Follows the NPC structure
The questions come from the NPC PIA Guide form, so your team answers what the regulator's own guide asks, in the same order.
Prototype. Please enter fictional data only. Do not enter real personal data, real systems or real client information.
About
Privacy impact assessments, as a checklist your team can finish.
PIA Desk is a workspace for completing a Privacy Impact Assessment against the National Privacy Commission's PIA Guide. Your team describes the system, works through the checklist, and prints the report or takes it to Excel.
Why use PIA Desk
Finish the assessment, and be able to show it.
One record, not a folder of files
The description, answers, notes, reviewer and sign-off date sit together. Anyone in your organisation can see where the assessment stands.
Evidence beside every answer
Each answer has a note for the supporting detail. A reviewer can see why a question was answered Yes or No without chasing the author.
Easy to repeat when systems change
Start a new version from the last signed-off one. You update what changed instead of beginning again.
Output people already use
Print the report to PDF for the file, or download Excel to share with management, auditors or a vendor.
A clear trail
Every answer and status change is logged with who and when. A PIA cannot be signed off while any question is unanswered.
PIA Desk helps you complete and record an assessment. It does not decide whether your system is compliant, and it does not replace your Data Protection Officer or legal advice.
The problem
A PIA is usually written once and then forgotten.
Most assessments live in a Word file. Someone answers the questions from memory, a manager signs it, and it goes in a folder. Six months later the system has new fields, a new vendor and a new export button, and the PIA describes a system that no longer exists.
The NPC guide describes a PIA as a process that continues after deployment. PIA Desk keeps the checklist, the answers and the notes in one place, with versions, so a new review starts from the last signed-off one instead of a blank page.
How it works
Four steps, one record.
01
Describe
Name the system, its purpose, owner and scope. Plain words are fine.
02
Assess
Work through the checklist. Answer Yes, No or Not applicable, and paste the evidence into the note beside each answer.
03
Review
The DPO checks the answers, corrects them, and signs off. The reviewer and date are recorded.
04
Share
Print the report to PDF or download it as Excel. Start a new version when the system changes.
How to use it
From a new account to a signed report.
- 1. Create an account and an organisation. The organisation is your company's private workspace. You become its owner. Add colleagues by email once they have an account, and give each a role: DPO, reviewer or viewer.
- 2. Add a system. Give it a name, a plain description of what it does and why, the accountable owner, and the scope of this assessment. Choose a risk tier.
- 3. Open the assessment. Each system starts with a draft PIA. It lists the threshold questions first, then the checklist sections on transparency, legitimate purpose and proportionality.
- 4. Upload documents (optional). Add the SDD, project plan, UAT results, data center handover and security checklist. PIA Desk reads them and suggests passages that may support each question. Suggestions are search matches, not answers.
- 5. Answer each question. Choose Yes, No or Not applicable. In the note, paste the evidence from your own documents, settings or system: a policy line, a configuration value, a retention rule. Keep personal data out of notes. Press Save answers; you can stop and return later.
- 6. Send for review. When every question has an answer, send the draft for review. The DPO or reviewer checks it and can send it back to draft with changes.
- 7. Sign off. The DPO signs off. The assessment is then locked, and the reviewer and date are recorded.
- 8. Share the report. Open Report (print / PDF) and use your browser's Print, then Save as PDF. Or download the Excel file. Both show every question, answer and note.
- 9. Keep it current. When the system changes, choose Start new version. Your earlier answers are copied across, so you review and update instead of starting over.
Tip: Answer honestly rather than optimistically. A "No" with a note on how you plan to fix it is more useful to a reviewer than a "Yes" nobody can back up.
A checklist that shows its work
Every answer has a place for its evidence.
The checklist follows the structure of the NPC form, so what you produce reads the way the NPC expects.
Yes No
Answered by your team
Copy the supporting detail from your own documents, settings or systems into the note, so the reviewer can see why.
Not applicable
Say when it doesn't apply
An honest "not applicable" with a reason is better than a blank.
Unanswered
Gaps stay visible
Unanswered questions are shown in the report, and a PIA can't be signed off until every one has an answer.
What it will never do
Declare a system compliant. PIA Desk records your assessment. Accountability stays with your organisation and its DPO.
Our own privacy stance
A privacy tool should practise what it assesses.
- No code scanning, no AI. PIA Desk never asks for your source code. Documents you upload are read on the server your organisation runs, and nothing is sent to another service. AI drafting is a planned optional add-on and is off.
- Keep notes free of personal data. Describe the data, not the people in it.
- Each organisation is separate. You see your own systems and nobody else's.
- Every change is on the record. Who answered, who changed it, and when.
Status: PIA Desk is a prototype. Please use fictional data only. Your organisation installs it on its own servers, so your data stays with you. Two-factor sign-in is planned and not built yet.
Hosting, responsibilities and disclaimers explains who is responsible for the data when your organisation runs PIA Desk itself, and when it is hosted for you.
Grounded in
The NPC guide, followed closely.
The structure follows the sections of the NPC Privacy Toolkit's PIA Guide: system description, threshold analysis, and the privacy impact analysis against transparency, legitimate purpose and proportionality under Republic Act No. 10173, the Data Privacy Act of 2012.