Getting Started With Risk Assessments

DataGrail makes it easy to start creating Risk Assessments and collaborating with your team to better understand the privacy risk in your organization.

DataGrail User Roles

Only the following will have access to the Risk Assessments tab without being added as a Contributor to an assessment:

• Super Admin
• Risk Assessments Admin
• Assessment Creator

Users with only the Assessment Creator or Assessment Contributor role see a simplified view of DataGrail limited to their assessments, without the side navigation or other product areas.

Workflow

In the Risk Assessments tab of DataGrail, you will find:

• All previously created assessments and their associated: identifier, name, state, contributor assignee, personal data likelihood, percentage of completion, due date, renewal date, and the approving user
• The ability to create a new assessment
• The total count of all created assessments

All previously created assessments will be sorted in ascending order based on creation date, with the earliest assessment created displaying last on the list.

Downloading All Risk Assessments

Select Download CSV on the Risk Assessments page to download a CSV export of all Assessments created in DataGrail.

Creating New Assessments

To get started, select Create New Assessment and choose the Assessment Template that best aligns with the risk or activity being documented. There are a variety of prebuilt templates available by default for DPIAs, AI Risk Assessments, and more! DataGrail also allows you to create a Custom Assessment Template for more unique use cases.

After selecting a Template, you will be prompted to enter the following details:

• Assessment Name
• System(s)
• Processing Activity (optional)
• Due Date (optional)
• Renewal Cycle

With the Assessment created, you can start to Add Contributors, who can help populate it.

Assessment Identifiers

Each assessment is automatically assigned a unique identifier in the format RA-N (e.g., RA-1, RA-2, RA-3). This identifier appears below the assessment name in the table, overview, and form views.

Assessment identifiers serve as a stable, human-readable reference for your assessments. They are especially useful for disambiguating between assessments that share similar or identical names (e.g., multiple annual DPIAs for the same system). You can use them to:

• Quickly reference a specific assessment in conversations or audit trails
• Navigate directly to an assessment using the identifier in the URL (e.g., /risk/assessments/RA-42-...)
• Search for assessments by identifier in the table filter

Identifier Permanence

Identifiers are permanent and never change, even if the assessment is renamed or versioned. Each new version of an assessment receives its own unique identifier.

Adding Contributors

A Contributor is someone who has information on the relevant system that will help populate the Assessment. Contributors can be internal to your business, like a system owner, or external to your business, such as a contact for the vendor.

To add a Contributor, select Add New Contributor from your newly-created Assessment, then choose one of the following options.

Contributor: Adds an existing DataGrail user to the assessment. Enter the user's email address — if it matches an active user on your account, they're granted the Assessment Contributor role (if they don't already have assessment access) and can view and fill in the assessment by logging into DataGrail directly. If the email doesn't match an existing user, you're prompted to send an External Contributor invite instead.

External Contributor: Sends an email to the invitee with a link to view and edit the assessment, along with an optional message from the user who sent the invite. External Contributors don't need a DataGrail account and access the assessment through the emailed link.

Valid Assessment States

A Contributor can only be added to an Assessment in the Not Started or In Progress state.

Existing Contributors (who have not completed the Assessment) can be removed, or, for External Contributors, resent the invitation, by selecting the ellipsis on the far right.

Comments

Comments let you and your contributors discuss specific questions and sections without leaving the assessment. Select the Comment button on any question or section to open the comment panel, then add your comment, reply to an existing one, or @-mention a user or contributor to bring them into the conversation.

Comment Notifications

When someone interacts with a comment, DataGrail sends an email to the relevant person so they can respond without checking the assessment manually. Each email links directly to the comment.

The following interactions trigger an email:

Interaction	Who Is Notified
Reply	The author of the comment being replied to
@-mention	The user or contributor who was mentioned
New comment	The assessment owner

Both DataGrail users and external contributors receive these emails. When a contributor selects the link in their email, they are taken straight to the comment — no separate login is required. For security, each link is valid for 7 days, and links stop working as soon as a contributor is removed from the assessment.

Turning Off Comment Emails

DataGrail users can turn comment emails on or off using the Assessment Emails setting in the Notifications section of the Settings page. Contributors always receive comment emails.

Assignments

Assignments let you delegate an individual question or section to the person best positioned to answer it. Select the Assign button on any question or section to open the assignment panel, then choose the user or contributor you want to assign. The same item can be assigned to more than one person, each as a separate assignment.

You can assign an item to any user or contributor on the assessment. Once an assignment exists, the question or section displays an assignment count so everyone can see what has been delegated and to whom.

Assignment Statuses

Each assignment carries a status that reflects where it stands:

Status	Meaning
Open	The assignment is active and awaiting completion
Resolved	The assignee has marked the assignment complete
Cancelled	The assignment was withdrawn and no longer needs to be completed

The assignee — whether a user or a contributor — can select Resolve to mark their assignment complete, and Unresolve to reopen it. The user who created the assignment, along with Risk Assessments Admin users, can Cancel an assignment at any time.

