Hopex GDPR Presassessment default values

[cnisparnorddk]

Are the Final Risk Level and Final Compliance Level automatically set according to the details entered into the processing activities?

[mimperiali]

Hi Claus,

Yes please. A new thread would be better. I'm getting the info you requested so I should be able to come back to you shortly.

[cnisparnorddk]

Please see replies below. We don't understand how Net Risk is calculated and we don't see that the Final Risk Level is calculated corretly. Shall we open a new thread with this issue?

[cnisparnorddk]

Can you also explain to me how Net Risk is calculated?

It doesn't change when I'm changing "Risk" and "Risk Mitigation"

[cnisparnorddk]

Just what I needed. Thanks 🙂

[mimperiali · Accepted solution]

Good morning Claus,

Yes they are. Their value is based on the 5 compliance indicators of the processing activity:

1) Legal Basis Compliance Level

2) Data Minimization Compliance Level

3) Data Subjects' Rights and Notice Management Compliance Level

4) Data Transfers Compliance Level

5) Security Measures Compliance Level

In order to compute the Final Compliance Level, the algorithm sums the 5 indicators values, based on the following scoring table:

The result is averaged and rounded to the smallest integer. Please not that if a compliance indicator is left empty, it is considered as if it was set to "Not Compliant".

For the Final Risk Level, instead, the algorithm sums the 5 indicators values, based on the following scoring table:

The result is averaged and rounded to the biggest integer, then we subtract one.

Also the field "Subsequent Action" is automatically computed.

For Pre-Assessments:

• If the Final Risk Level is either High or Very High, then the Subsequent Action is "Run a DPIA"
• Otherwise it is "Other"

For DPIAs:

• If the Final Risk Level is either High or Very High, then the Subsequent Action is "Notify Supervisory Authority"
• Otherwise it is "Other"

Best,

Mike