This function provides an easy method to extract data to Excel. You may use the data to build your own reports or run queries on the extracted data. Each selected section will be included in your Excel document as a separate sheet. Though reports can be useful in reviewing and validating your Data Mappings, do not use a Report as a starting point for a Data Mapping upload. Instead use Data Mapping > Export/Import.
Choose which items you wish to download, then click “Download Excel” at the bottom of the page.
Available reports and filters follow. If you filter the results, your filter items are listed at the top of the corresponding Excel sheet in the download.
Applying filters
In order for the filter to apply, you need to minimize the dropdowns once you have made your selections, then choose “Download Excel”. Otherwise your filters may not be applied. Following is an example for a “Service Providers” Report:
Step 1: Click to open the Service Providers dropdown
Step 2: Choose the Service Providers for filtering
Step 3: Close the dropdown by clicking on the filter topic again:
Step 4: Choose “Download Excel”
Locations (Asset Register / Data Mapping)
Filtering options: Processing Location; Processing Purpose; Personal Information Type; Sensitive personal information type
Output contains: Location; Outside US; Department; Data Subject Type; Processing Purpose; Legal Basis; Personal Information Type; Is sensitive
Example usage:
- Maintain an asset register of all locations where personal data is held or processed.
- Export all or some of your Data Mapping; can supplement a Visualization view of your mapping.
- If your Data Mapping will not pass Validation, exports can help pinpoint where gaps exist.
Service Providers
Note that the Service Provider extract depends on the data mapping tab in the Service Provider form to be updated. PrivIQ provides a reminder about this relationship:
Filtering options: Service Provider; Country; Service Provider type; Contract end date from; Contract end date to
Output contains: Service Provider; Service Provider type; Status; Contract end date; Country; Export legal basis; Department; Data Subject Type; Processing Purpose; Personal Information Type; Is sensitive
Example usage:
- Identify service providers that could assist with a particular data subject access request.
Collection Sources
Filtering options: Collection Source; Personal Information Type; Sensitive personal data type; Third Party Name
Output contains: Department; Data Subject Type; Personal Information Type; Is sensitive; Collection Source; Third Party Name
Example usage:
- Identify where sensitive personal information is collected and apply stricter security measures at those collection points.
- If your Data Mapping will not pass Validation, exports can help pinpoint where gaps exist.
DSAR
Filtering options: Type; Status; Task Owner; Relationship (Data Subject Type); Received date from; Received date to
Output contains: Type; Reference; Received date; Requester name; Email address; Relationship; Task Owner; Status; Date completed/rejected; # of days for reply
Example usage:
- Identify data subject access requests that are overdue for a response.
Breach (Incident)
Filtering options: Incident type; Lead investigator; Data Subject Type; Service Provider; Status; Date of incident from; Date of incident to
Output contains: Name; Incident date; Date response commenced; Lead investigator; Country; Incident type; Likely causes; Data Subject Type; No. of Data Subjects; No. of records involved; Contained?; Status; Service Provider; Training required?
Example usage:
- Identify the types and frequency of breaches and use the data to address any recurring incident types.
Record of Processing (ROPA)
Filtering options: Data Subject Type; Processing Purpose; Legal Basis; SPDT legal basis
Output contains: Department; Data Subject Type; Processing Purpose; Legal Basis; Personal Information Type; Is sensitive; SPDT legal basis; Retention period
The Record of Processing Activity is dependent on your organization settings being accurate, your data mapping being completed, and the technical and organizational security measures (located under Governance) being up to date.
PIA (Privacy Impact Assessment)
Filtering options: PIA owner; PIA Name; Due date; Risk type; Overall risk level (Risk severity)
- Risk Type Dropdown is used when the PIA Risk Type is chosen from dropdown
- Risk Type text box is used when the PIA Risk Type is chosen from dropdown as “other” and will search free text that was input with Type=”other”
Output contains: Name; PIA owner; Creation date; Due date; Status; Data Subject Type; Has special category data; Risk Type; Impact; Overall risk level
The report will only contain PIAs which have an associated level of risk. No Risks are assigned on a PIA until it has initial approval. After the initial approval, a Risks tab will appear where you can detail each risk and how it’s being mitigated.
Example usage:
- Identify previously approved privacy impact assessments which could be applied to similar projects that might be planned or are in progress.
Stakeholders (Employees)
Filtering options: Department; Location; Status; free text search
- Status filter matches on the overall status of each person, not status of individual items
- Free text search returns a full or partial match in any of these employee attribute fields: First Name, Last Name, Email Address, Job Title
Output contains: First name; Last name; Email address; Job title; Department; Location; Is active; Status; … then for each assigned Document or Item: Item – Status; Item – Sent at; Item – Accepted at
All information about an employee is contained in a single row for ease of reporting and analysis.
Example usage:
- Track and manage stakeholders’ acceptance of policies and related documents
- Excel document with one entry per person allows for sorting, filtering, and calculations
