Hosting, responsibilities and disclaimers.

1. Two ways to run PIA Desk

2. Who is responsible for what

3. What the upload feature does

• You can upload documents such as the system design document, project plan, UAT results, data center handover sheet and security checklist (PDF, Word, Excel or text).
• The server reads the text and finds passages that relate to each checklist question. These appear as suggested evidence beside the question, with the file and location.
• It is plain text matching on the server. No AI is used and nothing is sent to any other service.
• It never answers a question for you. A person reads the suggestions and answers Yes, No or Not applicable.
• The uploaded file and the text taken from it are stored with the assessment and can be deleted from the assessment page.
• Suggestions can be wrong or miss relevant text. Always read the source document.

Documents can contain personal data, credentials, network details or other sensitive material. Upload only what the checklist needs, and remove passwords, keys and personal data first.

4. If PIA Desk is hosted by SKOOLS (skooled.online)

Under the Data Privacy Act, a controller that gives personal data to another party to process must have a contract with that party, and the processor must protect the data to the same standard. For a hosted PIA Desk the agreement is meant to say that SKOOLS (skooled.online):

• processes your documents only to provide the service and only on your documented instructions, and never for its own purposes;
• keeps the data confidential and limits staff access to those who need it, under confidentiality duties;
• applies reasonable organisational, physical and technical security measures, and tells you what they are;
• uses only the sub-processors listed in the agreement (for example the hosting company, an email provider, and an AI provider if you switch the AI add-on on), and tells you before changing them;
• tells you without undue delay, within a period fixed in the agreement, if it becomes aware of a personal data breach, and helps you assess and report it;
• helps you answer data subject requests and the NPC's enquiries;
• returns or deletes your data when the agreement ends, and confirms in writing when it has;
• lets you check how it complies, for example by answering a security questionnaire, and keeps your data in the location the agreement states;
• does not use your documents to train any AI model.

Your organisation, as controller, still decides the purpose, checks that it has a lawful basis, informs data subjects, and chooses who in your organisation may see what.

Before uploading real documents to a hosted copy: sign the data processing agreement, agree the breach-notice period and data location, and have your DPO approve the hosting.

5. AI drafting (optional add-on, not part of the base product)

An AI drafting add-on is planned. It is not built or switched on. If it is added, it will be off by default and enabled only by an organisation owner in writing. It would send excerpts of your documents to an AI provider, which becomes another sub-processor. That would be disclosed in your agreement and in your Privacy Policy before use, and a person would still have to confirm every draft. An organisation may supply its own AI account, so that excerpts go from its own server directly to the provider.

6. Disclaimers

• PIA Desk records an assessment that your people complete. It does not decide that a system is compliant, and it is not legal advice.
• It does not replace the judgment of a Data Protection Officer.
• It is not affiliated with or endorsed by the National Privacy Commission. The checklist follows the structure of the NPC's PIA Guide.
• Suggested evidence is a search aid. Accuracy depends on the documents supplied.
• The software is provided as agreed in your licence. Liability, warranties and support are set out there.
• This copy is a prototype. Use fictional data and documents only.

7. Go-live checklist

1. 1. Decide the model: self-hosted or hosted by SKOOLS (skooled.online).
2. 2. Set the organisation name and privacy contact in the configuration, and set PIA_PROTOTYPE to false.
3. 3. Have your DPO review the Privacy Notice and Privacy Policy.
4. 4. If hosted: sign the data processing agreement and agree the breach-notice period and data location.
5. 5. Serve the site over HTTPS, back up the database and the uploaded files folder, and restrict server access.
6. 6. Add only the people who need access, with the lowest role that works.
7. 7. Decide how long assessments and documents are kept, and write that down.
8. 8. Tell your people not to upload credentials or unneeded personal data.