Privacy, Compliance & Data Ethics Risk Assessment

{ "Title": "Privacy, Compliance & Data Ethics Risk Assessment", "IntroductionHtml": "

This short assessment helps teams identify privacy and compliance risks, ethical concerns, and practical mitigation steps before analytics or model work begins. Complete each field to create a documented record that can be reviewed by data owners, privacy officers, or governance teams.

", "SubmitLabel": "Save Assessment", "SuccessMessage": "Assessment saved. Review recommended mitigation steps and assign owners for follow-up.", "DataType": "PrivacyRiskAssessment", "SchemaVersion": "1.0", "Fields": [ { "Key": "projectName", "FieldType": "text", "Label": "Project / Dataset Name", "HelpText": "Name or identifier for the analytics project or dataset.", "Required": true }, { "Key": "assessorName", "FieldType": "text", "Label": "Assessor Name", "HelpText": "Who completed this assessment.", "Required": true }, { "Key": "assessmentDate", "FieldType": "text", "Label": "Assessment Date", "HelpText": "YYYY-MM-DD or another date format.", "Required": true }, { "Key": "datasetDescription", "FieldType": "textarea", "Label": "Dataset Description", "HelpText": "Brief description of the data, sources, and intended analytic use.", "Required": true }, { "Key": "dataSensitivity", "FieldType": "select", "Label": "Data Sensitivity Classification", "HelpText": "Choose the closest classification for the dataset.", "Required": true, "Options": [ {"Value": "public", "Label": "Public (no restrictions)"}, {"Value": "internal", "Label": "Internal (business use only)"}, {"Value": "confidential", "Label": "Confidential (sensitive personal or business data)"}, {"Value": "restricted", "Label": "Restricted (personal identifiers, PHI, financial)"}, {"Value": "highly_restricted", "Label": "Highly restricted (regulated or national-security data)"} ] }, { "Key": "containsPI_PHI", "FieldType": "yesno", "Label": "Contains Personal Identifiable Information (PI) or Protected Health Information (PHI)?", "HelpText": "Select Yes if the dataset includes direct or indirect personal identifiers.", "Required": true }, { "Key": "pi_phi_types", "FieldType": "checkbox", "Label": "Types of PI/PHI present (check all that apply)", "HelpText": "Select known categories.", "Options": [ {"Value": "identifiers", "Label": "Direct identifiers (name, SSN, email)"}, {"Value": "health", "Label": "Health or clinical data (PHI)"}, {"Value": "financial", "Label": "Financial data (bank account, credit card)"}, {"Value": "biometric", "Label": "Biometric data (fingerprints, face ID)"}, {"Value": "location", "Label": "Precise location data"}, {"Value": "other", "Label": "Other"} ] }, { "Key": "applicableRegulations", "FieldType": "checkbox", "Label": "Applicable laws / regulations", "HelpText": "Select regulations that may apply to this data or project.", "Options": [ {"Value": "gdpr", "Label": "GDPR / EU privacy laws"}, {"Value": "ccpa", "Label": "CCPA / California privacy laws"}, {"Value": "hipaa", "Label": "HIPAA / US health privacy"}, {"Value": "pippeda", "Label": "PIPEDA / Canada"}, {"Value": "other", "Label": "Other / local laws"}, {"Value": "none", "Label": "None / unknown"} ] }, { "Key": "consentRecorded", "FieldType": "yesno", "Label": "Was explicit consent collected for the intended use?", "HelpText": "If consent exists, it should be documented and scoped to the analytic use.", "Required": true }, { "Key": "consentDetails", "FieldType": "textarea", "Label": "Consent & Data Use Details", "HelpText": "Describe consent wording, opt-out mechanisms, and permitted uses. If no consent, explain legal basis for processing.", "Required": false }, { "Key": "retentionPolicyExists", "FieldType": "yesno", "Label": "Is there a documented retention policy for this data?", "HelpText": "Retention and deletion schedules limit long-term risk.", "Required": true }, { "Key": "retentionPeriodMonths", "FieldType": "number", "Label": "Retention period (months)", "HelpText": "If known, provide retention duration in months.", "Required": false }, { "Key": "reidentificationRisk", "FieldType": "scale", "Label": "Re-identification risk (1 = very low, 5 = very high)", "HelpText": "Estimate the risk that individuals could be re-identified from this dataset or combined outputs.", "Required": true, "ScaleMin": 1, "ScaleMax": 5 }, { "Key": "pseudonymizationApplied", "FieldType": "yesno", "Label": "Has data been pseudonymized or tokenized?", "HelpText": "Pseudonymization reduces direct identifier use but may not eliminate re-identification risk.", "Required": true }, { "Key": "pseudonymizationTechnique", "FieldType": "textarea", "Label": "Pseudonymization / Anonymization Techniques used", "HelpText": "Describe methods (hashing, tokenization, suppression, generalization, differential privacy, synthetic data, etc.).", "Required": false }, { "Key": "syntheticDataSuitable", "FieldType": "yesno", "Label": "Is synthetic data suitable as an alternative for this project?", "HelpText": "Consider model accuracy, fairness, and verification needs when deciding on synthetic data.", "Required": true }, { "Key": "dataSharingDestinations", "FieldType": "checkbox", "Label": "Data sharing or transfer destinations", "HelpText": "Where will data or model outputs be shared?", "Options": [ {"Value": "internal", "Label": "Internal teams only"}, {"Value": "third_party", "Label": "Third-party vendors or contractors"}, {"Value": "cloud", "Label": "Cloud service providers"}, {"Value": "research", "Label": "Academic or research partners"}, {"Value": "public", "Label": "Public release / open data"} ] }, { "Key": "mitigationControls", "FieldType": "textarea", "Label": "Recommended mitigation controls", "HelpText": "List technical, organizational, legal, and monitoring controls to reduce identified risks (examples: access controls, encryption, data minimization, DPIA, contractual clauses).", "Required": true }, { "Key": "riskRating", "FieldType": "select", "Label": "Overall risk rating", "HelpText": "Determine an overall risk level combining sensitivity, legal exposure, re-identification risk, and sharing.", "Required": true, "Options": [ {"Value": "low", "Label": "Low"}, {"Value": "moderate", "Label": "Moderate"}, {"Value": "high", "Label": "High"}, {"Value": "critical", "Label": "Critical"} ] }, { "Key": "recommendedAction", "FieldType": "select", "Label": "Recommended next action", "HelpText": "Suggested governance step after assessment.", "Required": true, "Options": [ {"Value": "approve", "Label": "Approve project"}, {"Value": "approve_conditions", "Label": "Approve with conditions (list controls below)"}, {"Value": "hold_review", "Label": "Hold and perform further review / DPIA"}, {"Value": "reject", "Label": "Do not proceed"} ] }, { "Key": "ownersAssigned", "FieldType": "text", "Label": "Assigned owners / contacts", "HelpText": "Data owner, privacy officer, or project lead responsible for implementing controls.", "Required": true }, { "Key": "additionalNotes", "FieldType": "textarea", "Label": "Additional notes or observations", "HelpText": "Any other context, stakeholder concerns, or follow-ups required.", "Required": false } ] }