PDPL essentials: register, data map, assessments and transfers

Interactive tutorial

Follow the course step by step in the interactive player.

Lessons

1. 1Find your way around the Data Protection moduleKnow where everything in the Data Protection module lives before you record anything: the summary tiles, the programme metrics, the year filter, the Insights panel and the list of sections that leads to every register. In this lesson the module is still empty, so you also see what each empty register looks like.7 min
2. 2Set the regime, the deadlines and the Data Protection OfficerRecord the settings every other part of the module relies on: which data-protection law the entity follows, how many days you allow for requests and breach reports, who the Data Protection Officer is, and how children's data is treated.6 min
3. 3Add a processing activity: every field explainedRecord one way your organisation uses personal data in the record of processing activities, or RoPA, and understand what every field on the form is for, what a good value looks like and what happens if you leave it empty.7 min
4. 4Record children's data and automated decisionsAdd two activities that need extra detail: one that processes children's data, with its age bands and age checks, and one where a system decides about people automatically, with a description of the logic and the right to human review.7 min
5. 5Open, review and edit an activity, and flag that it needs a DPIARead an activity's full record, change it when the business changes, and mark it as needing a data protection impact assessment, or DPIA. You will see the hint that appears when an active activity needs a DPIA and use it to put the activity under review.7 min
6. 6Sort, filter, archive and download the registerWork with the register as a whole: add a short record with only the required fields, sort and filter the list, change an activity from the list without opening it, archive an activity that has ended, and download the register as a file.7 min
7. 7Start the data map: add a system and the records it holdsRecord where personal data actually lives. You will add a system that ComplianceOS cannot connect to, describe a set of records inside it field by field, and link those records to the processing activity that uses them.8 min
8. 8Keep data map records up to date and link them from an activityMaintain the records in the data map: find a record, describe it, say roughly how many rows it holds and whose data it is, check how each field is classified, add a second record, and link a record to an activity starting from the activity's own page.8 min
9. 9Tune discovery: automation settings and the configuration pageKnow the settings behind the data map and change them safely for one entity: when reviewers are asked about unclear columns, who is alerted when personal data changes, when a link to an activity is suggested, and the thresholds, categories and rules on the Discovery configuration page.7 min
10. 10Register processors and their contractsRecord the suppliers that handle personal data for you, called processors, with what each one does, its contract and whether a data processing agreement is in place, and link each processor to the activities it serves.8 min
11. 11Start a DPIA and find your way around itStart a data protection impact assessment, or DPIA, for an activity that needs one. You will fill in every field of the New DPIA form, choose the right template, decide whether to ask for an AI draft, and learn the three tabs of the assessment's page.7 min
12. 12Complete the DPIA questionnaire and attach evidenceAnswer every question of a data protection impact assessment: describe the processing, answer the yes and no checks, record evidence by reference and by uploading a file, list the mitigations and write the conclusion, so that the assessment reads Complete and can be submitted.9 min
13. 13Export a DPIA and submit it for approvalCheck a finished impact assessment, download it as a PDF, submit it for approval, follow the request, and withdraw it to make a correction before submitting it again. You will see why the person who prepared a DPIA cannot approve it, and where to watch its progress.7 min
14. 14Approve a DPIA as the second Data Protection OfficerTake a DPIA that a colleague submitted, from your Approvals inbox to a decision. You will read the assessment and its evidence, approve it with a note, see the linked activity return to Active by itself, and assign the risk actions the approval creates.7 min
15. 15After approval: the report, risk actions and a new versionWork with a DPIA once it is approved: download the report, follow up the risk actions with proof that each measure is in place, and start a new version when the processing changes, comparing it with the approved one before you submit it.8 min
16. 16Get a first draft of a DPIA from the AI and finish itStart a DPIA from an activity that recommends one, ask the AI to write the first draft of the narrative, check and correct what it wrote, answer the questions it cannot answer for you, and submit the finished assessment for approval.9 min
17. 17From the data map to a cross-border transferSee how the data map leads to the Cross-Border register. You will add a system hosted outside the United Arab Emirates, describe the record it holds, and accept the suggestion the data map then makes to record a cross-border transfer.8 min
18. 18Read the transfer register, review a transfer and add one by handRead a transfer in the Cross-Border register: its adequacy labels, risk level, status and transfer impact assessment. Then open a transfer to link it to its activity, and record a new transfer by hand with every field.7 min
19. 19Record, use and withdraw your organisation's adequacy assessmentRecord your organisation's own assessment that a destination country protects personal data adequately, see what it changes on the transfers to that country, and withdraw it when it no longer holds.7 min
20. 20Complete a transfer impact assessment and submit itStart a transfer impact assessment, or TIA, for a cross-border transfer, answer its questions about the destination, the legal basis and the safeguards, attach the contract as evidence, read the conclusion ComplianceOS works out, and submit the assessment for approval.8 min
21. 21Approve a TIA and its transfer, and reject a transferDecide the two requests a cross-border transfer produces. You will approve a transfer impact assessment from your inbox, see the transfer itself arrive for approval automatically, approve it in the Cross-Border register, and reject another transfer with a reason.8 min
22. 22Track assessments, adapt a template and set the review cadenceUse the Assessments section to see which transfers still lack an approved transfer impact assessment and when approved ones fall due for review, make your own version of an assessment template, and set how often assessments are reviewed.7 min
23. 23See who can do what, and how approvals are set upUse the Access section of Data Protection to answer three questions: who can view, create, edit and approve each kind of record, which role gives them that right, and what the approval rule is for DPIAs, transfers and transfer impact assessments.6 min
24. 24What an auditor sees, and the files to hand overReview the privacy programme as an auditor with read-only access. You will see that every register can be read and downloaded but nothing can be changed, download each register, read an approved DPIA, and find the supporting evidence and the audit trail.6 min
25. 25What someone without access to Data Protection seesRecognise what a colleague sees when they have no Data Protection role, so you can explain it when they ask, and know how they find out who can grant access.2 min
26. 26How this connects: dashboard, risk register, calendar and vendorsSee where the work done in Data Protection shows up in the rest of ComplianceOS: the entity dashboard, the risk register, the compliance calendar, the Approvals inbox and the vendor risk register. You will also learn which of these links are automatic and which need a button.7 min
27. 27How this connects: My Actions, notifications and the Approvals inboxFollow the work the Data Protection module sends to the rest of ComplianceOS for one person. You will find a risk action from a DPIA in My Actions and in the notifications, decide the requests waiting in your Approvals inbox, and approve a new version of a DPIA, watching it replace the old one.9 min

