A Processing Operation Assessment (POA) records and assesses how a Vendor processes personal data.

Each Vendor can have multiple Processing Operation Assessments (POAs), with each POA relating to a specific processing activity. A POA always belongs to a single Vendor.

Access to Vendors and Processing Operation Assessments (POAs) is permission-based.

Having access to the Vendor Platform allows you to create Vendors and POAs, but you can only access records you have been assigned to.

The available roles are:

• Vendor: Owner, Members, Notified Users and Attachment Reviewer.
• Processing Operation Assessment (POA): Owner, Members, Notified Users, Attachment Reviewer, Reviewers and Approver.

The Owner can edit and delete the record. All other assigned users can edit the record but cannot delete it.

If a Vendor is linked to a Data Protection Impact Assessment (DPIA), Record of Processing (RoP) or Record of Processing Activity (RoPA), users with permission to access the linked record can also access the Vendor and its associated POAs.

If you require access to a record, contact your organisation's 9ine Platform administrator.

Yes. Vendor Assessment and Processing Operation Assessments (POAs) are available as part of the 9ine Privacy Platform and 9ine Vendor Platform.

If you cannot access these features, your organisation may not have the required licence or you may not have permission to use them. Contact your organisation's 9ine Platform administrator for assistance.

Only two fields are mandatory:

• Legal Name
• Owner

All other information, such as trading name, address, contacts, review date and linked records, is optional and can be added later.

A Processing Operation Assessment (POA) is completed across six steps:

• Processing Operation Description
• Processing Compliance
• Safeguarding
• Security and Systems
• Assessment Summary
• Review & Approval

You must save your answers as you progress between steps, and you can return to any step at any time.

The Review & Approval step is used to assign one or more Reviewers and an Approver. Each assignment records a status of Open or Closed.

A Processing Operation Assessment (POA) does not have a Submit action. The review and approval process is complete when all required review and approval statuses have been set to Closed.

Each change is recorded as a revision, providing a complete history of the review and approval process.

Closing a Vendor or Processing Operation Assessment (POA) makes the inactive and removes it from your logs. Associated Risks, Issues, Lessons and Tasks are also closed, but nothing is deleted.

You can reopen the Vendor or POA at any time. Once reopened, users with edit permission can continue making changes.

Vendors and POAs use two statuses only: Open and Closed.

No. Vendors and Processing Operation Assessments (POAs) do not send scheduled review reminders. This feature will be developed in the near future.

Instead, you receive an in-Platform notification when a review date is first added and again whenever it is changed.

Keeping the Next Review Date up to date helps you manage when assessments should be reviewed.

Yes.

A Vendor can be linked to:

• Data Protection Impact Assessments (DPIAs)
• Records of Processing (RoPs)
• Records of Processing Activities (RoPAs)
• An Application

A Processing Operation Assessment (POA) can be linked to:

• Risks
• Issues
• Tasks
• Lessons
• An Application

Some linking options require the relevant platform licence and appropriate user permissions. If an option is unavailable, contact your organisation's 9ine Platform Administrator.

To export your data, select Download from the Vendor or Processing Operation Assessment (POA) log.

You can export:

• A basic Excel report
• An advanced Excel report
• a Word document for an individual Processing Operation Assessment (POA)

The export is generated in the background, allowing you to continue working. You will receive both an in-Platform notification and an email when it is ready.

The exported file reflects the filters currently applied to the log, so apply any required filters before requesting the export.

Yes. Vendor and Processing Operation Assessment (POA) names do not have to be unique, so duplicate names are permitted.

This allows you to duplicate existing records and create similar assessments without first changing the original name.

The Submit action is available only if your organisation has the required Vendor Platform licence.

When you submit a Vendor, a request is sent to the 9ine Privacy and Support team for review. The Vendor remains editable while the assessment is in progress.

If you do not see the Submit option, contact your Primary Account Administrator (PAA) to confirm your organisation's licence.

Creating a new Vendor, duplicating a record and creating a Processing Operation Assessment (POA) are available only while your organisation's licence is active and within its allocated limits.

Linking a Vendor to a Data Protection Impact Assessment (DPIA), Record of Processing (RoP), Record of Processing Activity (RoPA) or publishing to the Application Library also requires the relevant platform licence and the appropriate user permissions.

If an option is unavailable, contact your organisation's 9ine Platform administrator.

A Transfer Impact Assessment (TIA) is completed when personal data is transferred to another country.
A separate assessment is completed for each destination country, recording:

• The transfer mechanism
• The safeguards in place
• Whether the destination country provides an adequate level of legal protection
• Any human rights considerations

This information helps you assess and manage the risks associated with transferring personal data internationally.

The Assessment Summary step is used to summarise the processing activities and record the overall risk assessment for the Processing Operation Assessment (POA).
From this step, you can also create associated:

• Risks
• Issues
• Lessons
• Tasks

This helps ensure any actions arising from the assessment are managed alongside the assessment itself.

The Review & Approval step is used to complete the review and approval process for a Processing Operation Assessment (POA).

Assign one or more reviewers and an approver. Each person records their review or approval status.

Review and approval use two statuses only:

• Open
• Closed

A Processing Operation Assessment (POA) does not have a Submit action. The review and approval process is complete when all required review and approval statuses have been set to Closed.

Whenever a reviewer, approver, status or review date is changed, the affected users receive an email and in-Platform notification, and a new revision is recorded.

You can view the history of every review and approval cycle from the POA's Revisions.

Vendors and Processing Operation Assessments (POAs) use two statuses:

• Open
• Closed

A Closed record is inaccessible. To make changes, the record must first be reopened to Open. Only users with permission to edit the record can then make changes.