The open source PIA software helps to carry out data protection impact assesment
The PIA software aims to help data controllers build and demonstrate compliance to the GDPR. The tools is available in French and in English. It facilitates carrying out a data protection impact assessment, which will become mandatory for some processing operations as of 25 May 2018. This tool also intends to ease the use of the PIA guides published by the CNIL.
Who can use the PIA software?
The tool is mainly addressed to data controllers who are slightly familiar with the PIA process. In this regard, a stand-alone version can be downloaded and easily launched on your computer.
It is also possible to use the tool on an organisation’s servers in order to integrate it with other tools and systems already used in-house.
What is it?
The PIA tool has been designed around three principles:
- A didactic interface to carry out PIAs: the tool relies on a user-friendly interface to allow for a simple management of your PIAs. It clearly unfolds the privacy impact assessment methodology step by step. Several visualisation tools offer ways to quickly understand the risks.
- A legal and technical knowledge base: the tool includes the legal points ensuring the lawfulness of processing and the rights of the data subjects. It also has a contextual knowledge base, available along all the steps of the PIA, adapting the contents displayed. The data are extracted from the GDPR, the PIA guides and the Security Guide from the CNIL, to the aspect of the processing studied.
- A modular tool: designed to help you build your compliance, you can customise the tool contents to your specific needs or business sector, for example by creating a PIA model that you can duplicate and use for a set of similar processing operations. Published under a free licence, it is possible to modify the source code of the tool in order to add features or include it into tools used in your organisation.
This version can be directly downloaded and launched on your computer with no need to install it locally.
You can watch the video tutorial to get started with the PIA software!
A tool constantly improved
Launched as a beta, the PIA tool will evolve in the incoming months to include improvements concerning the workflow and user experience.
I have display issues such as icons being stuck in one state or missing elements from the interface
When encountering those display issues, close the application and reload it. It usually fixes the issue. You won’t lose the information you have entered; it is automatically saved as you type.
I can’t edit the gauges for evaluating the severity and likelihood of a risk
This known issue is currently being fixed. If you encounter this problem, we recommend that you fill in the justification field of the estimated level of severity and / or likelihood. You will be able to edit the gauge once the bug is fixed.
I encounter issues when importing a PIA
Several bugs have been observed when importing a PIA, and in particular the level gauges for evaluating the severity and likelihood of a risk may disappear. In this case, please refer to the above mentioned issue.
Besides, a PIA may not appear on the dashboard after importing it. This is a display issue and you just need to refresh the page.
When I copy / paste text, it is highlighted.
This is only a display bug and it has no effect on the text you enter in a field. This visual problem will be fixed soon.
I can’t evaluate a section
In order to evaluate a section, it is mandatory to fill in all the fields. Please check if this is the case. When editing a risk, you must have at least one technical or organizational measure that mitigates the risk in order to ask for an evaluation of the risk.
When switching language, the texts are not translated
Please close the PIA you are editing and re-open it. The content should then be displayed in the language you have selected.
I have refused to validate a PIA but I don’t know what to do now
For the moment, the navigation menu icons are not refreshed after refusing a PIA. You have to check each section and change the information and/or evaluation according to the reasons for refusing the PIA. Once all section have been reviewed, you should be able to request PIA validation again.