Organisations are required to demonstrate that they are undertaking appropriate impact assessments to determine risks to individual rights posed by data processing activities. A risk impact assessment is by its nature a collaborative exercise, and the Case Manager will be the controlling mechanism for scheduling, storing and maintaining those reviews, as well as managing the third-party supplier aspect of the review process, with solution extensions available to support third-party digital signatures that demonstrate an understanding of the organisation’s privacy processes