How this connects to the rest of ComplianceOS

• Approvals

  Submitting a DPIA or a transfer impact assessment opens a request in the Approvals inbox of everyone who may approve it and did not prepare it. Approving a transfer impact assessment sends its transfer for approval automatically. The preparer follows progress under My requests.

• My Actions and notifications

  Each mitigation of an approved DPIA becomes a risk action. An action assigned to a person's email address appears in their My Actions list and raises a notification.

• Risk register

  Select Sync Modules in the risk register to import a risk for each DPIA rated High or Very high and each high-risk transfer, tagged with its source; risks from superseded or voided assessments are retired by the same sync.

• Compliance calendar

  Select Sync Deadlines in the calendar to bring in the review dates of approved DPIAs and transfer impact assessments, and the response dates of data subject requests.

• Data map and Cross-Border

  A system hosted outside the UAE that holds personal data prompts a suggestion to record a cross-border transfer; accepting it creates the transfer.

• Requests and erasure

  The data map built here is what a data subject request is searched against, by the email on the request.

• Vendor risk and the vendor directory

  Processors and transfers recorded here can be linked to a vendor in the vendor risk register, which shares its vendors with the tax vendor directory.

• Evidence Vault and Audit log

  Files uploaded as evidence, and a snapshot of each approved DPIA, are sealed in the Evidence Vault; every change and decision is in the Audit log.

• Entity dashboard

  The Data Protection score and the count of DPIAs awaiting approval appear on the entity dashboard.