Sensitive-data processing assessment

What does the sensitive-data processing assessment produce?

Assess exact sensitive-data categories, declared conditions, recipients and observed safeguards.

Use the exact local files and task-specific inputs listed below. Preparation and review stay in this browser. Inspect all findings before preparing the finalized pack.

What do you need before you start?

• Define the authorized source population and your review rules.
• Keep the unchanged original files and record the snapshot and exclusions.
• Review missing and invalid inputs before preparing the finalized pack.

What information do you enter?

Select the actual local sources and freeze the task-specific inputs below. Keep source files and complete findings private.

• Assessment reference. Stable internal assessment reference.
• Assessment version. Exact current document version.
• Responsible reviewer. Responsible person for evidence review and customer decisions.
• Review date. Your as-of date.
• Approved processing scope. Actual inclusions, exclusions, objectives and uncertainty.
• Scope approval reference. Customer approval for the declared boundary.
• Approved assessment method. Your criteria and decision method version.
• Method source reference. Actual local file containing the approved method or licensed criteria.
• Approved method source locator. Exact source location supporting this method.
• Method approver. Customer-authorized method approver.
• Method approval date. Actual date, no later than the review date.
• Subject population. Selected subjects or your declared complete supplied population.
• Declared subject count. Required only for a declared complete supplied population.
• Sensitive-data condition and safeguard workpaper scope. Readable task-specific rows. Exact linked IDs bind subjects, jurisdiction criteria, source observations and decisions.
• Criteria. Readable task-specific rows. Exact linked IDs bind subjects, jurisdiction criteria, source observations and decisions.
• Answers. Readable task-specific rows. Exact linked IDs bind subjects, jurisdiction criteria, source observations and decisions.
• Flows. Readable task-specific rows. Exact linked IDs bind subjects, jurisdiction criteria, source observations and decisions.
• Alternatives. Readable task-specific rows. Exact linked IDs bind subjects, jurisdiction criteria, source observations and decisions.
• Impacts. Readable task-specific rows. Exact linked IDs bind subjects, jurisdiction criteria, source observations and decisions.
• Measures. Readable task-specific rows. Exact linked IDs bind subjects, jurisdiction criteria, source observations and decisions.
• Decisions. Readable task-specific rows. Exact linked IDs bind subjects, jurisdiction criteria, source observations and decisions.
• Evidence. Readable task-specific rows. Exact linked IDs bind subjects, jurisdiction criteria, source observations and decisions.
• Actions. Readable task-specific rows. Exact linked IDs bind subjects, jurisdiction criteria, source observations and decisions.

What you can download

Every result must identify its supplied facts, assumptions and unresolved items.

Fictional review report (PDF). Editable review (DOCX). Complete fictional pack (ZIP). Requires tailoring and responsible review. Samples use the finalized renderer.

How does the sensitive-data processing assessment work?

1. 1
   Select the actual sources

   Assessment reference. Stable internal assessment reference.

2. 2
   Freeze the review rules

   Match exact declared sensitive categories to actual collection, use, recipients, retention and access. Bind claimed conditions to your criteria and reviewed evidence. Report uncovered categories, inconsistent conditions, unsupported permission and unmitigated impacts. No category classification or lawful processing conclusion is inferred.

3. 3
   Inspect complete findings

   Review all source-linked results and unresolved items. Free JSON and CSV preserve complete results.

4. 4
   Keep recoverable work

   Exact strings and source bytes save locally. Strict restore checks tool identity, supported task rows, source hashes and retained event history before replacing work. Earlier work and a previous checkpoint remain downloadable.

5. 5
   Prepare the finalized pack

   Prepare seven core files and the exact selected attachments, then download them free. Review the fictional sample below.

Method and sources

Apply the steps above to the supported inputs. Use the listed source sections to review the rule basis, assumptions and limits.

• CCPA approved regulations, risk assessments and automated decisionmaking technologySupports this named preparation structure. Your exact legal criteria and substantive decisions remain required. Sections 7002, 7150 through 7156 and 7200 through 7222. Purpose restrictions, assessment content, benefits and negative impacts, safeguards and decision preparation. Effective and compliance dates differ. Your applicability and exact operative versions remain required.California Privacy Protection Agency. Reviewed 2026-10-09.

Common questions

What still needs review?

This preparation preserves your jurisdiction, source versions, criteria, facts and substantive decisions. It does not determine legal applicability, valid consent, a legal basis, statutory deadlines, assessment sufficiency or source authenticity. No risk reduction follows automatically from a listed safeguard. Original files remain unchanged and browser-local. Original files are not saved to the cloud.

At most 500 rows and 200000 characters per table, 20 files, 10 MB each and 25 MB total. Complete input metadata is bounded to 900 KB. Formal reports show explicit bounded previews.

Criteria and permitted-use claims require your exact supplied source versions, reviewed evidence and substantive approval. Jurisdiction grouping does not make one assessment sufficient for another jurisdiction.

Related working records

The related workspace contains working administrative records. Open it for the related administrative task.

Related tools

Browse all privacy and data rights tools.

• DPIA screening questionnaireAssemble facts supporting whether further assessment is required. Try a free example. Review your inputs and result. No account or payment required.
• DPIA drafting assistantDraft a privacy assessment from selected jurisdiction-specific criteria, processing facts, impacts and safeguards. Review scope and approval.
• Legitimate interests assessment assistantStructure purpose, necessity and balancing analysis. Try a free example, then review your inputs and the result. No account or payment required.
• US state data protection assessment packGenerate jurisdiction-specific working records. Try a free example, then review your inputs and the result. No account or payment required.
• Children’s privacy assessmentExamine audience, collection, features and protective controls. Try a free example. Review your inputs and result. No account or payment required.