How it works today in most organizations
Almost every data protection organization has a review path, even if it is written down nowhere. A new processing activity is recorded by the business unit, the data protection coordinator adds the legal basis and retention periods, the external data protection officer reviews it, and for sensitive processing such as video surveillance in the warehouse, management wants to sign off before it counts as approved.
Little of this reaches the tool. Most systems and spreadsheets know four states: new, in progress, approved, archived. Everything between "created" and "approved" is "in progress", whether the document sits with the business unit, with the coordinator or has been with the data protection officer for three weeks.
Workarounds fill the gap. The file name reads "RoPA_VideoSurveillance_v3_DPO-reviewed.docx", and the spreadsheet has a free-text column "Progress" with entries like "with Mr. Krause", "question to IT" or "ok per email of the 12th". Anyone who wants to know whether the data protection officer has seen a processing activity searches the mailbox for his reply.
Technical and organizational measures look the same. IT enters a measure, the information security officer checks whether it has been implemented effectively, and only then should it count as confirmed. Whether that review took place is something you only learn by asking the people involved.
Approval itself is not always the same either. The website privacy policy only applies once the legal department has reviewed it and it has been published online, while an internal version applies as soon as the coordinator approves it. In the tool, both are simply "approved". Which version is actually on the website is settled by an email to the marketing department that nobody can find a week later.
On top of that, everyone fills in the free-text column differently. One person writes "DPO review", another "with DPO", a third leaves the field empty because he considers it optional. You cannot filter by it, and nobody checks the order of the steps. A processing activity can jump to "approved" although the data protection officer never saw it, because nothing in the document prevents anyone from setting the status directly.
The moment it becomes apparent
It usually becomes apparent in a meeting with the data protection officer or in an audit. The question is then not whether the records are complete, but which entries he actually reviewed and which are merely marked as approved. The honest answer takes an afternoon with the mailbox, file names and memory.
The same happens when the coordinator changes. Her successor inherits a spreadsheet in which the progress is written in a language only her predecessor understood.
The analysis
Five Problems With a Status That Knows Only Four Values
They do not come from carelessness. They come from a review path that has no place in the tool and therefore ends up in file names, free text and mailboxes.
View processing activities in preeco"In progress" does not say with whom
The business unit, the coordinator and the data protection officer share a single state. Anyone who needs to follow up does not know whom to ask, and documents sit unnoticed at one station.
The review is not documented
Whether the data protection officer has seen a processing activity is recorded in an email, not in the document. In an audit, the review can be proven only with effort or not at all.
Steps can be skipped
Nothing stops anyone from setting a document straight to "approved". The agreed review path holds only as long as everyone remembers it.
Free text cannot be analyzed
With "with DPO", "DPO review" and an empty field for the same stage, no filter returns a reliable list. Nobody knows how many processing activities are waiting for feedback.
Knowledge of the process leaves with the person
What "v3_ok" in a file name means is known to the person who wrote it. After a change, the successor has to ask again where every document stands.
The target process in six steps
A workable status workflow separates two things that are mixed up today: the fixed phases that approval and archiving depend on, and the stations a document passes through in your organization within those phases. The following six steps describe the process using processing activities as the example.
1. Write down the review path you actually follow. Before setting anything up, clarify which stations a document really passes through. For processing activities these are often "Query to business unit", "DPO review" and, where needed, "Approved by management".
2. Create your own statuses per document type. In preeco | data protection and preeco | information security, which share one platform, administrators create their own statuses for each document type in the settings under Workflows: processing activities, TOMs, data processing agreements (DPAs), risk analyses, policies, assets and more. Each status gets a name in each document language, a text and background color, and a description of what it stands for.
3. Assign each status to a category. The categories New, In progress, Approved and Archived are fixed. You assign your own statuses to them, and the category continues to determine the behavior: moving into an approved status creates a revision, just as approval did before.
4. Define the allowed transitions. Every status has an entry and an exit. If both are open, every transition is allowed. If you close the entry of "Approved by management" and define a single path from "DPO review", a document can only get there through the review. The flow view shows all paths as a diagram.
5. Define which status is used automatically. New documents receive the automatically used status of the category New. When approving and archiving, the automatically used status is preselected, and if the category has several statuses, you choose the right one in the dialog.
