The Red Clover Privacy Impact Assessment (PIA) is a critical step for companies as they change their personal information handling practices. Many U.S. state privacy laws require PIAs or data protection assessments (DPAs) when companies make changes to processes, products, or services. GDPR requires businesses to conduct a data protection impact assessment (DPIA), a more defined version of a PIA or DPA, when a processing activity is likely to result in “high risk” to the rights and freedoms of individuals. It outlines specific information that must be included in a DPIA, requires the input of a data protection officer (where applicable), and obligates companies to produce DPIAs on request to regulators.
Why Do You Need a Privacy Impact Assessment?
The PIA helps flag the privacy risks of a business process and enables a company to mitigate those risks before proceeding with the initiative. Privacy risk assessments are often required under privacy and data protection laws for companies engaging in data processing that represent a high risk to individuals. Of course, what constitutes a high risk varies across laws, adding more complexity.
Red Clover will work with you to understand your assessment obligations and build a risk assessment process that works for your organization. We will then use that process to identify potential privacy risks associated with a project, product, or service and help you find ways to mitigate those risks. We will help ensure you have appropriate processes in place, that privacy risks are flagged and mitigation steps are taken – and that all of it is appropriately documented. Read more about PIA’s in the Red Clover article “A Guide to Privacy Impact Assessments”.
Our Privacy☘PS® managed services team provides trained personnel to execute on projects and ongoing management of your programs, including establishing a PIA program, performing or reviewing PIAs that the business completes, and offering training on how to conduct a PIA.
Frequently asked Questions
A Privacy Risk Assessment (PRA), also called Privacy Impact Assessment (PIA), Data Privacy or Protection Assessment (DPA), or Data Protection Impact Assessment (DPIA), is an invaluable tool for enhancing trust and transparency in your operations, especially in today’s data-driven world. These assessments include a (1) review of the impact of privacy and (2) identification of risks related to the use of personal information in the context of a business activity. At its core, a PRA provides insight into how you collect, use, and manage personal data.
PRAs proactively identify and mitigate privacy risks in new or modified data processing activities, ensure compliance with data protection laws, and build consumer trust by demonstrating a commitment to protecting personal data. They are a crucial step in responsible personal data management and help solidify your reputation as a company that values privacy and security. Plus, conducting PRAs is often more than just a good idea; it’s both a regulatory requirement and a best practice in the era of data-driven decision-making.
Privacy Threshold Assessment (PTA)
A Privacy Threshold Assessment is the starting point for most businesses. It is the initial and highest-level review that determines whether a business activity needs a more in-depth privacy review like a PIA/DPA or DPIA. A PTA may be as simple as determining whether consumers’ personal data is impacted or customized to your organization’s operations. This flexibility allows you to tailor the assessment to fit the unique privacy risks and requirements of your business. A PTA can also help prioritize conducting Privacy Risk Assessments for existing initiatives.
Privacy Impact Assessment (PIA) / Data Privacy Assessment or Data Protection Assessment (DPA)
Once you confirm a business activity involves personal data, it is called a processing activity. A PIA or DPA takes a deeper look at identifying privacy risks that a processing activity might create. In some cases, PIAs/DPAs are required by law. So, make sure you know the rules for the jurisdictions that impact your use of personal data.
Data Protection Impact Assessment (DPIA)
In some regions or states, DPIAs are required for certain processing activities. You need to include specific information in the assessment, and there are obligations around consulting data protection officers, regulators, and rules around next steps when you identify significant risks as part of the assessment process.
Before Launching New or Modified Products or Services
A PRA at this stage ensures you are building on a foundation of privacy, enhancing customer trust from the get-go.
While Integrating New Technologies
A PRA helps navigate new technologies and innovations responsibly, ensuring your advancements don’t compromise user privacy.
Integrating New Technologies During Business Expansion
As you enter new markets, a PRA is vital for complying with local and international data protection laws, avoiding costly fines, and resonating with a privacy-conscious audience.
When Processing Activities Present A Heightened Risk of Harm
A PRA helps you proactively uncover any areas where data processing might inadvertently harm individuals’ privacy (e.g., targeted advertising, processing sensitive data, sale of data, profiling under certain conditions).
Post Data-Breach
If you experience a breach, a PRA is critical for assessing the damage, strengthening your defenses, and restoring public trust.
