Upon purchasing 9ine’s Privacy Platform or Vendor Platform and its associated features, users can be granted access to Vendor and Processing Operation Assessments. Your organisation’s administrator(s) have the option to allocate permission via  User Management (previously referred to as People) available to administrators in the header.

 Vendor: Granting access to this feature allows users to create new vendors and processing operation assessments but does not automatically grant access to all existing vendors. Users need to be assigned as owners, members, notified users, or attachment reviewers of specific vendors to gain edit access to those areas and their associated processing operation assessments. A vendor’s permissions include:

• Owner
• Member
• Notified User
• Attachment Reviewer

Processing Operation Assessment: Similarly, access to this feature does not automatically grant rights to view or edit all processing activities. Users must be specifically added as owners, members, reviewers, approvers, attachment reviewers, or notified users for individual assessments to gain edit permissions. A processing operation assessment’s permissions include:

• Owner
• Member
• Reviewers
• Approvers
• Attachment reviewers
• Notified users 

In addition, any owners, members, notified users, or attachment reviewers of any risks, issues, lessons or tasks are also granted edit access to the processing operation assessment but they do not gain access to the vendor and the other assessments associated with the vendor. 

There can only be a single owner of a vendor and processing operation assessment, but there are no limits to the number of members or notified users. Each attachment and processing operation assessment can also have one reviewer, approver and attachment reviewer. Owners can edit and delete their assigned items, while all other roles have edit rights but cannot delete. When more than two members or notified users are added, the additional user details are combined into a single pill, which can be clicked to view further details. These pills are alphabetically ordered.

Begin by clicking New Vendor, to get started. You will then be presented with a popup which displays four fields:

• Select Application
• Legal name
• Trading name
• Address 
• Zip/Post Code/PO box
• Country (Headquarters)
• Country (where processing will take place)
• Owner
• Member(s)
• Notified user(s)
• Link RoP
• Link RoPA
• Link DPIA
• Vendor Code
• Next Review Date

• A contact(s) table Add Details
  • Type
  • First Name
  • Last Name
  • Role
  • Contact Information

Two of the fourteen fields are mandatory when creating a new vendor including: legal name and owner.

On entering the required fields, you have three options:

• Save & Exit: Saves the information, creates the vendor, and returns you to the vendor log.
• Save & Create POA: Saves the information, creates the vendor, and opens a new popup with five additional fields (detailed below).

Save & Create POA

On clicking Save & Create POA you are presented with five further fields which include the title of processing operation assessment, owner, member(s), department(s), and next review date. You then have the option to:

• Save & Exit: which saves the processing activity and navigates you back to the vendor log.
• Save & Add Details which saves the processing operation assessment and navigates you into the full form assessment.
• Save & Create another POA: which saves the processing operation assessment but allows you to create another associated with the vendor.

When creating a new processing operation assessment from scratch or via the Quickstart workflow or editing an existing activity, you will be navigated to the form and presented with six headers, including:

• Processing Operation Description
• Processing Compliance
• Safeguarding
• Security And Systems
• Assessment Summary
• Review & Approval

To efficiently move through the six steps, you can use the clickable navigation tabs when there are no unsaved changes on the form. However, after making changes, you must navigate using the primary buttons located at the bottom of the page.

The title of the processing activity is consistently displayed at the top of the form, and to the right, a unique reference number is provided. This number is prefixed with POA and followed by a unique identifier that cannot be edited. 

Processing responsibilities such as the controller, joint controller, data processor or any other external party will be identified during the discovery phase of populating your organisation’s processing operation assessments.

The Processing Operation Description step allows you to capture if the personal data is transferred to another country. 

Transferring personal data to another country may introduce additional risks, as many countries have specific regulations governing cross-border data transfers. Data transfer to another jurisdiction can occur in various ways, such as when information is emailed, stored on cloud servers located overseas, or accessed from another country. These actions may expose data to differing levels of protection based on the destination country’s laws, making it essential to assess and mitigate associated risks carefully.

In the Processing Compliance step, selecting an option—N/A, Yes, No, or Don’t Know—activates an additional information field where you can provide further details. This feature allows for enhanced clarity and context around your selection, supporting a more comprehensive assessment.

On the Safeguarding step you are initially presented with a single question. 

On selecting Yes, additional questions are presented.

Similar to the previous step, selecting an option— Yes, No, or Don’t Know—activates an additional information field where you can provide further details.

In the Security and Systems step, you will begin with a single question. If you select Yes or Don’t Know, additional questions will appear to gather more detailed information. This step is best completed in collaboration with your IT team to ensure thorough and accurate responses, as it involves technical aspects of systems and security that require IT expertise.

In both the new and edit workflows for a vendor or processing operation assessment, you have the option to upload a custom logo. Once added, you can either reset it to the default 9ine Platform logo or replace it with a new image at any time, providing flexibility in representing each vendor or assessment visually.

When creating a new vendor or processing operation assessment, or editing an existing one, the details entered are added to the respective log. Each vendor and processing operation assessment  are automatically assigned a unique reference number (starting with VEN and POA) that cannot be edited.

To see only the vendors you are responsible for, use the My Vendors toggle in the top right corner of the Vendor log. This filter will display items where you are listed as the owner, member, or notified user. Please note that this feature is unavailable on the Processing Operation Assessment (POA) log when in the Vendor Details view but becomes accessible when you switch to the Processing Operation Assessment (POA) log view. Here you will have the option to enable My POAs.

