¶ Getting started with Privacy in Diri: how everything connects
This guide helps you get started with privacy management and GDPR compliance in Diri. Diri comes with predefined content in several areas, and this guide shows how to make use of it and how the privacy features connect.
What you can see and change depends on your role. The User Privacy role can create and edit processing activities, Pre-DPIAs, DPIAs and treatment plans. Auditors can read them. See Role-based access control.
Go to Tasks. Here you will find ready-made privacy tasks designed to help your organisation comply with GDPR and good practice.
Each task has a clear name and a short description of what needs to be done.
Tasks are connected to relevant policies, routines, IT systems, vendors, risk assessments and documentation, so when you open a task you have the context and supporting material you need.
Processing activities: each processing activity links to the IT systems, vendors (data processors) and treatments involved. Vendors you add show their security assessment result, so you can see which processors have been assessed.
Pre-DPIA and DPIA: you start a Pre-DPIA directly from a processing activity. If a DPIA is needed, you continue straight into it, and Diri suggests answers for the DPIA from the processing activity.
Personal data flow: Diri checks your processing activities against the data flows mapped between your IT systems and points out systems or transfers the record does not mention. See Data processing activities.
Treatments: measures you plan in a DPIA go into its treatment plan and are followed up with the rest of your treatments. See Treatments.
Signing and review: a finished DPIA is signed by the responsible person and reviewed regularly. See Signing and review. DPIA reviews also appear in the Annual wheel.
Policies: templates for privacy policies, procedures and routines. See Policies.
Incidents: register, analyse and treat incidents, including personal data breaches. See Incidents.
Frameworks: GDPR is available in the framework library, so you can follow up GDPR requirements as controls. See Frameworks.
Start by mapping your processing activities and publishing privacy notices.
Run a Pre-DPIA for each processing activity, and a DPIA where it is needed.
Establish routines for handling data subject rights (access, rectification, erasure, portability).
Review and update privacy documentation and risk assessments regularly.
Use the dashboards to monitor compliance status and outstanding actions.
Tip: because the privacy features are connected, everything you document is traceable: from the processing activity, through the Pre-DPIA and DPIA, to the treatments and the signature.