Data Ethics & Privacy Assessment — Interactive Assessment

{ "Title": "Data Ethics & Privacy Assessment", "IntroductionHtml": "

This assessment helps teams surface privacy, compliance, and ethical risks before analyses or models are built. Complete the fields below for each project or dataset. Saved responses create an auditable record and help prioritize mitigations.

", "SubmitLabel": "Save Assessment", "SuccessMessage": "Assessment saved. Consider assigning mitigations and scheduling a follow-up review.", "DataType": "privacy_ethics_assessment", "SchemaVersion": "1.0", "Fields": [ { "Key": "project_name", "Type": "text", "Label": "Project or Dataset Name", "HelpText": "Short name to identify this initiative.", "Required": true }, { "Key": "project_owner", "Type": "text", "Label": "Project Owner (person/team)", "HelpText": "Who is accountable for the project? Include team or role.", "Required": true }, { "Key": "assessment_date", "Type": "text", "Label": "Date of Assessment", "HelpText": "Use YYYY-MM-DD or your local date format.", "Required": true }, { "Key": "dataset_reference", "Type": "text", "Label": "Dataset Reference / Location", "HelpText": "Where the raw data lives (table, bucket, catalog ID).", "Required": false }, { "Key": "business_purpose", "Type": "textarea", "Label": "Purpose of Use", "HelpText": "Describe the analytic or model use case and the business question it answers.", "Required": true }, { "Key": "data_classification", "Type": "select", "Label": "Data Classification (choose the best fit)", "HelpText": "Identify the most sensitive data types present.", "Options": [ { "Value": "no_personal_data", "Label": "No personal data" }, { "Value": "pseudonymous", "Label": "Pseudonymous / indirect identifiers" }, { "Value": "direct_identifiers", "Label": "Direct identifiers (names, SSNs, contact)" }, { "Value": "sensitive_categories", "Label": "Sensitive categories (health, race, religion, sexual orientation, finances)" }, { "Value": "special_category", "Label": "Special category / high sensitivity" } ], "Required": true }, { "Key": "lawful_basis_consent", "Type": "select", "Label": "Consent / Lawful Basis", "HelpText": "What legal basis permits this processing?", "Options": [ { "Value": "consent", "Label": "Explicit consent" }, { "Value": "contract", "Label": "Contractual necessity" }, { "Value": "legal_obligation", "Label": "Legal obligation" }, { "Value": "legitimate_interest", "Label": "Legitimate interest" }, { "Value": "public_task_research", "Label": "Public task / research exception" }, { "Value": "other", "Label": "Other (explain in notes)" } ], "Required": true }, { "Key": "consent_notes", "Type": "textarea", "Label": "Consent / Notice / Data Use Notes", "HelpText": "Briefly describe how consent or notice is captured and where documentation is stored. If relying on legitimate interest, document the balancing test result.", "Required": false }, { "Key": "reidentification_risk", "Type": "scale", "Label": "Re-identification Risk (1 = low, 5 = high)", "HelpText": "Estimate the practical risk that individuals could be re-identified from outputs or derivatives.", "Required": true, "Min": 1, "Max": 5 }, { "Key": "anonymization_techniques", "Type": "checkbox", "Label": "Anonymization / De-identification Techniques Applied", "HelpText": "Select techniques already applied or planned.", "Options": [ { "Value": "pseudonymization", "Label": "Pseudonymization (tokenization)" }, { "Value": "aggregation", "Label": "Aggregation / bucketing" }, { "Value": "masking", "Label": "Masking / redaction" }, { "Value": "noise_addition", "Label": "Noise / differential privacy" }, { "Value": "synthetic_data", "Label": "Synthetic data" }, { "Value": "none", "Label": "None applied" } ], "Required": false }, { "Key": "anonymization_notes", "Type": "textarea", "Label": "Anonymization / Synthetic Data Notes", "HelpText": "Describe parameters, verification tests, or known limitations of the applied methods.", "Required": false }, { "Key": "fairness_bias_review", "Type": "yesno", "Label": "Fairness and Bias Review Completed?", "HelpText": "Has the model or analysis been checked for biased inputs, disparate impacts, or proxy variables?", "Required": true }, { "Key": "fairness_bias_notes", "Type": "textarea", "Label": "Fairness / Bias Findings", "HelpText": "Summarize findings and any subgroup performance differences or mitigations planned.", "Required": false }, { "Key": "purpose_limitation", "Type": "yesno", "Label": "Purpose Limitation & Minimization Followed?", "HelpText": "Is data collection and use limited to what's necessary for the stated purpose?", "Required": true }, { "Key": "retention_policy_exists", "Type": "yesno", "Label": "Retention Policy Defined?", "HelpText": "Is there a documented retention period aligned to the purpose and legal requirements?", "Required": true }, { "Key": "retention_period", "Type": "text", "Label": "Retention Period (if defined)", "HelpText": "Example: 3 years, until project closure, or 'see policy X'.", "Required": false }, { "Key": "access_controls_logging", "Type": "select", "Label": "Access Controls & Logging", "HelpText": "Select the statement that best describes access and monitoring for this data.", "Options": [ { "Value": "role_based", "Label": "Role-based access with logging" }, { "Value": "restricted_manual", "Label": "Restricted manual access (no automated logging)" }, { "Value": "open_internal", "Label": "Open to internal teams" }, { "Value": "external_sharing", "Label": "Shared externally / third parties" } ], "Required": true }, { "Key": "mitigation_actions", "Type": "textarea", "Label": "Planned Mitigation Actions", "HelpText": "List concrete mitigation steps (technical, contractual, governance), owners, and target dates.", "Required": false }, { "Key": "overall_risk", "Type": "scale", "Label": "Overall Residual Risk (1 = low, 5 = high)", "HelpText": "Considering controls and mitigations, how would you rate the residual risk to individuals or the organization?", "Required": true, "Min": 1, "Max": 5 }, { "Key": "assessment_status", "Type": "select", "Label": "Assessment Status", "HelpText": "Current state of the assessment.", "Options": [ { "Value": "draft", "Label": "Draft" }, { "Value": "under_review", "Label": "Under review" }, { "Value": "approved", "Label": "Approved" }, { "Value": "mitigated", "Label": "Mitigated / Approved after fixes" } ], "Required": true }, { "Key": "signoff_name", "Type": "text", "Label": "Assessment Sign-off (name)", "HelpText": "Person who reviewed and signed off (privacy officer, data steward, or project owner).", "Required": false }, { "Key": "signoff_role", "Type": "text", "Label": "Sign-off Role", "HelpText": "Role or title of the signatory.", "Required": false }, { "Key": "signoff_date", "Type": "text", "Label": "Sign-off Date", "HelpText": "Date of sign-off (YYYY-MM-DD).", "Required": false }, { "Key": "notes_and_references", "Type": "textarea", "Label": "Notes, References & Links", "HelpText": "Add links to impact assessments, privacy notices, policy documents, data catalogs, or test results.", "Required": false } ] }