Before GDPR, PIA (Privacy Impact Assessment) were a thing. This topic is around privacy impact assessment, its purpose, PIA vs DPIA and includes the underlying context of GDPR compliance. The monotony has been changed since the General Data Protection Regulation (GDPR) came into existence; it has significantly changed the concept of data privacy and security. This is the first regulation that influences the business paradigm by making it necessary to address a data protection model in their business strategy. Other than defining the individual rights to protect their data, data controller and data processors duties, handling and reporting the data breaches etc., it has openly assigned and mandated the rule to help businesses secure the data and manage the risk of individuals’ data and rights.
Privacy Impact Assessment is one of the assessments suggested by the GDPR to businesses that process personal data. This article aims to cover the important aspect of privacy impact assessment, often conversely used as Data Protection Impact Assessment.
What is the purpose of a privacy impact assessment?
Privacy Impact Assessment is part of the risk management process used to analyse how an organisation or controller collects, uses, shares, processes, and maintains personal data. PIA identifies the potential impact that any new project might propose on the existing information system, program, policies, services, or other related aspects of the project that later affect the individuals’ privacy. It also outlines the instructions and other activities to minimise and reduce the impact.
Privacy impact assessment and data protection impact assessments are used interchangeably in many situations. They are more or less the same, but there is a thin line that differentiates the both.
What is the difference between Privacy Impact Assessment (PIA) and DPIA (Data Protection Impact Assessment)?
To make it easy to read, PIA vs DPIA is differentiated in the context of GDPR. With GDPR, Data Protection Impact Assessment has replaced privacy Impact Assessments, also known as PIAs. Without GDPR, PIA is a process aimed at achieving privacy in an organisation. It could be a product launch, a new company offering or another project.
PIA and DPIA are separate processes because the former deals with achieving privacy by design, and the latter deals with risks associated with the processing of personal data.
PIA and DPIA difference
Privacy Impact Assessment is a standard process that deals with achieving privacy by design through business processes and technical policies and controls. These are used to identify and mitigate organisational level privacy risks, whether it’s a new product range launch, new acquisition or business process.
The Data Protection Impact Assessment (DPIA) is used to assist an organisation in identifying and mitigating risks associated with the processing of personal data. Under GDPR, EU member states have published their own guidelines when DPIA is necessary. Some of these examples are the processing of sensitive data and automated decision making and profiling.
In the context of GDPR, DPIA (Data Protection Impact Assessment) was previously known as PIA. The DPIA classifies the data processing risks of personal data to exclude or reduce them to an acceptable level. Compared to privacy impact assessment, DPIA is an ongoing assessment and applies to data processing prone to high risk or violation of individuals rights and freedom of natural persons.
Is a privacy impact assessment (PIA) mandatory?
Privacy impact assessment (PIA) is not mandatory for public or private businesses but having an appropriate PIA strategy is always helpful in identifying privacy gaps in operational processes and improving privacy maturity in any project or performance task.
When should a Privacy Impact Assessment be conducted?
Privacy impact assessment is recommended at the beginning of any project design or development that includes personal data. PIA is performed to manage the new project and data processing requirements. It is equally equipped in analysing privacy risk when planning changes to an existing system.
Under the GDPR, PIA is required to take a high risk over individual data rights and freedom. It is more beneficial to consider PIA in the project lifecycle from beginning to end to identify privacy risk as early as possible and before the project goes into production or is set out for release. For a project involving any personally identifiable information, the controller should undertake the PIA as a proactive approach and address the risk first and economically. However, it is not supported but can be incorporated after the project is processed or implemented.
How to do a privacy impact assessment?
The process of conducting GDPR privacy impact assessment and data protection impact assessment is pretty similar; privacy impact assessment (PIA) typically involves four stages:
Defining the context of personal data processing
The first step to conducting a privacy impact assessment is to examine whether or not the project involves any personally identifiable information (PII) such as person name, age, nationality, gender, financial, medical or criminal information, national identity number, phone number, email addresses, credit card data, etc.
If your project contains any PII, you must conduct a privacy impact assessment; otherwise, there is no need to do so.
Establishing controls to ensure compliance with the fundamental principles
Once you identify the need to perform PIA, you must define how to compile the personal data. To establish a privacy controlled mechanism, you need to identify the critical characteristics of the project that might trigger the privacy risks by examining the project through consideration, such as
- What activities will be involved in processing operations?
- Does the data processing occur on a lawful basis as defined by GDPR?
- What will be the information flow in the project?
- Will the data be shared with any third party?
- What technology will be involved in the processing of data, etc.?
- What will be the data retention period?
By analysing the requirements mentioned above, you will identify and establish necessary controls to meet privacy compliance and its impact on securing the data.
Assessing associated privacy risks
This critical step examines the privacy risk associated with the project and personal data. It involves the detailed analysis and classification of privacy issues and their solutions by estimating the relevant legal procedures and regulatory requirements for the project necessities.
This solely focuses on all the gathered information in the previous stages to make a firm decision to mitigate risk and its impact on the identified project or performance task with the proposed solutions and their benefits.
Validating the obtained data protection level
In the end, the privacy impact assessment (PIA) directed the project decisions based on identified issues and solutions. It supports addressing a privacy-focused approach for the project processing by determining the due diligence. It allows the project team, controller, and stakeholder to decide on overall findings and analysis to maintain data protection and privacy throughout the project and processing.
Example of Privacy Impact Assessment
You can download this excellent template by IAPP that defines the data protection issues, code of conduct, assessment and mitigation measures before concluding. The conclusion column helps organisation perceive their risk appetite whether the risks are sufficiently mitigated, acceptable or none of these.
https://iapp.org/media/pdf/resource_center/dpia-template.pdf
Watch the following video for Data Protection Impact Assessment basics from OneTrust.
Final Thoughts
Managing data risk and privacy often becomes a nightmare for many businesses because not every piece of data is the same, nor every piece of information requires high priority protection.
Get in touch with us to discuss data privacy challenges faced in the evolving landscape of risk and threats. Our data privacy and compliance assessment deliver the results by GDPR requirements and business needs.
Shahrukh, is a passionate cyber security analyst and researcher who loves to write technical blogs on different cyber security topics. He holds a Masters degree in Information Security, an OSCP and has a strong technical skillset in offensive security.
