How to review DPIA and LIA workflows end to end: intake triggers, triage, ownership, approvals and evidence that stand up to regulatory scrutiny.
Topics: Privacy Assessments, DPIA, LIA, Privacy Governance, Compliance
A privacy assessment workflow review is not a documentation exercise. It is a test of whether the organisation can identify a material change, involve the right people, reach a defensible decision and retain evidence that the decision was followed. When that chain breaks, a completed DPIA or LIA provides limited assurance.
For privacy, legal, risk and security leaders, the challenge is rarely the absence of assessment templates. It is the operational gap between a template being sent and governance being exercised. New products progress before privacy is engaged. Supplier details are held in procurement systems but never reach the assessment owner. Mitigations are agreed in meetings, then disappear from view. A useful review exposes these points of failure and creates a controlled workflow that works across jurisdictions, teams and delivery models.
What a privacy assessment workflow review should examine
A workflow review should follow the actual path of change through the business, rather than the process described in a policy. Start with the events that should trigger an assessment: a new processing activity, a change in data use, a high-risk supplier, international transfers, new monitoring technology or an AI system entering development or use. Then establish what happens next, who owns each decision and where the supporting evidence sits.
This review should cover both DPIA and Data Protection Impact Assessment workflows, alongside Legitimate Interest Assessments where legitimate interests are relied upon. These assessments serve different legal purposes, but they depend on the same operational disciplines: clear intake, consistent triage, accountable review, recorded approvals and follow-up actions.
The most revealing question is simple: can the organisation show why an assessment was or was not required for a specific activity? If the answer relies on individual recollection, scattered email threads or an outdated spreadsheet, the process is not yet controlled.
Start with intake, not the questionnaire
Many programmes concentrate on the assessment form itself. That is too late. The workflow begins when a business team proposes a project, procures a service, changes a system or introduces an AI capability. A review should test whether intake is embedded in the places where those decisions are made.
For example, procurement may identify a vendor processing customer data, while product teams may introduce profiling features through an existing platform. If neither route creates a visible privacy intake, the privacy team is left to discover material changes after implementation. The result is reactive assessment work, incomplete context and avoidable delay.
A mature intake process captures enough information to triage without forcing business owners through a lengthy legal questionnaire at the outset. It should identify the purpose, categories of personal data, affected individuals, geographic scope, suppliers, data transfers, use of special category data and whether AI is involved. The privacy team can then route the activity to the appropriate workflow: DPIA, LIA, vendor or third-party risk assessment, contract review, ROPA update, or a combination of these.
Test ownership at every decision point
An assessment workflow becomes unreliable when responsibility is collective. Privacy teams may coordinate the work, but they should not become the assumed owners of every factual statement, risk control and remediation action.
A practical review maps accountable roles across the lifecycle. The business owner confirms purpose and necessity. Security validates technical and organisational measures. Procurement or vendor management provides supplier due diligence. Legal assesses the legal basis, contractual terms and transfer position. Privacy determines the assessment route, challenges assumptions and records the outcome. Senior decision-makers accept residual risk where escalation is required.
The right model depends on organisational size and structure. A lean team may combine several roles, while an enterprise may need formal approval gates. The non-negotiable requirement is that each action has a named owner, a due date and a recorded status. “With the project team” is not an ownership model.
This is particularly relevant for mitigation actions. An assessment may identify a need to minimise fields collected, amend a processor agreement, restrict access rights or complete a transfer assessment. If those actions are not assigned and tracked beyond the assessment record, the organisation has identified risk without managing it.
Review the quality of triage decisions
Not every processing activity needs a full DPIA. Treating every change as high risk creates bottlenecks and reduces the quality of review. Equally, informal triage without documented reasoning creates inconsistency and leaves the organisation unable to explain why a DPIA was not completed.