6. Work with the statuses day to day. In the document, you choose the status in the edit form. Transitions the workflow does not allow are grayed out. Tables show the colored statuses, filter by them and group the filter by category, and dashboard cards show your status names in the legend.
What the workflow controls and what it does not
The status workflow controls which transitions are possible by hand: in the form, when approving and archiving, in bulk approval from tables and through the API. Processes the system triggers itself, such as signing a contract, are never blocked.
It does not determine who may set a status. That stays with the existing permissions: whoever may edit a document can choose any allowed status, and an approved status only if they may also approve.
Before and after at a glance
| Criterion | Before: four fixed values and free text | After: your own statuses with transitions |
|---|---|---|
| Progress | "In progress" for every station | One status per station, colored in the document |
| Consistency | Everyone writes the stage differently | Fixed choice, named per document language |
| Order | Any step can be skipped | Only the defined transitions can be chosen |
| Evidence | Review recorded in an email | Status on the document, approval with revision |
| Reporting | Filtering free text leaves gaps | Filters and dashboard by your statuses |
| Approval | One value for every kind of approval | Several approved statuses to choose from in the dialog |
| Changing the process | New column, new agreement | Replace a status, revisions stay unchanged |
| Staff changes | Meaning lives in the predecessor's head | A description per status explains the step |
In practice
What this looks like in preeco | data protection
The three building blocks behind the process described above.
Statuses and transitions per document type
Administrators create their own statuses with color and description for each document type and use entry, exit and single paths to define which transitions are allowed. The flow view shows all paths as a diagram.
Approval with a status choice
When approving and archiving, you choose the right status, with the automatically used one preselected. Approval creates a revision as before, and a path the workflow does not allow is locked.
Tables, filters and dashboard
Statuses appear in color in tables, grouped by category in the filter and in the legend of dashboard cards. You see at a glance how many processing activities are waiting for review.
What the switch means in practice
For a team that sets up nothing, nothing changes. Every document type starts with one status per category, and all transitions are open. You can therefore start with a single document type, typically processing activities, and add the others once the process has proven itself.
The real effort lies in agreeing on the review path with the people involved, not in the setup. Talk to the data protection officer and the business units about which stations exist, and write into the description of each status when it applies.
Three mistakes that make the switch harder than necessary
Turning every thought into a status. Nobody reads ten statuses for processing activities. Two or three stations within In progress are usually enough; everything else belongs in tasks or comments.
Closing every path from the start. If you close every entry and exit, you have to create every path individually and end up with statuses that can no longer be reached. Close the entries that matter, such as the one leading to approval.
Mistaking the workflow for a permission concept. The workflow defines which transitions are possible, not who makes them. Who may edit and approve which documents is still governed by roles and permissions.
How to tell it is time
A status with four values is enough as long as one person handles everything. Your own statuses pay off when one of these applies:
- The file name or a free-text column says who is currently reviewing a document.
- An external data protection officer reviews documents before they are approved.
- You cannot say offhand how many processing activities are waiting for feedback.
- Some approvals need management sign-off, others do not.
- In the last audit, the review of a document could only be proven by email.
If two or more apply, your review path already exists. It just is not in the document yet.
FAQ
Frequently asked questions about status workflows
For every document type with a status that your license covers, including processing activities, TOMs, data processing agreements (DPAs), data protection impact assessments (DPIAs), data subject requests, incidents, training courses, risk analyses, policies, audits and assets. Each document type has its own statuses and transitions.
No. Approval, revisions and archiving still depend on the category. When a document moves into a status of the category Approved, a revision is created as before. What is new is that you can choose between several approved statuses in the approval dialog.
Only administrators set up statuses and transitions. The status of a document is changed by whoever may edit that document, and only along the allowed transitions. An approved status can only be chosen by someone who also has the right to approve.
If the status is in use, you choose a replacement from the same category when deleting it. All documents receive the new status, the activity log records one entry per document, and existing revisions stay unchanged. The last status of a category cannot be deleted.
Yes, as long as all statuses belong to the same category. A TOM can, for example, carry "DPO review" and "Query to business unit" at the same time. Statuses from different categories cannot be combined, because the category controls approval and archiving.
Map your review path together
Bring your spreadsheet with the "Progress" column. In 30 minutes we show how it turns into statuses and allowed transitions.