Create an approval policy with two steps and a condition

Steps

1. 1

   Select Publish a privacy policy version

   In Settings, Access control, Approval policies, select Publish a privacy policy version in the list of approvable actions. Its badge reads Default, and the editor on the right is filled in with the built-in rule: one approval step.

2. 2

   Check where the policy will apply

   Policy for is set to Whole organisation, so the policy you save will apply to every unit and entity that has no policy of its own. To give one entity a different rule you would choose it here first. That is covered in a later lesson.

3. 3

   Type the policy name

   In Policy name, type a name that says what the rule does. People see this name on every request that follows the policy. If you leave it blank, the action's own name is used.

   • Type Policy name: Privacy policies: second sign-off on major changes
4. 4

   Set the time allowed for a decision

   In SLA, in hours, enter 72. Each request then shows a due time three days after it was submitted. Leave the box empty if requests should have no due time. The largest value is 2160 hours, which is ninety days.

   • Type SLA (hours): 72
5. 5

   Leave maker / checker on Strict and both switches on

   Strict maker / checker stays selected, so nobody approves a version they wrote or edited. A different person for each step stays on, so the two steps need two different people. Policy active stays on, so the policy takes effect as soon as it is saved.

6. 6

   Name the first step

   Under Approval steps, change the Step name of step 1 to Data protection officer. Approver needs already shows the permission Data protection, Privacy policies and attestation, Approve, which the data protection officers hold. Approvals needed is 1.

   • Type Step name: Data protection officer
7. 7

   Select Add step

   Select Add step under the first step. A second step appears, named Step 2, with the same approver permission as the first. A policy can have up to ten steps, and they are decided in order from the top.

   • Select Add step

   

8. 8

   Name the second step

   Change the Step name of step 2 to Compliance officer sign-off. The step name is shown to the person who submitted the record, so they know whose turn it is.

   • Type Step name: Compliance officer sign-off
9. 9

   Choose the permission the second approver needs

   Open Approver needs on step 2. Type compliance tasks in the search box and choose Compliance tasks, Approve. Anyone whose role includes that permission on the entity can decide this step. Here that is the compliance officer.

   • Type Search permissions…: compliance tasks
10. 10

    Look at where the approver must hold the permission

    Open Approver holds it over. The same entity means the entity the record belongs to. The parent unit and head office move the decision up the organisation structure, and a specific unit names one unit. Keep the same entity, then close the list.

    • Select the same entity
11. 11

    Keep one approval for the step

    Press Escape to close the list. Approvals needed is the number of different people who must approve before the step is complete. It can be from 1 to 10. Keep 1.

12. 12

    Switch on Only when and choose the condition

    Switch on Only when on step 2. In Field choose major change, and in Condition keep is yes. The fields offered depend on the action: for privacy policies they are policy type, major change and legal review outstanding. The sentence under the step now ends with Only when major change is yes.

    • Select policy type
    • Choose major change
13. 13

    Find the buttons that reorder or remove a step

    At the top right of each step, the up and down arrows change the order in which steps are decided, and the bin removes the step. A policy must keep at least one step, so the bin is greyed out when only one is left.

14. 14

    Select Save policy

    Select Save policy. A note beside the button reminds you that the policy is saved for the whole organisation. After saving, the badge at the top reads Saved for this scope, and the action shows 1 saved in the list. The policy applies to requests submitted from now on.

    • Select Save policy