# DPIA QA MATRIX ## Review Basis The supplied review basis consists of the **10 DPIA documentary criteria** expressly provided in the request. No external legal checklist or additional legal requirements have been introduced. ## Supplied-Material Inventory **Substantively supplied:** * DPIA narrative describing the proposed employee productivity platform; * Project / processing description; * Ten-item DPIA review criteria. **Referenced but not substantively supplied:** * internal processing description; * draft data-retention schedule; * access-control design summary; * employee communication draft; * system architecture overview; * risk workshop notes. Because the contents of those documents are not included, they are not treated as evidence. | Review Area | Criterion / Requirement | Expected Documentation / Evidence | Status | Evidence Found | Source Reference | Gap / Issue | Conflict / Inconsistency | Information Needed | Human Review Note | | --------------------------- | ------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Nature / Purpose / Scope | 1. Nature, purpose, and scope of the processing | Documentation describing the processing activity, purpose, population, geographic scope, and overall processing scope | **PRESENT** | Proposed employee productivity platform; approximately 2,400 employees; European and Asia-Pacific offices; application usage, login activity, work-session duration, and selected productivity indicators | DPIA; Project / Processing Description. Exact page/section reference not supplied | No material documentary gap identified in the supplied description | None identified | None apparent from supplied materials | No legal conclusion is made about necessity, proportionality, or permissibility of the scope | | Data / Individuals | 2. Categories of personal data and affected individuals | Identification of personal-data categories and affected individuals | **PRESENT** | Application usage, login activity, work-session duration, productivity indicators; affected population identified as approximately 2,400 employees | DPIA. Exact page/section reference not supplied | The supplied description identifies the principal categories, but does not provide further granularity beyond the stated categories | None identified | Further category detail may be needed if contained in the missing supporting documentation | Human review may be appropriate to confirm whether the supplied category description matches the implementation materials | | Activities / Access | 3. Relevant processing activities and intended access | Processing operations and who can access which information, including access level/purpose | **PRESENT** | Platform records and analyzes activity data; managers receive aggregated team-level dashboards; designated HR personnel may access individual-level information for defined workplace-management purposes | DPIA. Exact page/section reference not supplied | Individual HR access purposes are described only at a high level; the supplied access-control design is referenced but not substantively provided | No direct contradiction identified | Detailed access roles, permissions, and access-purpose mapping from the access-control design summary | Professional review may be needed to compare the documented access model with the actual proposed design | | Necessity / Proportionality | 4. Necessity/proportionality rationale as documented in the DPIA | Explicit rationale addressing why the processing is documented as necessary/proportionate within the DPIA | **MISSING** | Purpose and processing scope are described, but no explicit necessity/proportionality rationale is included in the supplied text | DPIA. Exact page/section reference not supplied | A stated business/processing purpose is present, but the requested necessity/proportionality rationale is not identified | None identified | Documentary rationale addressing necessity and proportionality | This flags a documentation gap only; no independent legal assessment is made | | Risks | 5. Identified privacy and data-protection risks | Documented risk analysis identifying relevant risks arising from the processing | **PRESENT** | Risks expressly identified include employee monitoring, access misuse, inaccurate interpretation of productivity indicators, and potential impacts on employee privacy | DPIA risk section. Exact page/section reference not supplied | Risk topics are identified, but the depth and evidentiary basis of the analysis are addressed separately below | None identified | More detailed risk-analysis material if contained in risk workshop or other supporting documents | No conclusion is made about the legal severity of the identified risks | | Risk Evidence | 6. Supporting evidence for material risk statements | Supporting evidence, analysis, or source material substantiating material risk statements | **MISSING** | Risk categories are stated, but no supporting evidence, source references, assessment records, or risk-workshop outputs are substantively supplied | DPIA risk section; referenced risk workshop notes were not supplied | The supplied materials identify risks without providing documentary support for the material risk statements | None identified from available materials | Risk workshop notes, underlying assessments, source records, or other documented support for the stated risk analysis | Human review is needed to determine whether the underlying risk analysis is adequately evidenced | | Mitigation | 7. Documented mitigation measures | Clear