The Data Protection Assessment (DPA) is designed to assess how developers use, share, and protect User Data and/or Device User Data, as defined in the Developer Data Use Policy (collectively referred to as “User Data”). Completing a Data Protection Assessment annually is a requirement for any app that accesses, transmits, or stores User Data.
The administrators for your organization will be sent a link to complete the questionnaire by a specific deadline. If they cannot complete the assessment by the deadline, your app will be removed from the Meta Horizon Store and risk losing access to the advanced platform features altogether.
Data Protection Assessment (DPA) differs from Data Use Checkup (DUC)
Data Protection Assessment evaluates whether developers comply with Meta policies covering prohibited uses of data, data deletion, data sharing with third parties, and data security. Data Use Checkup is how developers request access to the features they need to operate their app and certify their general compliance with the Developer Data Use Policy.
Meta strongly recommends consulting with legal, policy, and data security experts within your organization for guidance on addressing certain questions. Providing incomplete or vague answers may result in further investigation and loss of platform access.
Before you start
To prepare for the Data Protection Assessment, we recommend that you:
Watch a video on Submitting a Data Protection Assessment. Get the clarity you need fast with our new Trusted Developer Essentials video course featuring tips and resources from Meta experts and Data Protocol to gain a better understanding of the process.
Review our Developer Data Use Policy in detail, and be sure you’re able to answer questions on how your app is complying with these terms.
Gather relevant documentation such as your privacy policy, information security certificates or policies, service provider lists, and your contracts with your service providers (which could include standard terms of service for those service providers).
If you are an organization admin and you are required to complete the Data Protection Assessment, you will receive email communication from us.
Deadline
Deadlines, which are unique to each app, will be communicated to your organization admins via an email containing the link to the DPA.
You can also check all current requirement deadlines by going to Requirements > Tasks and looking under the Deadline(s) column. You can also change the sort order to ascending or descending by clicking on the column header.
Request Extension
You can extend your DPA deadline by clicking on Request Extension button under Requirements > Tasks, which will give you 20 more business days to complete the assessment.
Submit an assessment
You don’t have to complete the Data Protection Assessment in one sitting. Once started, scroll down to the bottom of the assessment and click on Save Draft, to the left of the Submit button. Your progress will be saved and your DPA will be put into a Draft status where you can return to it at any time.
In the left-side navigation, click Requirements > Tasks.
On the Tasks page click on the drop down menu under Status. There are four statuses a DPA could be listed under, Action Required, Draft, Resolved, Under Review. To find a DPA that requires action, select the Action Required status or check the Hide all resolved items box to the far right of the drop down menu. This will display all requirements as row items that need to be resolved, as well the new DPA.
Next, click the View button on the right of the row for the DPA you wish to start. Alternatively, you can go to Requirements > Summary and see an overview of all requirement statuses. If you have a DPA listed with an Up next status, you can click on the Go to Tasks button to navigate directly to the View tab.
If there isn’t a DPA in Action Required or Draft status, you don’t need to complete an assessment at this time.
When you are ready to start the assessment, click on the Resolve button in the View tab. This will start the assessment.
Step 2. Start the assessment
Provide information about the data you access. Depending on the responses to the Data Protection Assessment, you may be asked to provide additional documentation.
Note: Please read all parts of the form to make sure you understand all required information and can provide accurate responses to all the questions.
If you use service providers, you should gather relevant contracts where a service provider collects or processes User Data and/or Device User Data on your behalf. Keep in mind, contracts include written agreements such as a Terms of Service. You will be asked to examine these contracts and confirm that they state that:
They can only access User Data and/or Device User Data for a legitimate business purpose
They can only use User Data and/or Device User Data at your direction and/or to provide the service you requested.
They have a service level agreement related to breach notification and responsiveness to inquiries from you.
They will reasonably protect User Data and/or Device User Data, including using the same level of security that you maintain.
They will notify you in the event there is a compromise of User Data and/or Device User Data.
They comply with Developer Data Use Policy for any User Data and/or Device User Data they receive from you.
They delete the User Data and/or Device User Data they received from you when you cease using their service.
If you share data to comply with legal regulations, you may need to provide:
An explanation of the circumstances in which you share User Data to comply with a legal or regulatory requirement.
If you share data with a third party because users tell you to, you may need to provide:
A description of how users direct you to share User Data with another person or business.
Include screenshots if applicable.
If you have information security practices in place to protect user data and/or device user data, you will need to provide:
A description of your Information Security Practices. (Learn more.)
If you have a data security certification, you will need to provide:
A copy of that data security certification. (Learn more.)
If you do not have a data security certification, but you do take steps to protect the security of user data, you may need to provide:
Policy or procedure documents, software configurations, screenshots, or screen recordings that illustrate the steps you take to protect the security of User Data. (Learn more.)
Step 3. Submit your information
Once you have answered all questions, click the Submit button at the bottom of the form. The Submit button will become clickable once all questions are answered, allowing you to proceed.
A pop-up window will appear, with the following warning:
Once you submit your assessment for [Your app name here], you will not be able to edit your responses. Your answers will be reviewed by our team. By submitting this assessment, you represent and warrant that the responses you provide are true and accurate to the best of your knowledge.
If all information is accurate, click the Submit button on the pop-up window to submit your DPA for review.
Check the status of an assessment
In the Developer Dashboard, go to your app, and go to either Requirements > Summary to see an overview of all requirements or Requirements > Tasks and click on the drop down menu under Status to select Under Review or check the Hide all resolved items box to the far right of the drop down menus to see any requirements that are still in progress.
Note: The Summary and Tasks pages will display requirements in all statuses for reference later.
Request for more information
If more information is required by Meta reviewers after submitting your DPA, a “Request For Information” (RFI) will be sent and found under the Tasks page for your organization. Each RFI will have its own self-contained instructions you will need to resolve for each specific case. Your organization admins should check Requirements regularly for your app but they should also receive an email notification about any new RFI or violations that need to be addressed.
Learn more
Visit the Developer Blog post to learn more about why the Data Protection Assessment is required.