New or Changing Product or Service Offering
- A new use of existing personal data to improve upon a product or service offering.
- A new product or service engaging in targeted advertising, sale of personal data, profiling, handling sensitive information, and/or large volumes of data.
- Collection of new personal data to improve upon a product or service offering.
- Sharing personal data with a third party to support a product or service offering.
New or Changing Processes
- A new use case or disclosure of existing personal data.
- A decision to keep personal data for longer than designated in the retention schedule or as disclosed in the Privacy Notice.
- Changes to the regulatory context in which a process operates.
New or Changing Technologies
- Implementing Artificial Intelligence (AI)
- A change in the way personal data is stored or secured.
- A new system or system upgrade.
- Retiring or modifying an existing legacy system or application.
- A new way of collecting personal data (e.g., screen scraping).
- A new business process supported by IT tool(s).
- Engaging a third party to provide an IT service or application.
- Type of processing: Some processing activities result in higher risks to individuals, like tracking, profiling, and selling or sharing personal data.
- Type of personal data: Some categories of personal data involved in the processing may be considered sensitive, meaning its loss or inappropriate exposure would mean high risk to individuals.
- Type of individual (person, aka data subject): Some individuals need more protection than others, like children or other vulnerable groups.
- The jurisdictions that apply to you: Laws requiring privacy reviews differ based on jurisdiction, so it’s important to know what jurisdictions apply to the processing activities to know your legal obligations. For example, this information will help you understand if a DPIA is required.
Understanding the Different Assessments
Assessing privacy risk has turned into an alphabet soup of acronyms! PIAs, DPAs, PRAs, DPIAs – what’s the difference? Is there a difference? As it turns out, yes, there is. The goal of all of these assessments is the same: Identify the privacy risk of a project, initiative, technology change, etc. – preferably before you implement it. And, in general, laws require them in similar circumstances: When a processing activity is likely to represent a “heightened risk” to an individual. Though, there are specific processing activities that require a privacy risk assessment, and those vary from one jurisdiction to the next. On top of that, DPIAs are much more prescriptive than other assessments. The EU GDPR – and many national data protection laws – outlines specific information that must be included in a DPIA, requires consulting your data protection officer (where applicable), and where the DPIA finds high risk, companies must consult their regulator. Red Clover will help you select the appropriate tool.
Privacy Impact Assessment
Privacy Impact Assessment Scoping & Discovery Involves working with business owners to identify the privacy risk of a project, initiative, technology change, and/or when processing activities present a heightened risk of harm. This process also involves customizing and identifying things like new or modified data processing activities to ensure compliance with data protection laws.
Privacy Impact Assessment Create Assessment Template Customized for your organization, the assessment template will be used to ask business owners about their business processing activities to better understand the personal data that is collected, used, stored, and shared and the privacy risks associated with it and what mitigation measures are in place.
Privacy Impact Assessment Execute & Review Assessment Whether using software or a manual assessment, Red Clover Advisors will review the answers provided by the business owners. During this review, we’re looking for completeness and accuracy, and dive deep into privacy risks and subsequent mitigation measures. We’ll formalize any findings into a prioritized summary report with our suggested remediations.
Privacy Impact Assessment Software Implementation For companies looking to implement and use a privacy software platform, Red Clover Advisors can help you set this up from start to finish. We will make sure that it is customized and works properly for you.
Privacy Impact Assessment Develop Policies, Processes, and Procedures We will develop a privacy impact assessment policy which identifies the requirements of privacy laws that apply to your organization, types of processing activities, types of personal data, and types of individuals. It will also include how often a PIA/DPIA should be performed, how to address changes in the business, and how to include those in a PIA/DPIA.
Privacy Impact Assessment Training We will provide training on how to use the privacy software, how to execute an assessment, what to look for in an assessment, and what type of processing activities and personal information needs to be included in a PIA/DPIA, and what type of privacy risks and mitigation measures to look for.
Privacy Impact Assessment Maintenance, updates, and ongoing assessments We will help with maintaining a PIA/DPIA and updating it on a periodic basis, as well as finding new activities that require an assessment. For some companies, this might be an annual task, while for others, it could involve ongoing updates to capture all the new changes in the business.
Want to Know More About Privacy Impact Assessments?