documentation of measures intended to address identified risks | **PRESENT** | Role-based access; limited retention; employee transparency measures; restrictions on manager access | DPIA mitigation section. Exact page/section reference not supplied | Measures are identified, but several are described only at a high level | None identified | More detailed implementation descriptions where available | No determination is made as to whether the measures are legally or operationally sufficient | | Safeguard Evidence | 8. Supporting evidence for key safeguards | Documentary evidence demonstrating or describing the key safeguards, such as access-control design or implementation specifications | **PARTIAL** | DPIA states that role-based access, retention limits, transparency measures, and manager-access restrictions are mitigation measures; prompt itself states that supporting evidence for certain safeguards may be incomplete | DPIA mitigation section; access-control design and other supporting documents are referenced but not substantively supplied | Safeguards are documented at a high level, but supporting evidence for certain safeguards is not available in the supplied materials | None identified | Access-control design, implementation specifications, configuration evidence, employee communication draft, or other supporting safeguard documentation | Human review may be needed to reconcile the DPIA safeguard descriptions with implementation documentation | | Retention | 9. Retention information | Retention periods or documented retention approach supporting the processing description | **PARTIAL** | DPIA states that a limited-retention approach is proposed | DPIA retention / safeguards description. Exact page/section reference not supplied | A retention approach is described, but no specific retention period, event triggering deletion, or detailed retention schedule is provided in the supplied material | None identified | Draft data-retention schedule and any supporting implementation detail | Professional review may be needed to compare the DPIA statement with the actual retention schedule | | Consistency / Conflicts | 10. Unresolved inconsistencies between the DPIA and supporting materials | Cross-document comparison between DPIA and substantive supporting materials | **NOT ASSESSABLE** | The DPIA contains the stated processing, access, retention, risks, and safeguards, but the substantive contents of the referenced internal processing description, retention schedule, access-control design, and other optional documents are not supplied | DPIA; Project / Processing Description; supporting documents referenced but not supplied | A cross-document consistency assessment cannot be completed from the supplied content | No contradiction can be established from the available materials | Actual contents of the referenced supporting documents are required for comparison | Human review should address any discrepancies once the supporting materials are available | # DOCUMENTARY REVIEW SUMMARY ### Documented areas The supplied DPIA documents the **nature, purpose, and scope of the processing**, the **categories of data and affected employees**, the **processing activities and intended access**, the **identified privacy/data-protection risks**, and the **proposed mitigation measures**. ### Partial areas The documentation is **partial** regarding **supporting evidence for key safeguards** and **retention information**. The safeguards are described, but supporting implementation evidence is not substantively supplied. Retention is described as limited, but a specific retention schedule is not included in the supplied material. ### Missing areas An explicit **necessity/proportionality rationale** was not identified in the supplied DPIA material. Supporting documentary evidence for the stated material risk analysis was also not identified. ### Unclear areas The supplied material does not provide enough detail to establish the precise scope of individual HR access, the detailed implementation of safeguards, or the operational retention parameters. These are documentary-detail issues rather than independent legal conclusions. ### Conflicting areas **No conflict was established from the supplied materials.** The absence of the referenced supporting documents prevents a meaningful cross-document conflict check. ### Unresolved issues The principal unresolved documentary issues are: * absence of an identified necessity/proportionality rationale; * absence of supporting evidence for the material risk statements; * incomplete supporting evidence for key safeguards; * lack of detailed retention information; * inability to perform a full consistency comparison against the referenced supporting documents. ### Limitations The review is limited because the substantive contents of the **internal processing description, draft data-retention schedule, access-control design summary, employee communication draft, system architecture overview, and risk workshop notes** were not supplied. Accordingly, criterion 10 is **NOT ASSESSABLE**, and several supporting-evidence questions can only be assessed from the DPIA narrative itself. **Validation:** All ten supplied review criteria were considered; documentary statuses were assigned using the specified vocabulary; no source locations were invented; unavailable supporting materials were not treated as evidence; no conflicts were silently resolved; and no legal-compliance, high-risk, approval, or other legal determination has been made.