DPIA Questionnaire

Overview

The DPIA Questionnaire component provides an interactive form for conducting Data Protection Impact Assessments (DPIAs) in compliance with the Nigeria Data Protection Act 2023 (NDPA). This component helps organizations identify and minimize data protection risks in their projects or systems.

Installation

Install the NDPR Toolkit package which includes the DPIA Questionnaire component:

pnpm add @tantainnovative/ndpr-toolkit

Usage

Import and use the DPIAQuestionnaire component in your React application:

import { DPIAQuestionnaire } from '@tantainnovative/ndpr-toolkit';

const dpiaQuestions = [
  {
    id: 'data_collection',
    question: 'What types of personal data will be collected?',
    options: [
      { value: 1, label: 'Basic contact information only' },
      { value: 2, label: 'Personal identifiers and contact information' },
      { value: 3, label: 'Sensitive personal data (health, biometric, etc.)' }
    ]
  },
  {
    id: 'data_volume',
    question: 'What is the volume of data being processed?',
    options: [
      { value: 1, label: 'Small scale (fewer than 100 data subjects)' },
      { value: 2, label: 'Medium scale (100-1000 data subjects)' },
      { value: 3, label: 'Large scale (more than 1000 data subjects)' }
    ]
  },
];

function MyDPIAForm() {
  const handleSubmit = (answers, projectName) => {
    console.log('Project Name:', projectName);
    console.log('DPIA Answers:', answers);
  };

  return (
    <div>
      <h1>Data Protection Impact Assessment</h1>
      <DPIAQuestionnaire
        questions={dpiaQuestions}
        onSubmit={handleSubmit}
      />
    </div>
  );
}

Props

DPIAQuestion Type

type DPIAQuestion = {
  id: string;
  question: string;
  options: {
    value: number;
    label: string;
  }[];
  helpText?: string;
};

Examples

Basic Example

import { DPIAQuestionnaire } from '@tantainnovative/ndpr-toolkit';

const basicQuestions = [
  {
    id: 'q1',
    question: 'Does the project involve collecting personal data?',
    options: [
      { value: 1, label: 'No personal data collected' },
      { value: 2, label: 'Limited personal data collected' },
      { value: 3, label: 'Extensive personal data collected' }
    ]
  },
  {
    id: 'q2',
    question: 'Will the data be shared with third parties?',
    options: [
      { value: 1, label: 'No sharing with third parties' },
      { value: 2, label: 'Limited sharing with trusted partners' },
      { value: 3, label: 'Extensive sharing with multiple third parties' }
    ]
  }
];

function BasicDPIA() {
  return (
    <DPIAQuestionnaire
      questions={basicQuestions}
      onSubmit={(answers, projectName) => {
        console.log(answers, projectName);
      }}
    />
  );
}

With Initial Values

import { DPIAQuestionnaire } from '@tantainnovative/ndpr-toolkit';

function DPIAWithInitialValues() {
  const initialAnswers = { 'q1': 2, 'q2': 1 };

  return (
    <DPIAQuestionnaire
      questions={basicQuestions}
      initialAnswers={initialAnswers}
      initialProjectName="E-commerce Platform"
      onSubmit={(answers, projectName) => {
        console.log(answers, projectName);
      }}
    />
  );
}

With Risk Calculation

import { DPIAQuestionnaire } from '@tantainnovative/ndpr-toolkit';
import { useState } from 'react';

function DPIAWithRiskCalculation() {
  const [riskScore, setRiskScore] = useState(0);
  const [riskLevel, setRiskLevel] = useState('');
  const [recommendations, setRecommendations] = useState([]);

  const handleSubmit = (answers, projectName) => {
    const totalScore = Object.values(answers).reduce((sum, value) => sum + value, 0);
    const maxPossibleScore = Object.keys(answers).length * 3;
    const percentageScore = (totalScore / maxPossibleScore) * 100;

    setRiskScore(percentageScore);

    if (percentageScore < 40) {
      setRiskLevel('Low Risk');
      setRecommendations(['Regular review of data processing activities']);
    } else if (percentageScore < 70) {
      setRiskLevel('Medium Risk');
      setRecommendations([
        'Implement additional security measures',
        'Conduct regular staff training',
        'Review data retention policies'
      ]);
    } else {
      setRiskLevel('High Risk');
      setRecommendations([
        'Consult with the NDPC before proceeding',
        'Implement strict access controls',
        'Conduct comprehensive security audit',
        'Consider data minimization strategies',
        'Implement regular compliance monitoring'
      ]);
    }
  };

  return (
    <div>
      <DPIAQuestionnaire questions={comprehensiveQuestions} onSubmit={handleSubmit} />
      {riskScore > 0 && (
        <div className="mt-8 p-6 bg-white dark:bg-gray-800 rounded-lg shadow">
          <h2>DPIA Results: {riskLevel}</h2>
          <p>Risk Score: {riskScore.toFixed(1)}%</p>
          <ul>
            {recommendations.map((rec, index) => (
              <li key={index}>{rec}</li>
            ))}
          </ul>
        </div>
      )}
    </div>
  );
}

