FormData Protection Impact Assessment Atlas by Cultural InfusionYou should start to fill out the template at the start of any major project involving the use of personal data, or if you are making a significant change to an existing process. The final outcomes should be integrated back into your project plan.Customer Name(Required)Created Date(Required) DD slash MM slash YYYY ProjectName of Controller(Required)Cultural Infusion DPO(Required)Name of Controller Contact/DPO(Required)IntroductionThe need for a DPIA Atlas is a SaaS (software as a service) survey tool curated by Cultural Infusion and delivered to the customer who will act as controllers for the purposes of the survey. Atlas provides intersectional cultural and demographic data analysis. These insights are used to promote inclusion, celebrate diversity and other objectives as outlined in the Atlas Code of Conduct. The platform features an interactive dashboard including charts, tables and graphs, some of which is exportable. As much of the data could be considered ‘personal’, a DPIA is required. The ProcessingAtlas is a platform only. The controller will collect the data from the data subjects, via the survey tool. The controller will then use this data to map the diversity of their participants and subsequently stage their own analysis of the results. The controller can delete the gathered data at any time. The controller owns the data. The customer (controller) should not share or on-sell the data according to our own Code of Conduct, Client Obligations and their own matching documents. Cultural Infusion can delete the customer’s account at any time. Cultural Infusion can provide access logs at any time.The information will be stored on Atlas server located(Required)The Scope of ProcessingWill data subjects be asked about their criminal history? Yes Not to our knowledge **If yes, this may be illegal. Atlas to investigateWill children under the age of 16 be surveyed? Yes Not to our knowledge **If yes, this may be illegal. Atlas to investigateThe specific licensing agreement made between Cultural Infusion and(Required)Contract Start Date MM slash DD slash YYYY Contract ValueParticipantsThe information surveyed is the following: Country of birth going back 3 generations Countries of citizenship Language proficiency Cultural Heritage Religion and worldview Age Gender Education Disability Position type and position level Physical Appearance Sexual orientation Select AllExtra comments:Cultural Infusion does not have a direct relationship with the data subjects as this is the responsibility and domain of the controller. Data subjects have the option not to answer the survey, or to skip answering any or all questions. Data subjects have the option to complete the survey in ‘anonymous’ mode. The data subjects retain all rights to data protection as stipulated by the corresponding statutory authority. If a data subject chooses to enter their names at the commencement of the survey, they have the right to request deletion of the data at any time henceforth. Even if a data subject chooses to enter their name, no one will be able to know their individual survey responses. If a data subject chooses to complete the survey as ‘anonymous’ they will have an option to delete their own data, so long as they make a record of their unique data key. The PurposeThe greater purpose of Atlas platform is to map diversity within any organisation or group in order to reveal hidden diversity. Knowledge pertaining to an organisation’s diversity is expected to lead to policies, procedures or programs that inspire greater inclusion, harmony, staff retention, creativity, productivity and knowledge for its own sake, as outlined in our Code of Conduct. The customer, by way of studying our product throughout the sales process and within our Client Obligations document are by implication in congruence with this purpose. Consultation ProcessThroughout the sales and consultation process, matters of data security have been discussed and acted upon with the controller. Security measures already in place will be constantly monitored and improved over time. Necessity and ProportionalityThis product is fully compliant with the Australian Privacy Act and adheres to the data protection laws of any country, state and jurisdiction in which we deliver it, including (but not limited to) GDPR (EU). Our Code of Conduct clearly stipulates that our customer cannot and will not on-sell or re-use the data beyond the scope and purpose of the product. This also applies to Cultural Infusion. From rigorous testing (under ongoing review) we believe that the charts (as displayed on the product’s dashboard) are an accurate representation of the unsanitised data. We do not verify the inputs. The data is encrypted whilst in transit at all times, and pseudonymisation has been mitigated to the best of our abilities. Specific Project Risks - Potential SolutionsPotential Risk 1Solution to Potential Risk 1Potential Risk 2Solution to Potential Risk 2Potential Risk 3Solution to Potential Risk 3Potential Risk 4Solution to Potential Risk 4Potential Risk 5Solution to Potential Risk 5Potential Risk 6Solution to Potential Risk 6Sign off and Record OutcomesMeasures approved by:Residual Risks approved by:DPO advice provided:Summary of DPO Advice