A controlled workflow uses defined criteria to distinguish low-risk changes from activities requiring deeper analysis. The criteria should reflect the jurisdictions in scope and the organisation's risk profile. They should also be specific enough to identify common risk indicators, such as large-scale processing, vulnerable individuals, systematic monitoring, special category data, novel technology, automated decisions or significant data sharing.
The review should sample closed cases from different business functions. Look for consistent outcomes where similar processing is involved. Where decisions differ, determine whether the distinction is justified or whether the process depends too heavily on the individual reviewer. Consistency does not mean identical conclusions in every case. It means decisions are supported by comparable evidence and a repeatable rationale.
Bring AI governance into the same operating model
AI projects frequently expose weak assessment workflows because the data, suppliers, development teams and deployment context can all change quickly. A privacy assessment should not operate separately from AI governance, particularly where personal data is used for training, testing, monitoring or automated decision-making.
The workflow should connect the assessment to an AI system registry and EU AI Act risk classification. That connection enables teams to see whether the same system has a documented purpose, accountable owner, supplier record, data sources, risk classification and required controls. It also prevents duplicate evidence collection across privacy, security, legal and AI governance reviews.
The level of review depends on the use case. An internal productivity tool may need a focused supplier and data-use assessment, while an AI system that influences employment, access to services or other significant outcomes may require a much more detailed evaluation. The workflow should support proportionate governance without allowing speed of deployment to bypass accountability.
Evidence must be usable, not merely retained
A completed assessment is only one part of the evidence trail. A review should verify that supporting materials are attached or referenced in a controlled system: data flow details, processor information, security assurances, transfer mechanisms, consultation records, approvals and closure evidence for mitigation actions.
This matters during internal audit, customer due diligence, regulatory engagement and incident response. When a breach occurs, teams need to establish what processing was approved, which data was involved, what controls were expected and whether risks had already been identified. A disconnected folder structure makes that reconstruction slow and uncertain.
The assessment workflow should also connect to the Records of Processing Activities. If the DPIA identifies a new purpose, data category, retention period, third party or international transfer, the ROPA should be updated as part of the same process. Separate registers maintained by separate teams create predictable drift.
Privacy360 supports this model by placing DPIAs, LIAs, ROPA records, vendor reviews, contract review and DPA redlining, breach and incident management, DSAR workflows and AI system oversight in one operational environment. The objective is not to centralise paperwork for its own sake. It is to ensure that a decision made in one governance workflow is visible and usable in another.
Measure whether the workflow is improving control
Cycle time is useful, but it is not enough. A fast assessment process that misses high-risk changes is less valuable than a slightly slower process with reliable intake and clear decisions. Review metrics should therefore balance efficiency with control.
Useful indicators include the proportion of new initiatives assessed before go-live, time from intake to triage, overdue mitigation actions, assessments reopened after material change, ROPA updates completed through the workflow and the percentage of AI systems linked to a current privacy assessment. Trends matter more than a single reporting period. A rising volume of late assessments, for example, may indicate that intake is not connected to product, procurement or change-management processes.
Metrics should lead to operational changes. If supplier assessments stall because security questionnaires arrive too late, adjust the procurement gate. If business owners repeatedly submit incomplete information, simplify the intake form and provide clearer prompts. If one region applies different triage criteria, establish a common decision framework while allowing for local legal requirements.
Make review a recurring control
A privacy assessment is not permanently valid because it was approved once. Processing changes, suppliers change, data volumes increase and AI features are repurposed. The workflow should therefore include review triggers, not just an arbitrary annual refresh date.
Changes in purpose, categories of data, recipients, transfers, retention, technology, scale or risk should prompt reconsideration. So should material security incidents, supplier changes and new uses of AI. A scheduled review remains helpful for high-risk or long-running processing, but event-based review is what keeps records aligned with operations.
The strongest privacy assessment workflow is one that business teams can use without losing momentum and governance teams can defend without reconstructing the past. Build it around real decision points, named accountability and connected evidence. That gives the organisation a practical control system for change, rather than a collection of completed forms.