# NIST Privacy Framework IDENTIFY Implementation Workflows

## Workflow 1: Data Processing Inventory
1. Identify all systems processing personal data (ID.IM-P1).
2. Assign processing owners (ID.IM-P2).
3. Map data subject categories (ID.IM-P3).
4. Document data actions (ID.IM-P4) and purposes (ID.IM-P5).
5. Inventory data elements (ID.IM-P6).
6. Create data flow maps (ID.IM-P8).
7. Cross-reference with Art. 30 RoPA.

## Workflow 2: Risk Assessment
1. Identify contextual factors (ID.RA-P1).
2. Identify problematic data actions from NIST taxonomy.
3. Assess likelihood and severity (ID.RA-P4).
4. Determine risk responses (ID.RA-P5).
5. Document in risk register aligned with DPIA format.

## Workflow 3: Ecosystem Risk Management
1. Inventory third-party processors (ID.DE-P2).
2. Conduct due diligence assessments.
3. Verify DPA compliance (ID.DE-P3).
4. Establish ongoing monitoring (ID.DE-P5).