Platform privacy impact assessments (PVK)

While nais platform components are used by the teams, the platform in itself is "data agnostic" - that is, the platform team does not know what kind of data is stored and processed on the platform. As such, it is up to each team to perform a privacy assessment for their data processing and storage needs.

The exception to the data agnostic rule is data that the platform itself is the processor of - such as configuration data and certain system and access logs (not including application logs, which falls under each individual team's purview). Thus, the only personally identifiable information (PII) that the platform processes are access logs for developers at NAV. A PVK for this data processing has been conducted.

For details on what each team's responsibilites are with respect to data processing on the platform, refer to roles and responsibilities.