Files

Josako 37819cd7e5 - Correctie reset password en confirm email adress by adapting the prefixed_url_for to use config setting

- Adaptation of DPA and T&Cs
- Refer to privacy statement as DPA, not a privacy statement
- Startup of enforcing signed DPA and T&Cs
- Adaptation of eveai_chat_client to ensure we retrieve correct DPA & T&Cs

2025-10-13 14:28:09 +02:00

20 KiB

Raw Blame History

Data Protection Impact Assessment (DPIA) Template

Ask Eve AI

Date of Assessment: [Date]
Assessed By: [Name, Role]
Review Date: [Date - recommend annual review]

1. Executive Summary

Field	Details
Processing Activity Name	[e.g., "Job Candidate Assessment Specialist"]
Brief Description	[1-2 sentence summary]
Risk Level	☐ Low ☐ Medium ☐ High
DPIA Required?	☐ Yes ☐ No
Status	☐ Draft ☐ Under Review ☐ Approved ☐ Requires Revision

2. Description of the Processing

2.1 Nature of the Processing

What Personal Data will be processed?

Contact information (name, email, phone)
Identification data (ID numbers, passport)
Professional data (CV, work history, qualifications)
Assessment results or scores
Communication records
Behavioral data (how users interact with the system)
Technical data (IP addresses, device information)
Other: _______________

Categories of Data Subjects:

Job applicants/candidates
Employees
Customers
End users/consumers
Other: _______________

Volume of Data Subjects:

< 100
100-1,000
1,000-10,000
> 10,000

2.2 Scope of the Processing

What is the purpose of the processing?

[Describe the specific business purpose, e.g., "To assess job candidates' suitability for specific roles by analyzing their responses to standardized questions"]

How will the data be collected?

Directly from data subjects (forms, interviews)
From third parties (recruiters, references)
Automated collection (web forms, chatbots)
Other: _______________

Where will data be stored?

EU (specify: France - Scaleway)
Non-EU (specify and justify): _______________

2.3 Context of the Processing

Is this processing new or existing?

New processing activity
Modification of existing processing
Existing processing (periodic review)

Who has access to the Personal Data?

Ask Eve AI employees (specify roles): _______________
Customer/Tenant employees
Partners (specify): _______________
Sub-Processors (list): _______________
Other: _______________

How long will data be retained?

[Specify retention period and justification, e.g., "Candidate data retained for 12 months to comply with recruitment record-keeping requirements"]

3. Necessity and Proportionality Assessment

3.1 Lawful Basis

What is the lawful basis for processing? (Article 6 GDPR)

Consent - Data subject has given explicit consent
Contract - Processing necessary for contract performance
Legal obligation - Required by law
Vital interests - Necessary to protect someone's life
Public task - Performing a public interest task
Legitimate interests - Necessary for legitimate interests (requires balancing test)

Justification:

[Explain why this lawful basis applies]

3.2 Special Categories of Data (if applicable)

Does the processing involve special categories of data? (Article 9 GDPR)

No
Yes - racial or ethnic origin
Yes - political opinions
Yes - religious or philosophical beliefs
Yes - trade union membership
Yes - genetic data
Yes - biometric data for identification
Yes - health data
Yes - sex life or sexual orientation data

If yes, what is the additional lawful basis?

[Article 9(2) provides specific conditions - specify which applies]

3.3 Automated Decision-Making

Does the processing involve automated decision-making or profiling?

No
Yes - automated decision-making WITH human oversight
Yes - fully automated decision-making (no human intervention)

If yes:

Does it produce legal effects or similarly significant effects?

No
Yes (explain): _______________

What safeguards are in place?

Right to obtain human intervention
Right to express point of view
Right to contest the decision
Regular accuracy reviews
Transparency about logic involved
Other: _______________

3.4 Necessity Test

Is the processing necessary to achieve the stated purpose?

☐ Yes ☐ No

Justification:

[Explain why this specific processing is necessary and whether less intrusive alternatives were considered]

Could the purpose be achieved with less data or through other means?

