Assessments Guide

Assessments in TrustWorks help you carry out PIAs, DPIAs, vendor reviews, and other privacy evaluations. You can build your own Assessment Templates or start from a template provided by TrustWorks, publish them for internal or external use, and track every active assessment from one place.

Overview

The Assessments module contains two areas:

• Assessments — view, search, filter, and open assessment runs.
• Templates — create and manage your organisation's Assessment Templates or import ready-made templates from the TrustWorks Template Library.

The standard setup has three stages:

1. Create or import an Assessment Template.
2. Publish the template and configure how it will be deployed.
3. Trigger a new assessment for an Asset, Processing Activity, Initiative or Assessments tab.

Publishing automatically creates the workflow needed to run the assessment, so a separate workflow does not need to be configured for a standard assessment.

Note: For more advanced processes with several actions, such as additional tasks, assessments or emails, you can still configure the associated workflow in the Workflow Builder.

Creating an Assessment Template

Go to Assessments → Templates. From here, you can create a template from scratch or import one from the TrustWorks Template Library.

Create a template from scratch

1. Click + New Assessment Template.
2. Select Create from scratch.
3. Enter a clear template name and description.

4. Select the related object: Asset, Processing Activity, or Initiative. This determines the context in which the assessment can be used and which smart question types are available.

   Optionally add template metadata:

   • Type — for example, DPIA, LIA, TIA, or Vendor Assessment.
   • Regulatory Framework — for example, GDPR or ISO 27001.
   • Language — identifies the language in which the template is written.
5. Add sections and questions, then save the template.

New templates remain Unpublished until you are ready to configure and publish them. An Assessment Template must contain at least one question before it can be published.

Import a template from the TrustWorks Template Library

The TrustWorks Template Library contains curated templates that can be added to your organisation and customised.

1. Go to Assessments → Templates.
2. Click + New Assessment Template and choose the TrustWorks Template Library.
3. Browse the available templates, or use search and filters to narrow the list by Type, Regulatory Framework, or Language.
4. Select a template to review its description and metadata.
5. Import the template.

The imported template is added to your organisation as Unpublished and opens in the template builder. You can edit it before publishing without changing the original TrustWorks template.

If the template you need is not available, contact support@trustworks.io.

Building an Assessment Template

General question types

• Statement
• Short question
• Multiple choice
• File upload

Smart questions

Smart questions read from or update fields on the related object. When an assessment is approved, approved responses are written back to the linked Asset, Processing Activity, or Initiative.

Asset

Note: Asset Classification, Provider, and Related Legal Entity questions are not available in vendor-facing assessments.

Processing Activity

Initiative

Organise and configure questions

You can:

• Drag questions to change their order.
• Edit or delete questions.
• Format text using bold, italics, underline, links, and lists.

• Add conditional logic to multiple-choice questions. For example, a Yes answer can send the respondent to another section, while No can submit the assessment.

AI-assisted insights

You can enable Risk Insights and/or DPIA Insights in the template. These insights are generated after the assessment is completed and can be reviewed and imported to the related object during approval.

Conditional risks

For multiple-choice and custom-field selector questions, you can create or link a risk when a particular answer is selected:

1. Enable Conditional Risks.
2. Define the condition, such as “If the respondent selects X”.
3. Choose whether to create a risk from the Risk Template Library or link an existing risk.

Publishing and Deploying a Template

Only Published Assessment Templates can be used to create new assessments.

1. Open an unpublished template and click Publish.
2. Select whether the assessment is for internal or external respondents.
3. Configure the deployment, including the respondent and any reviewers or approver required by your process.
4. Complete the publishing flow.

TrustWorks publishes the template and automatically creates an active assessment workflow behind the scenes. You can open the linked workflow from the template when you need to review it or add more advanced workflow steps.

Unpublishing and republishing

Unpublishing a template deactivates its linked workflows, which prevents users from creating new assessments from it. Existing and historical assessment runs are retained.

If the template is published again, TrustWorks creates a new active workflow while preserving previous workflows and their assessment history.

Important: Before unpublishing, review the warning shown in TrustWorks and confirm that the template should no longer be available for new assessments.

Creating a New Assessment

You can create an assessment from:

• The Assessments page.
• A related Asset, Processing Activity, or Initiative.
• A bulk action for multiple related objects, where available.