In the Vendor Log, you can toggle between the following layouts:

• Vendor Assessment (VA) layout
• Processing Operation Assessment (POA) layout

Any changes made to the and POA layout are specific to each user and log, applying only to your profile. 

When accessing data through any of the three available logs, you will find common functionality is consistently available across them.

Default sorting is applied to the Ref No., which can be altered by clicking on the title of any other column. Clicking a column header once sorts the log by the selected column, and clicking it a second time reverses the order.

To remove individual columns, click View and deselect the columns you do not want to display, whilst retaining a minimum of one column. After selecting your preferred columns, click Apply. You also have the option to Save View.

You can also change the sequence order of the columns by dragging and dropping them into your preferred order. Any changes are automatically saved and retained on the next login. 

To focus on a specific vendor or processing operation assessment, you can use the Filter or Search functions. When a filter is active, an orange icon appears next to the filter icon for easy recognition. 

• To quickly clear any filters, click the Clear Filters button in the popup. 
• You can also apply a temporary filter without clicking Save Filter.
• To revert back to your saved filter, click Reset.
• Similarly, you can select data points and click Apply without saving your filter options.

To bulk manage Vendors or POAs, select one or more checkboxes located on the far-left side of the relevant log. Once one or more vendors are selected, the Manage Vendors button will appear above the log. Similarly, when POAs are selected, the Manage button will become available. Clicking the Manage Vendors button provides four options: manage, duplicate, close, and delete. Choosing manage allows you to bulk modify the owner, members, and next review date of the selected vendors.

Clicking the Manage button for POAs provides additional sub-options. Users are able to manage the POA along with its associated risks, issues, lessons, and tasks. Individual associated items can also be managed separately. Choosing manage allows you to bulk modify the owner, members, and next review date of the selected POAs. It also includes a Copy to all tabs feature, which enables users to apply the same data values across all associated items. Users may also manage associated items, allowing them to update the owner, members, status, and next review date (or due date for tasks). In addition, users may duplicate, close, or delete a POA or its individual associated items.

Users may select individual Vendors or POAs, or select all records on a page by ticking the checkbox in the column header. For the selection of Vendors or POAs, provide options as:

• Current Page: selects all records on the page you are viewing.
• All Pages: selects all records that match the current filters across all pages, excluding Closed records.
• Clear Selection: removes all current selections

The vendor log provides a range of quick-access functions within the menu options, including:

• Create POA
  This allows you to directly create a new processing operation assessment associated with the vendor.
• Add Note
  Opens the vendor details page directly on the Additional Notes feature. 
• Add Member(s)
  Opens a members popup to quickly grant users access to the vendor.
• Link RoP
  Opens the link popup, allowing you to select a record of processing area.
• Link RoPA
  Opens the link popup, allowing you to select a record of processing activity.
• Link DPIA
  Opens the link popup, allowing you to select a data protection impact assessment.
• Duplicate
  Duplicates the vendor, you can choose to add the Copy of prefix to the Vendor title and its child items, or duplicate it without the prefix. Additional Notes and Attachments will also be duplicated. Logged time and costs associated with child items will not be copied. Child items will not receive the Copy of prefix unless the Prefix All Items button is selected.
• Revisions
  Opens the vendor revisions popup detailing the user name, date, and time of the last revision.
• Close
  Marks a vendor and all its associated processing operation assessments, risks, issues, lessons, and tasks as closed, removing all items from their respective logs.
• Reopen
  Marks a closed vendor as open and restores all associated items. Related activities are returned to open status. Associated tasks are returned to not started, while linked risks, issues, and lessons are returned to open status.
• Delete
  Marks a vendor and all its associated processing operation assessments, risks, issues, lessons, and tasks as deleted, effectively removing them from the 9ine Platform.

The processing operation assessment logs (via the switch layout feature on the vendor log or on the vendor details page) provides a range of quick-access functions within the menu options, including:

• Add Note 
  Opens the processing operation assessment form directly on the Additional Notes feature. 
• Add Member(s)
  Opens a members popup to quickly grant users access to the processing activity.
• Add Reviewer(s)
  Opens a reviewers popup to quickly grant users access to the processing operation assessment. 
• Add Approver 
  Opens an approver popup to quickly grant users access to the processing operation assessment. 
• Duplicate
  Duplicates the processing operation assessment, you can choose to add the Copy of prefix to the POA title and its child items, or duplicate it without the prefix. Additional Notes and Attachments will also be duplicated. Logged time and costs associated with child items will not be copied. Child items will not receive the Copy of prefix unless the Prefix All Items button is selected.
• Download
  Downloads the processing operation assessment form in a DOCX format.
• Publish Application
  Users can create an application by selecting the Publish Application option from the three-dot menu in POA. While creating the application, the Vendor and POA fields are pre-selected.
• Close
  Marks a processing operation assessment and all its associated risks, issues, lessons, and tasks as closed, removing all items from their respective logs.
• Reopen
  Marks a closed processing assessment, open, and restores all associated items. Related tasks are returned to not started, while associated risks, issues, and lessons are returned to open status.
• Delete
  To delete, navigate to Vendor Details and click the quick menu option and select Delete. On selecting Delete, it marks a processing operation assessment and all its associated risks, issues, lessons, and tasks as deleted, effectively removing them from the 9ine Platform.