API Reference

DPIAQuestion Interface

export interface DPIAQuestion {
  id: string;
  text: string;
  guidance?: string;
  type: 'text' | 'textarea' | 'select' | 'radio' | 'checkbox' | 'scale';
  options?: Array<{
    value: string;
    label: string;
    riskLevel?: 'low' | 'medium' | 'high';
  }>;
  minValue?: number;
  maxValue?: number;
  required: boolean;
  riskLevel?: 'low' | 'medium' | 'high';
  showWhen?: Array<{
    questionId: string;
    operator: 'equals' | 'contains' | 'greaterThan' | 'lessThan';
    value: any;
  }>;
}

DPIASection Interface

export interface DPIASection {
  id: string;
  title: string;
  description?: string;
  questions: DPIAQuestion[];
  order: number;
}

DPIARisk Interface

export interface DPIARisk {
  id: string;
  description: string;
  likelihood: number;
  impact: number;
  score: number;
  level: 'low' | 'medium' | 'high' | 'critical';
  mitigationMeasures?: string[];
  mitigated: boolean;
  relatedQuestionIds: string[];
}

DPIAResult Interface

export interface DPIAResult {
  id: string;
  title: string;
  processingDescription: string;
  startedAt: number;
  completedAt?: number;
  assessor: {
    name: string;
    role: string;
    email: string;
  };
  answers: Record<string, any>;
  risks: DPIARisk[];
  overallRiskLevel: 'low' | 'medium' | 'high' | 'critical';
  canProceed: boolean;
  recommendations?: string[];
}

useDPIA Hook

import { useDPIA } from '@tantainnovative/ndpr-toolkit';

const {
  dpias,          // Array of all DPIAs
  startDPIA,      // Function to start a new DPIA
  updateDPIA,     // Function to update an existing DPIA
  completeDPIA,   // Function to complete a DPIA
  getDPIAById,    // Function to get a DPIA by ID
  identifyRisks,  // Function to identify risks based on answers
  assessRisk,     // Function to assess a specific risk
  generateReport  // Function to generate a DPIA report
} = useDPIA();

// Start a new DPIA
const newDPIA = startDPIA({
  title: 'Customer Data Analytics Platform',
  processingDescription: 'Processing customer data for analytics and personalization',
  assessor: {
    name: 'Jane Smith',
    role: 'Data Protection Officer',
    email: 'jane@example.com'
  }
});

// Update DPIA with answers
updateDPIA(newDPIA.id, {
  answers: {
    'data-types': ['personal', 'behavioral'],
    'data-volume': 'large',
    'automated-processing': true,
    'sensitive-data': false
  }
});

// Identify risks and complete
const risks = identifyRisks(newDPIA.id);
completeDPIA(newDPIA.id, {
  risks,
  overallRiskLevel: 'medium',
  canProceed: true,
  recommendations: [
    'Implement data minimization practices',
    'Enhance access controls',
    'Conduct regular security audits'
  ]
});

Best Practices

• Comprehensive Questions: Include questions that cover all aspects of data processing, including collection, storage, sharing, and deletion.
• Risk Scoring: Implement a risk scoring system to help identify high-risk areas that need additional mitigation measures.
• Documentation: Ensure the DPIA results are documented and stored for compliance purposes. The NDPA requires organizations to maintain records of processing activities.
• Regular Reviews: DPIAs should be reviewed periodically, especially when there are changes to the processing activities.
• Consultation: For high-risk processing, consider consulting with the NDPC or a data protection expert.

Accessibility

The DPIAQuestionnaire component is built with accessibility in mind:

• All form elements have proper labels and ARIA attributes
• Focus states are clearly visible
• Color contrast meets WCAG 2.1 AA standards
• Keyboard navigation is fully supported

To ensure maximum accessibility, make sure to provide clear and descriptive question text and help text where appropriate.

Need Help?

If you have questions about implementing the DPIA Questionnaire or need assistance with NDPA compliance, check out these resources: