Assessments
Run DPIAs, privacy impact assessments, California risk assessments, transfer impact assessments, and more from ready-made templates, with review, approval, and a permanent record.
Overview
An assessment is a written record showing you thought about the privacy risk in something before you did it. Regulators ask for them by different names in different places, and Concord gives you one place to run all of them.
You'll find them under Data Hub → Assessments.
What You Can Do
- Start an assessment from a ready-made template
- Fill in what you can from records you already keep, instead of retyping
- Send it to someone to review, and approve it when it's right
- Get reminded when it's time to look at it again
- Hand a regulator the exact assessment you approved, even years later
The Templates
Concord ships eight. Pick the one that matches what you're being asked for.
| Template | Use it when |
|---|---|
| Data Protection Impact Assessment (GDPR) | European rules say your processing is likely high risk |
| Privacy Impact Assessment | You want a general privacy review. It starts with a few questions and tells you whether you need a full DPIA |
| Risk Assessment (California) | California requires one before you sell or share personal information, handle sensitive personal information, or let software make significant decisions about people |
| Data Protection Assessment (US states) | A US state law asks for one, such as Colorado or Connecticut |
| Transfer Impact Assessment | You're sending personal data to another country |
| Legitimate Interests Assessment | You're relying on legitimate interests and need to show you weighed it up |
| Fundamental Rights Impact Assessment | The EU AI Act asks you to assess an AI system |
| Fundamental Rights section | Same as above, but added onto a DPIA you're already doing, so you answer once |
The two AI templates are marked provisional. The EU is still writing the official form, and we'll update ours when they publish it.
Making a Template Your Own
You don't have to use ours as-is.
Open Assessments → Templates, find one, and choose Customize. Give the copy a name and it becomes a private template for your organization. Edit it however you like: add questions, remove ones that don't apply, reword anything. Nobody else sees your copy, and we never overwrite it. You can take more than one copy of the same template (say, one DPIA per business unit); each has its own name and its own edits.
When we improve the original later, your copy shows an Update available note. You choose what happens:
- Apply the changes: we add what's new and leave your edits alone
- Start over from ours: throws away your edits and takes the new version
- Dismiss: keeps your copy exactly as it is and stops asking
Anywhere your edits clash with ours, we tell you and change nothing until you decide.
Building a Template From Scratch
Choose New Template on the same page, name it, and you get an empty template that belongs to your organization. The builder is the same one our team uses. Drag a question type in from the left, group questions into sections, and see a live preview of the finished assessment as you go.
Two things worth knowing:
Questions can depend on answers. Set a question to show only when an earlier answer says something in particular. If it stays hidden, it isn't asked and it isn't required.
Publishing is a separate step. Editing a template changes nothing for the people filling it in. When you publish, we tell you whether the change affects the questions themselves or only the wording, so you know whether older answers still line up.
Filling One In
Open an assessment and answer the questions. It saves as you go, and you can leave and come back.
Prefill. If the assessment is about a processing activity or a system you've already recorded in Concord, choose Prefill. We fill in what your records already say: what it's for, whose data, what kinds of data, your legal basis, where it goes, how long you keep it. Every prefilled answer is marked as coming from your records, with a link back to where, and you can change any of it. Nothing is filled in quietly.
Risk findings. Some assessments ask you to record specific risks. For each one you score how likely it is and how bad it would be, describe what you're doing about it, then score it again afterwards. The second score is the point: it's what shows the safeguards actually helped. Choose Add a Risk from the Catalog to start from a standard risk, and say which systems it affects. Risks you record also appear in your Risk Register.
Assigning and Sharing
You don't have to answer every question yourself.
- Assign to a teammate: on the assessment's Assignments tab, assign the whole assessment, a section, or a single question to a teammate, with a due date. They get a task and see it in My Work.
- Invite someone outside your organization: choose Invite an Outside Respondent, enter their email, and choose What to Share: the whole assessment or one section. They're invited as a guest, sign in with a one-time passcode sent to their email, and can answer only what you shared with them. You can revoke an invite at any time. See Guest Access.
Getting It Approved
An assessment moves through four steps:
- Draft: anyone assigned to it can edit
- In review: sent to a reviewer, locked from editing
- Changes requested: the reviewer wants something fixed, so it's editable again
- Approved or Rejected: the decision is made and the record is fixed
On approval we save a permanent copy of the whole assessment exactly as approved. That copy never changes, even if you later reopen the assessment or edit the template it came from.
Keeping It Current
When you approve an assessment you set how often it should be looked at again. When that date arrives we open a task for the owner. We don't reopen the assessment on our own: a compliant record shouldn't quietly stop being approved because a date passed.
If something material changes about what you assessed, reopen it yourself. That gives you 45 days and puts the assessment back in draft, with the previous approval kept as history.
When a Regulator Asks
Two things sit ready.
The assessment itself. Choose Produce on any approved assessment and you get it back exactly as approved: the questions as they were worded then, the answers given, the risk findings, and the approval. It doesn't matter how many times the template has changed since.
The annual summary. California wants a yearly summary rather than the assessments themselves. Concord builds it: how many assessments you did, broken down by the kind of processing each one covered, which categories of personal information were involved, the sworn statement California words for you, who to contact, and who is signing. The assessments stay with you.
One thing to know: California requires the person signing to be a senior executive who is responsible for this work and has the authority to submit it. Concord asks for their name and title rather than assuming whoever ran the export is the right person.
How Assessments Connect to Everything Else
Every system, vendor, control and document an assessment mentions gets linked to it. So on any of those pages you can see which assessments cover it, and from an assessment you can see everything it touches.
Approving an assessment also files it as evidence against any controls it supports, so your compliance frameworks pick it up without you doing anything.
What It Costs
Assessments are an add-on to the Privacy Premium and Enterprise plans, billed with your subscription. Turn it on under Global Settings → Billing, in your plan's Add-ons. If the add-on ends, everything you already approved stays readable and exportable; you just can't start or edit assessments until you add it back.
Tasks and My Work
Track compliance work as tasks your team can assign, prioritize, and close, and see everything assigned to you in My Work.
Sending Notifications
Send an email or a signed webhook when something happens in Concord, such as a privacy request arriving, a scan finding issues, or your balance running low.