Privacy Impact Assessment

What is Privacy Impact Assessment [PIA]?

Privacy Impact Assessments are used to determine the level of risk that your processing activities pose to individuals' rights and freedoms. Based on the results of this survey, you assess the project's privacy risks and implement appropriate mitigation measures and controls.

In short, PIA is a process that helps organizations identify and minimize the privacy risks of new projects or policies.

How is it different from Data Protection Impact Assessment?

While these terms are frequently used interchangeably, the term DPIA is clearly defined in the GDPR and includes specific elements (specified in article 35) that must be captured when a DPIA is conducted.

While Data Protection Impact Assessment is a legal requirement that is not always mandatory, all organizations that process personal data should have privacy impact assessment integrated as a valuable organizational practice.

While DPIA should be kept in a GDPR-compliant format, PIA can be kept in a more flexible format. A brief risk analysis or survey can be used as an example of privacy impact assessment and can be used to determine whether DPIA is required. 

PIAs are practical tools for identifying privacy risks and accelerating an organization's ability to manage data privacy and privacy processes.

How to do PIA?

PIA can be all-encompassing as it is a flexible process that must consider the balance between the risks and benefits of the processing activity.

Some laws in the United States may require you to conduct a PIA, and in that case, it should be considered that each state's laws and practices and PIA requirements must be addressed separately. PIA is not directly mentioned in GDPR.

For example, the California Privacy Rights Act (CPRA) establishes a fairly broad threshold for performing a PIA.

Data controllers must balance the risks and benefits of the processing activity and include context, the relationship between the controller and the consumer whose personal data will be processed, reasonable consumer expectations, and anonymized data in their PIAs. It is important that PIAs do not become pointless box-checking exercises.

Using a concise set of screening questions to determine the extent to which a PIA is required can help prioritize projects and maximize the use of limited resources. PIAs can also be used as auxiliary tools in the development of DPIAs.

You can automate this process by requiring project teams to describe their proposed data processing activities at a high level and answer a few key screening questions online.

For those who want to focus on the DPIA requirements of the GDPR, you can limit the screening questions to the high-risk areas defined in the GDPR, ICO lists, and related guidance.

In addition to screening questions, it is advantageous for the project kickoff documents to request fundamental information about the project context and participants. This information can serve as the foundation for descriptions of processing activities, consultations with interested parties, and risk assessments.