Click + New Assessment, select a published template, complete the setup, and launch the assessment. TrustWorks automatically generates the assessment name using the workflow, related object, and date.

If no published templates are available, TrustWorks displays Assessment setup required with a link to the Templates area.

Creating assessments for multiple assignees

You can select multiple assignees when launching assessments. TrustWorks creates a separate assessment for each person; these are individual assessments, not a single collaborative response.

This approach is not recommended for templates containing smart questions. Each approved assessment updates the same related object, so a later approval may overwrite information written by an earlier one. Use collaborators when several people should contribute to the same assessment.

Viewing and Managing Assessments

The Assessments tab provides a central list of assessment runs and includes:

• Name
• Related Object
• Type
• Respondent
• Approver
• Status
• Created On
• Updated On

Use search or filter the list by Status and Type to find the assessments you need. Select the view icon to open an assessment and review its responses and activity log. When you return to the list, your applied filters are preserved.

Pre-Populating Recurring Assessments

When running a recurring assessment, such as an annual vendor review, TrustWorks can pre-fill the new assessment with answers from the most recent completed assessment for the same workflow and related object.

How it works

1. When a matching completed assessment exists, Pre-populate from previous assessment appears in the launch dialog.
2. Select the option to carry forward eligible answers. You can open the source assessment before launching.
3. TrustWorks creates a new assessment; the source assessment is never changed.
4. Respondents can review, edit, or keep the pre-filled answers before submitting.
5. Pre-filled questions are identified for the respondent.

Important rules

• Only completed assessments can be used as a source. Draft, in-progress, and cancelled assessments are excluded.
• Answers are matched by question ID, not question order or label. Reordering or renaming a question does not prevent its answer from being carried forward.
• Removed questions are excluded, while newly added questions remain blank.
• If a question type has changed, its previous answer is not copied.
• Smart questions, such as Data Mapping and Lawful Basis, always show current values from the linked object rather than historical answers.
• Only assessments completed after March 21, 2025 can be used as a pre-fill source.

Adding Collaborators

After an assessment is created, you can invite collaborators in addition to the main respondent. Collaborators are added to an individual assessment. Once invited, they receive an email notification and can contribute to the responses. You can also tag users or teams in comments to direct them to questions where their input is needed.

Running Vendor Assessments

Vendor assessments are external assessments linked to an Asset and its vendor Legal Entity.

Before publishing the template

1. Open the relevant Asset and link the vendor's Legal Entity.

2. Open the Legal Entity and add the vendor representative's Contact Email. You can add additional contacts if more people should participate.

Publish and run the vendor assessment

1. Open the Assessment Template and click Publish.
2. Select the external deployment option and configure the vendor as the respondent.

3. From the Asset or Assessments page, click + New Assessment and select the published vendor assessment.
4. The linked vendor contact or contacts receive an invitation to complete the assessment.

Note: Vendor assessments can currently be created from the Asset context.

Example

You manage a CRM system provided by an external vendor:

• The CRM is registered as an Asset.
• The provider is linked as a Legal Entity of type Vendor and has a contact email.
• A Vendor Risk Assessment Template is published for external deployment with the vendor as respondent.
• When the assessment is created from the Asset, the vendor receives the questionnaire and the results remain linked to the Asset and Legal Entity.

Assessment Review

Reviewers are configured when the template is published and can be changed by an administrator for an individual assessment. Update the linked workflow if the reviewer assignment needs to change permanently for future assessments.

Reviewers can:

• Mark the review as Review Passed, Review Failed, or Awaiting Clarification.
• Add an overall comment when submitting their review.
• Comment on individual questions, tag users or teams, and flag questions requiring clarification.
• Edit responses or answer questions when needed.

Once all required reviews are complete, the assessment moves to approval.

Assessment Approval

Approval is the final step when an approver has been configured. The approver can review responses, reviewer feedback, and the activity log, then:

• Approve the assessment.
• Reject the assessment.
• Return it to the respondent for additional input.

Approvers can also edit responses and add comments. Once approved or rejected, the assessment is closed and can no longer be edited. Approved smart-question responses are then reflected in the related object.

Assessments provide a structured, traceable way to collect information, evaluate privacy risks, and keep related records up to date across Assets, Processing Activities, and Initiatives.

Still need help? Contact TrustWorks Support.