Virtus Group - DPIA Template (Worked Example: Recruitment)

Executive Summary

This document describes Virtus Group’s standard for this area and how it is applied in practice. It is derived from our internal policies and standards and is intended for both reviewers and operations.

Scope & Assumptions

• In scope: systems and processes directly managed by Virtus Group per contract.
• Out of scope: client-owned or third‑party systems not onboarded to our managed service.
• Dependencies: connectivity, power, and named client contacts for decision making.

Requirements (Key Controls)

• Availability: Ensuring information and systems are accessible when required. (VGL.Information.Security.And.Privacy.Framework.docx)
• Director – Provides governance and approves exceptions.Head of Security & Compliance – Owns this framework, ensures compliance, and conducts audits.IT Operations Manager – Implements security controls and manages operational risks.People & Culture – Ensures privacy and security in HR processes.Managers – Ensure compliance within their teams.All Staff – Must comply with the framework, complete training, and report incidents. (VGL.Information.Security.And.Privacy.Framework.docx)
• This document will be reviewed at least once every two years, or whenever a major update is required, whichever happens first. (VGL.Information.Security.And.Privacy.Framework.docx)
• Ensure privacy is considered in all activities (VGL.Privacy.Policy.docx)
• Ensure staff awareness (VGL.Privacy.Policy.docx)
• Disclosure is limited to authorised staff, contracted third parties, and regulators where required by law (VGL.Privacy.Policy.docx)
• PII is retained only as long as necessary for the identified purpose or as required by law. (VGL.Privacy.Policy.docx)
• PII may be transferred outside NZ where required for cloud services (Microsoft, AWS, other SaaS). (VGL.Privacy.Policy.docx)
• Privacy breaches must be reported immediately. (VGL.Privacy.Policy.docx)
• The Privacy Officer is responsible for investigation, notification to affected individuals, and regulatory reporting if required. (VGL.Privacy.Policy.docx)
• Exemptions must be approved by the Privacy Officer and the Director, tracked, and reviewed annually. (VGL.Privacy.Policy.docx)
• This document will be reviewed at least once every two years, or whenever a major update is required, whichever happens first (VGL.Privacy.Policy.docx)
• The following rules must be followed when making a protected disclosure: (VGL.Protected.Disclosures.docx)
• VIRTUS GROUP will ensure that all disclosures are treated confidentially, and all information gathered during the investigation will be protected. (VGL.Protected.Disclosures.docx)
• Director – Provides governance, approves exceptions, and ensures adequate resources.Head of Security & Compliance – Owns this procedure, oversees compliance, and ensures audits.IT Operations Manager – Maintains the asset register and oversees provisioning and de-provisioning.People & Culture – Ensures HR processes trigger asset allocation and retrieval.Managers – Approve allocation requests and ensure proper use of assigned assets.Asset Owners – Ensure correct classification, handling, and compliance.Custodians – Maintain custody and day-to-day protection of assigned assets.All Staff – Must comply with this procedure, report loss/theft, and return assets on termination. (VGL.Information.Asset.Management.Procedure.docx)
• All tangible and intangible assets that support Virtus Group’s services must be recorded, classified, and managed. (VGL.Information.Asset.Management.Procedure.docx)
• Physical verification of assets must be conducted annually. (VGL.Information.Asset.Management.Procedure.docx)
• Asset requests must be initiated via HRIS or ITSM systems, approved by the line manager, and logged in the asset register. (VGL.Information.Asset.Management.Procedure.docx)
• Users must acknowledge receipt of IT assets, and all retrieved assets must be inspected, serviced, and securely erased prior to reallocation. (VGL.Information.Asset.Management.Procedure.docx)
• Procurement must verify available inventory before purchasing new assets. (VGL.Information.Asset.Management.Procedure.docx)

Procedures / Playbooks

KPIs & Reporting

• Open risks accepted/treated before go-live
• Review DPIA on major change

Evidence & Records

Records are maintained per the VGL Document & Record Control guidelines, including logs, approvals, test outputs, meeting minutes, and reports.