Happy first day of November! I hope you are feeling refreshed with your extra hour of sleep.

I’ve spent the last few weeks talking to multiple companies about documenting activities into a Privacy Impact Assessment (PIA) and thought it would be helpful to share some overall themes and learnings from doing so. Maybe these will make you feel better that your company is not “the only one” doing what you wished they wouldn’t OR you’ll pick up on a risk to add to your next PIA.

A PIA is one of the best ways to find the difference between what a business thinks is happening and what’s actually happening. The result of completing one is what fancy privacy people call “privacy risks or findings.”

Alas, what I have found and in no particular order…

1. Many companies do not have a process in place to get PIAs done

The ones I’m completing are the first few getting documented, which means it’s creating and updating templates, explaining to people we’re not auditors, and that we’re trying to understand a process, document it, and ultimately find privacy risks so they can be mitigated.

Without a process, PIAs only happen when someone remembers to ask, which is usually after a vendor is signed or a feature has already launched. By then, changes are harder and more expensive to make.

2. Too many people have access to systems

We often find that entire teams and even multiple departments all have access to software that they do not need. Onboarding seems to be the bigger challenge, as many are tied to Single Sign-On (SSO), so that means when someone leaves they no longer have access (this is a good thing).

Access is often granted with the thought that people MIGHT need to use the software. That’s not the same as actually needing that access, though. Companies need to create better access controls and not let everyone into a system.

Remember, we just celebrated cybersecurity awareness month and too much access isn’t just a privacy issue; it’s a security issue. Every extra account is another door for an attacker and another person who could accidentally download, share, or delete data (which I also find happens a LOT more than it should).

3. Knowledge is siloed

Multiple times, people didn’t know how a software was actually implemented or how it worked. When asked “who did xyz,” most teams said “I don’t know,” ask this ‘fill in the blank’ department. This happened with pixels, SDKs, and good ole java script.

Companies need owners of tools, software, code, and tracking technologies. Imagine if it breaks – who would be able to fix it? That might be the starting point to understand how it got there in the first place.

This matters for privacy because you can’t protect, disclose, or delete data you don’t know is being collected. If no one knows what a pixel or SDK is sending, no one can confirm it matches the privacy notice or honors an opt-out.

4. Keeping data forever

This comes up ALL the time when companies are keeping data forever. Many software tools allow data exports, which means most of the time anyone can export it. Now all that information is replicated on a shared or local drive. Those exports are often uploaded into AI tools.

The data in the software tool is kept forever. The data in the exports is kept forever. The data in the LLM – who knows? Many companies haven’t addressed that yet. (Hint – you should and can get started with my LinkedIn AI Governance Course!)

Keeping data forever adds risk without adding value. The more you keep, the more is exposed in a breach, the more you have to search through data for access and deletion requests, and it becomes harder to explain why you still have it.

5. The business process doesn’t match the privacy notice

I say this all the time – the privacy notice should match what the company is doing. It often doesn’t. The business moves forward with its activity before privacy reviews to determine is it already disclosed and covered in the privacy notice?

A privacy notice that doesn’t match reality is more than a housekeeping issue. Regulators look closely at whether companies are doing what they say they’re doing, and a mismatch can be treated as a deceptive practice (this is true in privacy laws AND unfair & deceptive practices).

6. Pixels are dropping without proper consent management 

We’re seeing pixels firing where they require consent, no way to opt out, or not being properly categorized. I’ve talked about this a TON in many newsletters, articles, and LinkedIn posts because it’s a topic that needs a lot of attention in companies.

Cookie/Pixel/Tracker governance starts with the very first idea of a pixel all the way to offboarding. I have a LOT to say about this topic that I can’t possibly do in this little space. Having a working, systematic process for knowing which pixels are on the site, documenting their purpose, having the appropriate vendor agreements and diligence performed (remember Delaware’s new requirements for diligence!), and all the proper disclosures/opt-out functionality is what keeps companies compliant.

Did any of these resonate with you?

The companies I’m working with want to do the right thing. They are trying to balance business processes moving quickly and privacy compliance that is complex and requires time and resources with technology that also keeps changing with AI-everything. Every PIA completed helps the company move towards a more privacy-focused environment.

Here are a few questions to help you determine where you might want to focus your attention next:

  • Do you have a repeatable process (and template) for completing PIAs?
  • Who has access to your key systems, and do they actually need it?
  • Is there a named owner for every tool, pixel, and SDK?
  • How long are you keeping data, including exports and anything uploaded into AI tools?
  • Does your privacy notice reflect what the business is actually doing today?
  • When was the last time you audited the pixels on your site?
  • Do you know which AI tools employees are using, and what data is going into them?
  • Could you explain to a regulator why you’re keeping the data you have?

We highly encourage companies to pick one higher-risk activity, like a new AI tool or your marketing tech stack, run a PIA on it, and use what you learn to build the process for the next one. The more PIAs performed, the more easily companies can figure out what questions did or didn’t work, what part of the process needs tweaking, and how software can help improve the process.

Want to go deeper? Everything you need to know about PIAs is in our comprehensive Guide to Privacy Impact Assessments (readers love this one): 

We love helping companies get started building out privacy programs. If this has you scratching your head out of frustration or confusion, or you just feel overwhelmed (what we hear most often), let’s chat. We’ll help you sort out the highest-risk areas with the best use of your time and resources.

Have a great week!

Jodi

💡 When you’re ready, here’s how we can help:

⚙ Privacy Advisory & Implementation: We help companies navigate privacy requirements with confidence. Our advisory support covers strategy, operations, and real-world implementation.

⚙ Fractional Privacy Services: We provide fractional privacy leadership tailored to your needs and pace. From program development to day-to-day support, we help you build and sustain a strong privacy program.