☐ Yes (explain why not pursued): _______________
☐ No

3.5 Proportionality Test

Is the processing proportionate to the purpose?

☐ Yes ☐ No

Data Minimization:

Are you collecting only the minimum data necessary? ☐ Yes ☐ No
Have you considered pseudonymization or anonymization? ☐ Yes ☐ No ☐ N/A
Can data be aggregated instead of individual records? ☐ Yes ☐ No ☐ N/A

Storage Limitation:

Is the retention period justified and documented? ☐ Yes ☐ No
Is there an automated deletion process? ☐ Yes ☐ No ☐ Planned

4. Stakeholder Consultation

4.1 Data Subject Consultation

Have data subjects been consulted about this processing?

☐ Yes ☐ No ☐ Not required

If yes, how were they consulted?

[Describe consultation method: surveys, focus groups, user research, etc.]

Key concerns raised by data subjects:

[List any concerns and how they were addressed]

4.2 DPO or Security Contact Consultation

Has the DPO or security contact been consulted?

☐ Yes ☐ No ☐ N/A (no formal DPO)

Comments from DPO/Security Contact:

[Record any recommendations or concerns]

5. Risk Assessment

5.1 Risk Identification

For each risk, assess:

Likelihood: Negligible / Low / Medium / High
Severity: Negligible / Low / Medium / High
Overall Risk: Low / Medium / High / Very High

Risk 1: Unauthorized Access or Data Breach

Description: Personal data could be accessed by unauthorized parties due to security vulnerabilities.

Assessment	Rating
Likelihood	☐ Negligible ☐ Low ☐ Medium ☐ High
Severity (if occurs)	☐ Negligible ☐ Low ☐ Medium ☐ High
Overall Risk	☐ Low ☐ Medium ☐ High ☐ Very High

Risk 2: Discrimination or Bias in Automated Decisions

Description: Automated processing could result in discriminatory outcomes or unfair treatment.

Assessment	Rating
Likelihood	☐ Negligible ☐ Low ☐ Medium ☐ High
Severity (if occurs)	☐ Negligible ☐ Low ☐ Medium ☐ High
Overall Risk	☐ Low ☐ Medium ☐ High ☐ Very High

Risk 3: Lack of Transparency

Description: Data subjects may not understand how their data is processed or decisions are made.

Assessment	Rating
Likelihood	☐ Negligible ☐ Low ☐ Medium ☐ High
Severity (if occurs)	☐ Negligible ☐ Low ☐ Medium ☐ High
Overall Risk	☐ Low ☐ Medium ☐ High ☐ Very High

Risk 4: Inability to Exercise Data Subject Rights

Description: Data subjects may have difficulty exercising their rights (access, erasure, portability, etc.).

Assessment	Rating
Likelihood	☐ Negligible ☐ Low ☐ Medium ☐ High
Severity (if occurs)	☐ Negligible ☐ Low ☐ Medium ☐ High
Overall Risk	☐ Low ☐ Medium ☐ High ☐ Very High

Risk 5: Data Quality Issues

Description: Inaccurate or outdated data could lead to incorrect decisions or outcomes.

Assessment	Rating
Likelihood	☐ Negligible ☐ Low ☐ Medium ☐ High
Severity (if occurs)	☐ Negligible ☐ Low ☐ Medium ☐ High
Overall Risk	☐ Low ☐ Medium ☐ High ☐ Very High

Risk 6: Function Creep / Scope Expansion

Description: Data collected for one purpose could be used for other purposes without consent.

Assessment	Rating
Likelihood	☐ Negligible ☐ Low ☐ Medium ☐ High
Severity (if occurs)	☐ Negligible ☐ Low ☐ Medium ☐ High
Overall Risk	☐ Low ☐ Medium ☐ High ☐ Very High

Additional Risks:

[Add any processing-specific risks]

6. Mitigation Measures

For each identified risk, document mitigation measures: