Linking assessments to other entities

In MineOS, your compliance records aren't separate documents. They're connected parts of a single data map. A data source holds data types, processing activities explain why that data is used, assessments evaluate the risk, and risks track what needs to be done. Linking these records means a change in one place is reflected everywhere it matters, and you can trace any risk back to the systems and data behind it.

How records connect in MineOS

Record	What it represents	Connects to
Data sources	The systems and vendors in your inventory	Data types, processing activities, assessments, risks
Data types	The kinds of personal data each data source holds	Data sources, processing activities, assessments
Processing activities	The business purposes for using personal data	Data sources, data types, assessments
Assessments	Your evaluations of privacy, vendor, security and AI risk	All of the above, plus other assessments
Risks	The issues identified and tracked through to mitigation	Assessments, data sources

📸 [IMAGE: Diagram of how data sources, data types, processing activities, assessments and risks connect]

An example

Your team adopts a new CRM. You add it to your inventory as a data source, with the data types it holds, such as contact details and purchase history. You link it to the processing activities it supports, such as "Customer support" and "Marketing campaigns". You then run a vendor assessment on the CRM and a DPIA on the marketing activity, link the two assessments to each other, and add the risks they surface. Anyone opening the CRM's data source page can now see every assessment and risk connected to it.

Link assessments to your inventory

Assessment questions can connect directly to your inventory. Instead of typing in system names or data categories, you select data sources and data types from your data map. The data sourced and their inventory information are used as context for Mira AI when suggesting answers on an assessment.

Open the assessment.
In a question connected to your inventory, select the relevant data sources or data types.
Click Save.

📸 [IMAGE: Selecting data sources in an assessment question]

Because the answer is a link rather than text, it stays accurate when your inventory changes. When an assessment identifies data types or locations that aren't in your inventory yet, you can merge them back into your data map.

Link assessments to processing activities

Connect an assessment to the processing activities it evaluates. For example, link a DPIA to the high-risk activity it covers, or a legitimate interest assessment to the activity that relies on it. Linked activities are also used by Mira for extra context.

For more on processing activities, see Map business purposes with processing activities.

Link assessments to each other

Related assessments often depend on each other. A DPIA may rely on a transfer impact assessment, or several privacy assessments may follow the same internal policy. Linking them lets reviewers see the full context and keeps their statuses coordinated. Linked assessments are also used by Mira for extra context.

Open the assessment.
[confirm: where to link another assessment]
Search for and select the related assessment, then click Save.

A useful pattern: document an internal policy as an assessment, then link it to every assessment that applies it.

📸 [IMAGE: Linked assessments on an assessment]

Link risks to assessments

Identifying risks is the goal of most assessments. MineOS suggests risks based on the template type, your answers and the connected inventory. For example, it may suggest risks when an assessment involves international data transfers, sensitive data or a vendor with a weak security posture.

Review each suggested risk, then add it or dismiss it. You can also add risks manually. Added risks appear in your risk registry, linked to the assessment they came from.

📸 [IMAGE: Risk suggestions on an assessment]

Where connections appear

Links work in both directions, so you can start from any record:

On a data source page: the Compliance tab lists the assessments that reference that system.
In the risk registry: each risk shows its source assessment, across privacy, vendor and AI assessments.
On an assessment: linked records give reviewers the full picture.

Keeping connections accurate

Connected answers update as your inventory changes, so keep your data sources and data types current. If you restore an earlier version of an assessment, its links are restored as they were in that version, except for records that have since been deleted. See Track changes and export assessments.