Assignment Notifications

DataGrail sends an email for each assignment event so the relevant person is notified without checking the assessment manually. Each email links directly to the assigned question or section.

The following events trigger an email:

Event	Who Is Notified
Assignment created	The person assigned to the item
Assignment resolved	The user who created the assignment
Assignment cancelled	The person who was assigned to the item

Both DataGrail users and external contributors receive these emails. When a contributor selects the link in their email, they are taken straight to the assignment — no separate login is required.

Turning Off Assignment Emails

DataGrail users can turn assignment emails on or off using the Assessment Emails setting in the Notifications section of the Settings page. Contributors always receive assignment emails.

Assessment Context

After creating an assessment, you can provide additional context and supporting documentation to help Vera generate more accurate suggestions when auto-filling assessment responses. The Assessment Context panel is on the Overview tab of any assessment.

Additional Context

The Additional Context field is a free-text area where you can describe priorities, constraints, or other relevant details specific to the assessment. For example, you might note that the system primarily handles cross-border data transfers or processes children's data.

1. Open the assessment and select the Overview tab.
2. Enter your context in the Additional Context text field.
3. Your input auto-saves as you type — no need to manually save.

Supporting Documentation

You can upload documents such as PRDs, functional requirements, privacy notices, or terms of service for Vera to reference when generating suggestions.

1. In the Supporting Documentation section, select Choose a File or drag and drop files onto the upload area.
2. Wait for each document to finish processing — uploaded files go through a virus scan and vectorization step before Vera can use them. Status indicators display next to each document.
3. Optionally, select Select an Assessment to link a previously approved assessment as a reference. Vera uses linked assessments as additional context when suggesting answers.

Supported file types: pdf, docx, xls, xlsx, txt, csv, tsv, md, json, xml, yaml, and yml. Maximum file size is 10 MB per file.

Provide Context Early

Add your context and documentation before starting the assessment or running Vera's auto-fill. Vera draws on all available context — including uploaded documents, linked assessments, and your additional context — to generate its suggestions.

Change History

The Change History panel tracks every modification made to an assessment, providing a complete audit trail of who changed what and when. This feature is visible on the Overview tab and records activity from both DataGrail users and contributors.

Tracked events include:

Category	Events
Questions	Answer added, edited, or cleared
Contributors	Contributor added, removed, or name changed
Documents	Document uploaded or deleted
AI Suggestions	Suggestion generated or accepted
Status Changes	Assessment status transitions
Metadata	Name, due date, or additional context changed
Risks	Risk added from an assessment question

Each entry displays the actor's name (or "API Submission" for programmatic changes), the action taken, and a timestamp. Recent activity (within 24 hours) shows relative times like "2 hours ago," while older entries display the full date and time.

Select any entry to expand it and view details such as before/after values for edits, affected question numbers, or document filenames.

Filtering and Export

Use the Filter dropdown to narrow the history by category (Questions, Contributors, Documents, etc.). When viewing question changes, you can further filter by specific question number (e.g., Q1.1, Q2.3). Select Export CSV to download the filtered history — useful for audit documentation or sharing activity summaries with stakeholders.

Completing Assessments

To complete an Assessment, you must review and populate all required fields in each Assessment section.

You can move back and forth between sections by:

1. Utilizing the Back and Next buttons respectively
2. Selecting the desired section directly on the left-hand menu

The currently selected section will always be highlighted in the left-hand menu.

Submitting Assessments

When an invited Contributor has completed filling in the Assessment, they are able to submit it. Selecting Submit prompts a confirmation to the user with:

• A notice about the implications of submitting the Assessment.
• A field to add an (optional) message to the Assessment Owner.
• Buttons to both Cancel and Submit Assessment.

Submitting an Assessment does not mean it is complete. This action will update the Contributor Status in the UI and only indicates that the Contributor has completed their review and contribution.

Risk Assessments Notifications

Email notifications for Risk Assessments — including comment notifications — can be toggled on/off for each DataGrail user in the Notifications section of the Settings page.

Approving Assessments

When all Contributors have completed their review, it is time for the Assessment Owner to approve the Assessment.

This action is only available to Super Admin and Risk Assessments Admin roles, and is available through the Approve Assessment button in the bottom left corner when viewing the Assessment.

Once the Assessment is approved, a PDF version is available to download directly within the app. This can be done by selecting the Download PDF option.

Approved Assessments Cannot Be Modified

Once an Assessment has been approved, its sections cannot be modified and Contributors cannot be added or removed. If you would like to assess the given system again, you can select Create New Version which will create a new Assessment.

Assessment Statuses

Assessments can be in one of four statuses, which each provide a percentage of completion:

• Not Started: No changes have been made to the Assessment.
• In Progress An Assessment is transitioned to this state, if one of the following is true:
  1. Edits have been saved to this Assessment by the editing user.
  2. The invited Contributor on the Assessment was removed from the assessment by an Admin.
  3. The invited Contributor on the Assessment completed the assessment and submitted it.
• Pending Approval: The invited Contributor(s) have completed the Assessment and submitted it for Approval.
• Approved: A Super Admin or Risk Assessments Admin have approved the Assessment.