Getting Started

To get started, navigate to the Risk Assessments page and select the Templates tab. From here, you can create a new template for your use case.

When you have completed adding the relevant Sections, Questions, and Conditional Questions (Optional) to your template, select Save Template. The newly-created template will now be visible when you go to create a new Assessment.

Sections

Assessment Templates are driven by sections. A section is a collection of Questions that help provide an understanding to a particular aspect of your assessment.

As an example, the following sections are present in the standard DPIA Template:

• General Information
• Need for DPIA
• Consultation Process
• Data Processing Content
• Benefits of Processing
• Lawfulness & Fairness
• Privacy Rights & Expectations
• Protective Measures
• Special Topics
• Risks & Mitigations

When creating an Assessment Template, it is helpful to first outline your sections before adding questions.

Create your first section by selecting Add Section in the bottom-left corner of the page. Once your section is named, you can start to add Questions.

Questions

To populate your sections with questions, select Add Question from the center of the page.

DataGrail provides two different questions types to meet a broad variety of use cases: Basic Answer Types and Pre-filled Answer Types

Basic Answer Types

Basic Question Answer Types always require input from a contributor completing an Assessment.

Available Basic Answer Types include:

• Single Selection (Radio)
• Single Selection (Dropdown List)
• Multiple Selection (Checkboxes)
• Multiple Selection (Dropdown List)
• Date Picker
• Short Answer Text
• Long Answer Text

Pre-filled Answer Types

Pre-filled Answer Types automatically pre-fills questions with existing system metadata from the DataGrail Intelligence Library or from your own system inventory.

If you have completed a report on a system in your inventory, that data will pre-fill the assessment.

Available Pre-filled Answer Types include:

• Processing Country
• Data Subjects
• Data Subject Consent Origins
• Legal Bases
• Legal Roles
• Personal Data Categories
• Personal Data Origins
• Purposes of Processing
• Protective Measures

Conditional Questions

Collecting the right responses to a DPIA or Risk Assessment is a complex task. There's a balancing act between knowing when to ask for additional information and making the assessment as easy to complete as possible for business stakeholders.

Conditional Questions allow you to only expose certain questions based on the responses to other questions in the Assessment.

1. To get started with conditional questions, ensure there are at least two questions in the section, then select any existing question and select Add Rule.

2. Select the answer(s) to the question that you want to add a condition to. You can add multiple conditions to one question, so that multiple responses can trigger a corresponding action

3. To confirm and apply your changes, select Apply Rule.

When a rule has been added, the selected question with the rule assigned will show the label 1 Rule Added. The following question will show the label Conditional, as it will only be visible to the user if they select the answer targeted by the created rule.

You can add multiple rules to one question to build out more complex workflows as needed.