Diversity Atlas by Cultural Infusion

You should start to fill out the template at the start of any major project involving the use of personal data, or if you are making a significant change to an existing process. The final outcomes should be integrated back into your project plan.

Customer Name*

Created Date*

Project

Name of Controller*

Cultural Infusion DPO*

Name of Controller Contact/DPO*

Introduction

The need for a DPIA

Diversity Atlas is a SaaS (software as a service) survey tool curated by Cultural Infusion and delivered to the customer who will act as controllers for the purposes of the survey.
Diversity Atlas provides intersectional cultural and demographic data analysis. These insights are used to promote inclusion, celebrate diversity and other objectives as outlined in the Diversity Atlas Code of Conduct.
The platform features an interactive dashboard including charts, tables and graphs, some of which is exportable.
As much of the data could be considered ‘personal’, a DPIA is required.

The Processing

Diversity Atlas is a platform only.

The controller will collect the data from the data subjects, via the survey tool.
The controller will then use this data to map the diversity of their participants and subsequently stage their own analysis of the results.
The controller can delete the gathered data at any time. The controller owns the data.
The customer (controller) should not share or on-sell the data according to our own Code of Conduct, Client Obligations and their own matching documents.
Cultural Infusion can delete the customer’s account at any time.
Cultural Infusion can provide access logs at any time.

The information will be stored on the Diversity Atlas server located*

The Scope of Processing

Will data subjects be asked about their criminal history?

Yes
Not to our knowledge

**If yes, this may be illegal. DA to investigate

Will children under the age of 16 be surveyed?

Yes
Not to our knowledge

**If yes, this may be illegal. DA to investigate

The specific licensing agreement made between Cultural Infusion and*

Contract Start Date

Contract Value

Participants

The information surveyed is the following:

Extra comments:

Cultural Infusion does not have a direct relationship with the data subjects as this is the responsibility and domain of the controller. Data subjects have the option not to answer the survey, or to skip answering any or all questions. Data subjects have the option to complete the survey in ‘anonymous’ mode.

The data subjects retain all rights to data protection as stipulated by the corresponding statutory authority. If a data subject chooses to enter their names at the commencement of the survey, they have the right to request deletion of the data at any time henceforth. Even if a data subject chooses to enter their name, no one will be able to know their individual survey responses.

If a data subject chooses to complete the survey as ‘anonymous’ they will have an option to delete their own data, so long as they make a record of their unique data key.

The Purpose

The greater purpose of the Diversity Atlas platform is to map diversity within any organisation or group in order to reveal hidden diversity.

Knowledge pertaining to an organisation’s diversity is expected to lead to policies, procedures or programs that inspire greater inclusion, harmony, staff retention, creativity, productivity and knowledge for its own sake, as outlined in our Code of Conduct.

The customer, by way of studying our product throughout the sales process and within our Client Obligations document are by implication in congruence with this purpose.

Consultation Process

Throughout the sales and consultation process, matters of data security have been discussed and acted upon with the controller. Security measures already in place will be constantly monitored and improved over time.

Necessity and Proportionality

This product is fully compliant with the Australian Privacy Act and adheres to the data protection laws of any country, state and jurisdiction in which we deliver it, including (but not limited to) GDPR (EU).

Our Code of Conduct clearly stipulates that our customer cannot and will not on-sell or re-use the data beyond the scope and purpose of the product. This also applies to Cultural Infusion.

From rigorous testing (under ongoing review) we believe that the charts (as displayed on the product’s dashboard) are an accurate representation of the unsanitised data. We do not verify the inputs.

The data is encrypted whilst in transit at all times, and pseudonymisation has been mitigated to the best of our abilities.

Specific Project Risks - Potential Solutions

Potential Risk 1

Solution to Potential Risk 1

Potential Risk 2

Solution to Potential Risk 2

Potential Risk 3

Solution to Potential Risk 3

Potential Risk 4

Solution to Potential Risk 4

Potential Risk 5

Solution to Potential Risk 5

Potential Risk 6

Solution to Potential Risk 6

Sign off and Record Outcomes

Measures approved by:

Residual Risks approved by:

DPO advice provided:

Summary of DPO Advice