Specira sample artefact. Rendered from the governed default template on a fictional company. Names, figures and dates are illustrative.All artefacts →
SAMPLE
seeded demo data · specira.ai
Specira Privacy Impact Assessment: Governed Template Rendering
Governed template rendering reference: Privacy Impact Assessment default v2 (draft) definition 32e49429…f41f
Privacy Impact Assessment · Project artifact SPECIRA

Privacy Impact Assessment: Dispatch Modernization

Meridian Field Services: instructional example, not project evidence

Draft · watermark policy: draft_only template privacy_impact v2 · pack: specira_default_delivery the attachment the classification's DPIA summary cites · harm to the person is the lens
§1

Impact Assessment

mandatory 1 decision1 evidence rule validators: screening_result_cited_from_classification_register · every_risk_framed_as_harm_to_data_subject_not_company · residual_risk_has_named_signoff_owner · worker_representative_consultation_recorded_where_monitoring

The classification register ran the trigger test and cites this document as its attachment. Every risk row names harm to a PERSON; the lens inverts here.

Screening handshake: the trigger test FIRED on systematic monitoring of workers (impact assessment[1]); this document is the attachment that summary cites.

Processing description, by citation: continuous technician location during shifts (RESTRICTED, 30-day purge; basis: contract performance and legitimate interest, per labels · retention · consent[1]); override telemetry (CONFIDENTIAL worker-conduct records with the employment-notice discipline).

Necessity: dispatch cannot assign on proximity without positions; nothing less intrusive suffices. Zone-only precision was evaluated and fails the assignment use case (the walked alternative recorded in ADR-6 context[2]). Proportionality, designed in: the 30-day purge, band-level display off dispatch surfaces, no off-shift tracking, the anonymized-code boundary at the model gateway (SR-014[3]).

IdHarm: to whom, whatSeverityMitigations (cited)Residual
R-S1 A technician's movement patterns re-identified → loss of control over personal data possible · high (the project scale[4]) SR-033, SR-034[3] + the purge; threat row TM-07[4], cross-cited both ways rare · moderate
R-S2 Telemetry-driven discipline beyond the agreed monitoring purpose → unfair treatment possible · moderate The override-review purpose limit (BR-03[5]) + the audit trail (SR-009[3]) rare · moderate
R-S3 Chilling effect on work practices from felt surveillance → behavioral harm possible · moderate Meaningful notice, band display, the transparency question (open questions[6]) possible · low · revisited at the pilot exit interviews

Residual sign-off: N. Duval, July 15, 2026. Prior consultation NOT triggered: residuals sit below the high band after mitigation, stated with the scale citation. Consultation record: privacy officer consultation documented July 12; worker-representative consultation, the union co-signature review, in flight, due August 8 (shared thread[3]); the assessment is conditional-complete until it lands, and says so. Reopening triggers: off-shift tracking ever proposed; a new recipient; precision below band level; the model boundary changing.

§2

Cross-Border Transfer Assessment

conditional · OMITTED, with rationale 1 decision1 evidence rule validator: every_cross_border_transfer_has_mechanism_and_destination_law_assessment

Omission note: "cross_border omitted: processing is single-region; the classification register's cross-border record carries the claim and its re-run trigger (cross-border[1]). No transfer exists to assess; the trigger re-runs if a processor outside the region joins the integration register (register[7])."

§3

Data Subject Rights

mandatory 1 decision1 evidence rule validators: every_right_has_intake_sla_and_verification · no_right_declared_without_mechanics · deletion_vs_retention_precedence_cited

Rights carry mechanics before they are declared supported: the answer the intake team gives is written before the first request arrives. Staff are the subjects; the worker context is the default here.

RightIntakeVerificationSLAPath
Access The HR service portal's named request form Employee SSO session, proportionate: the requester is authenticated staff 30 days; one 60-day extension with notice N. Duval's team compiles from the position store and audit stream
Rectification Roster errors route to the HR directory, the system of record (INT-5[7]); this system corrects by sync, stated so the intake team routes right
Erasure The precedence law applied (retention rules[1]): positions purge at 30 days regardless (often the request is already satisfied); assignment records resist erasure under contract clause 14 and active holds; the written answer lives in the fulfillment pack (rights runbook[8])
Portability Not applicable to employment-context monitoring data under the governing regime, stated as a claim with counsel's citation
Objection Routes to the representative channel (the union process) plus the individual grievance path; monitoring-purpose objections land with N. Duval

Worker-context note: every right above names its worker-facing channel; the representative channel exists and is cited, not implied.

§4

Open Questions

mandatory1 decision
QuestionOwnerAnswer byBlocks
Does the union co-signature review change the notice text only, or also the objection path's routing? (Two rows depend on one answer.) N. DuvalAug 8, 2026 The consultation record's completeness and R-S3's revisit wording
Refs

References & Package Contents

In this export package

package [8] Rights runbook: the fulfillment pack with written answers ./compliance/rights-runbook.pdf

In the Specira workspace

specira [1] Data classification: the trigger test + DPIA summary this document attaches to; labels, retention, consent, cross-border app.specira.ai/projects/dispatch-modernization/artifacts/data-classification
specira [2] Decision log: ADR-6 context (the walked zone-precision alternative) app.specira.ai/projects/dispatch-modernization/artifacts/decision-log#adr-6
specira [3] Security requirements: SR-009, SR-014, SR-033, SR-034; the shared union thread app.specira.ai/projects/dispatch-modernization/artifacts/security-requirements
specira [4] Threat model: TM-07 (the threat side), the anchored scales app.specira.ai/projects/dispatch-modernization/artifacts/threat-model
specira [5] Business rules: BR-03 override reason (the purpose limit) app.specira.ai/projects/dispatch-modernization/artifacts/business-rules#br-03
specira [6] Observability: the dashboard transparency question app.specira.ai/projects/dispatch-modernization/artifacts/observability-monitoring#questions
specira [7] Integration inventory: INT-5 system of record; the register the trigger watches app.specira.ai/projects/dispatch-modernization/artifacts/integration-inventory
Generated by Specira · template privacy_impact v2 (draft) · pack specira_default_delivery lineage 32e49429…f41f · page 1 of 4