Privacy Impact Assessments (PIAs) – CDPSE Privacy Risk Management and Compliance Guide
Privacy Impact Assessments (PIAs): A Complete CDPSE Study Guide
1. Why Privacy Impact Assessments Are Important
A Privacy Impact Assessment (PIA) is one of the most important tools in a privacy program. It is the main way an organization finds, analyzes and reduces privacy risks before they turn into harm, regulatory penalties or reputational damage. For the CDPSE (Certified Data Privacy Solutions Engineer) exam, PIAs connect governance, risk management and technical privacy engineering.
PIAs matter for six main reasons:
Privacy by Design
PIAs put the Privacy by Design principle into practice. Privacy requirements are built into systems from the start instead of being added later. This is cheaper and more effective.
Regulatory compliance
Many laws require or strongly encourage impact assessments. Examples include:
- GDPR Article 35, which requires a Data Protection Impact Assessment (DPIA) for high-risk processing.
- The U.S. E-Government Act of 2002, which requires PIAs for federal agencies.
- Brazil's LGPD.
- Various state laws, such as the CPRA's risk assessment requirements.
Risk reduction
PIAs find threats to individuals' privacy, such as:
- unauthorized disclosure
- excessive collection
- function creep
- re-identification
Accountability and evidence
A documented PIA shows due diligence to regulators, auditors, customers and business partners.
Trust and transparency
Organizations that assess privacy impacts, and sometimes publish PIA summaries, build trust with data subjects.
Better decisions
PIAs give management the information it needs to accept, mitigate, transfer or avoid privacy risks before investing in a project.
2. What a Privacy Impact Assessment Is
A PIA is a systematic, documented process that assesses how a project, system, product, service or business process collects, uses, stores, shares and disposes of personal information. It also identifies and evaluates the risks this creates for individuals, not just for the organization, and recommends controls to reduce those risks.
Key terms to know:
PIA (Privacy Impact Assessment)
The general term, used widely in the U.S., Canada, Australia and in ISO/IEC 29134.
DPIA (Data Protection Impact Assessment)
The GDPR term. It is mandatory when processing is likely to result in a high risk to the rights and freedoms of natural persons.
PTA (Privacy Threshold Analysis)
Also called a privacy screening or threshold assessment. It is a short preliminary questionnaire that decides whether a full PIA is needed.
ISO/IEC 29134
The international standard that gives guidelines for conducting PIAs.
Related but distinct assessments
- Security risk assessment: focuses on confidentiality, integrity and availability of assets, mainly from the organization's point of view. A PIA focuses on the impact on individuals and on compliance with privacy principles.
- Transfer Impact Assessment (TIA): evaluates cross-border data transfers, for example after Schrems II.
- Legitimate Interest Assessment (LIA): evaluates whether legitimate interest is a valid lawful basis.
- Vendor or third-party privacy assessments.
When a PIA should be performed
- When a new system, application or technology that processes personal data is introduced.
- When existing processing changes significantly. Examples include new purposes, new data categories, new recipients, new technologies or new locations.
- During mergers, acquisitions or outsourcing.
- When high-risk processing is involved. Common examples are:
- large-scale processing of sensitive or special category data
- systematic monitoring of public areas
- profiling or automated decision-making with legal or similarly significant effects
- biometrics
- processing children's data
- combining datasets
- innovative technologies such as AI or IoT
- Periodically, as part of continuous monitoring, because a PIA is a living document.
Who is involved
- Project or system owner: usually accountable for completing the PIA and implementing its recommendations.
- Privacy office or DPO: gives advice, reviews the PIA and monitors it. Under GDPR, the controller must seek the DPO's advice.
- Other stakeholders: IT and security, legal and compliance, business units, privacy engineers and vendors or processors.
- Data subjects or their representatives: their views may be sought where appropriate.
- Senior management or the risk owner: approves residual risk.
3. How a Privacy Impact Assessment Works
Methodologies vary (ISO/IEC 29134, the ICO DPIA template, the CNIL PIA tool, NIST guidance), but they generally follow this lifecycle:
Step 1 – Threshold analysis (screening)
Answer key questions to decide whether a full PIA is required. Does the project involve personal data? Sensitive data? New technology? Large scale? Profiling? If the threshold is met, carry out a full PIA.
Step 2 – Planning and scoping
- Define the scope, objectives and boundaries.
- Identify stakeholders and assign roles.
- Set a timeline aligned with the project lifecycle (SDLC). The PIA should start early, ideally in the requirements or design phase.
Step 3 – Describe the processing
- Document the nature, scope, context and purposes of processing.
- Build a data inventory and data flow diagrams that cover collection, use, storage, sharing, transfer, retention and destruction.
- Identify data categories, data subjects, sources, recipients, processors, locations and cross-border transfers.
Step 4 – Assess necessity and proportionality / compliance
Check the processing against privacy principles and laws. These include:
- lawful basis
- purpose limitation
- data minimization
- accuracy
- storage limitation
- transparency and notice
- consent
- data subject rights
- security
- accountability
- transfer mechanisms
Step 5 – Identify privacy risks
Identify threats and vulnerabilities that could harm individuals. Examples include:
- illegitimate access
- unwanted modification
- data loss
- over-collection
- secondary use
- re-identification
- discrimination from profiling
- surveillance
- loss of control
Step 6 – Analyze and evaluate risks
- Rate each risk by likelihood and severity of impact on individuals, using qualitative or quantitative scales.
