Scope
Define systems, business units, and specific processing activities covered by the DPI, including geographic boundaries, cross-border transfers, and any third-party processors with access to personal data.
A Business DPI Document clarifies data processing purposes, identifies privacy risks, and records mitigation steps to reduce liability. It aids regulatory compliance for example HIPAA and state privacy laws, supports contractual obligations, and provides documented evidence of reasonable security practices for audits and third-party reviews.
Typical users and roles that complete Business DPI Documents include privacy officers, compliance lead, IT security managers, and project managers overseeing data processing initiatives.
The DPI process often involves external counsel, vendors, or auditors for high-risk processing or cross-border data transfers.
Define systems, business units, and specific processing activities covered by the DPI, including geographic boundaries, cross-border transfers, and any third-party processors with access to personal data.
List personal data types processed, such as identifiers, health, financial, and employment data; note any special categories that trigger heightened controls and include volume estimates.
Identify applicable legal bases for processing under federal or state law, contract necessity, consent, or legitimate interest, and cite relevant statutes or contractual clauses by name.
Assess likelihood and impact of privacy harms, score risks by severity, document residual risk after controls, and identify acceptance or escalation thresholds for executive review.
Describe technical and organizational safeguards, encryption, access controls, data minimization, retention limits, vendor controls, and monitoring plans and testing procedures.
Define ongoing review schedule, incident response integration, update triggers, reporting lines, and metrics to validate control effectiveness over time, including audit logs and KPIs quarterly.
| Field or Workflow Configuration Name | Configuration |
|---|---|
| Signer Authentication Method and Strength | Email link, SMS code, or KBA |
| Field Validation Rules and Formats | Require MM/DD/YYYY for dates, TIN format checks |
| Review Order, Roles, and Notifications | Sequential reviewers or parallel review with reminders |
| Storage, Retention Policy, and Access | Store signed PDF, export metadata, apply retention rule |
Typical platform requirements include integration with core systems, PDF and DOCX support, secure storage, and audit logging to support eSubmission and downstream processing.
Martin Properties used a Business DPI Document to formalize vendor controls and speed lease processing while recording privacy safeguards for tenant data.
Fertility Centers used a DPI Document when digitizing patient intake to identify PHI flows and specify HIPAA safeguards.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies by vendor | Varies by vendor | Varies by vendor | Varies by vendor |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
| Envelope Cap | No cap | 100 envelopes/user/year | Varies | Varies | Varies |