- Prioritize the risks using a risk matrix.
Step 7 – Identify controls and mitigation
Recommend measures that address the risks:
- Technical: encryption, pseudonymization, anonymization, access controls, logging, privacy-enhancing technologies.
- Organizational: policies, training, contracts and DPAs, retention schedules.
- Design changes: collecting less data, shortening retention, adding consent mechanisms.
Step 8 – Residual risk and sign-off
- Evaluate the remaining risk after controls are applied.
- The appropriate risk owner or management formally accepts or rejects residual risk.
- Under GDPR Article 36, if high residual risk cannot be mitigated, the controller must consult the supervisory authority before processing.
Step 9 – Reporting and integration
- Produce the PIA report.
- Integrate the recommendations into the project plan and system requirements.
- Track remediation actions to closure.
- Some organizations, especially public bodies, publish summaries.
Step 10 – Review and monitor
- Revisit the PIA whenever processing changes, after incidents, or on a scheduled basis.
- Keep the PIA as a living document linked to the records of processing activities (RoPA).
Minimum DPIA contents under GDPR Article 35(7)
- A systematic description of the processing and its purposes, including any legitimate interest pursued.
- An assessment of necessity and proportionality.
- An assessment of the risks to the rights and freedoms of data subjects.
- The measures planned to address those risks, including safeguards and security measures.
Outputs and benefits
- A risk register entry.
- Privacy requirements for system design.
- Evidence of compliance.
- Inputs to privacy notices.
- Vendor contract requirements.
- Updates to data inventories.
4. Common Pitfalls
- Doing the PIA too late, after the system is built. This makes it a checkbox exercise.
- Treating the PIA as a one-time activity.
- Focusing only on organizational risk and ignoring harm to individuals.
- Not involving the right stakeholders.
- Failing to track and implement the recommendations.
- Confusing a PIA with a security assessment.
5. Exam Tips: Answering Questions on Privacy Impact Assessments
Tip 1 – Timing is everything
When a question asks when a PIA should be performed, the best answer is almost always as early as possible: during planning, requirements or design, before processing starts or a system is acquired or developed. Be wary of answers like "after implementation" or "during user acceptance testing."
Tip 2 – Know the trigger events
A new system, a new technology, a significant change in processing, a new purpose, new data sharing, an acquisition or outsourcing should all trigger a PIA or a PIA update. If a scenario describes a change, look for the answer that reassesses privacy impact.
Tip 3 – Threshold first
If asked about the first step in deciding whether a PIA is needed, choose the privacy threshold analysis or screening. If asked about the first step within a PIA, look for scoping or identifying and describing the data flows and personal data involved. You cannot assess risk without knowing what data is processed.
Tip 4 – Focus on the individual
The defining feature of a PIA is that it assesses risk to data subjects. If the answer choices separate "risk to the organization" from "risk to individuals' rights and freedoms," the privacy-centric answer is usually correct.
Tip 5 – Primary purpose
The main purpose of a PIA is to identify and mitigate privacy risks and to ensure privacy is considered in design. It is not mainly to produce documentation, satisfy auditors or assign blame.
Tip 6 – Ownership versus advice
The business or project owner, or controller, is typically accountable for conducting the PIA and implementing its results. The privacy officer or DPO advises and monitors. Senior management or the risk owner accepts residual risk. Watch for questions that test who approves versus who performs.
Tip 7 – Residual risk and prior consultation
If high residual risk remains after mitigation under GDPR, the controller must consult the supervisory authority before processing. On "what next" questions, consider escalation to management, then regulator consultation if required, or redesigning the processing.
Tip 8 – Living document
Choose answers that reflect continuous review, such as updating the PIA after changes or incidents, rather than one-time completion.
Tip 9 – Practical engineering link
CDPSE is technical. Expect questions where the PIA output becomes privacy requirements in the SDLC, such as data minimization, pseudonymization, encryption, access control or retention controls. The best answer often integrates PIA findings into design specifications and tracks them through testing.
Tip 10 – Distinguish assessments
Know the differences between a PIA or DPIA, a security risk assessment, a TIA, an LIA, a vendor assessment and a privacy audit. An audit checks compliance against criteria after the fact, while a PIA is proactive and forward-looking.
Tip 11 – Read for qualifiers
Words like BEST, FIRST, MOST important and PRIMARY matter. Several options may be true. Pick the one that is most proactive, most risk-based and most aligned with protecting individuals.
Tip 12 – Data inventory and data flows are foundational
Many questions hinge on the fact that an accurate data inventory or data map is a prerequisite for a meaningful PIA.
6. Sample Exam-Style Reasoning
Example 1: A company plans to deploy facial recognition at building entrances. What should the privacy engineer do FIRST?
Best answer: Perform a PIA or DPIA (or a threshold analysis leading to one) before deployment.
Reasoning: This is biometric, high-risk processing involving new technology, so a proactive assessment is needed before anything else.
Example 2: A PIA identified risks, and controls were applied, but significant risk remains. What is the NEXT step?
Best answer: Escalate the residual risk to the appropriate management or risk owner for a formal acceptance decision. Under GDPR, consult the supervisory authority if high risk remains.
Example 3: What is the PRIMARY benefit of performing a PIA during the design phase?
Best answer: Privacy controls can be built in cost-effectively (Privacy by Design), avoiding costly retrofits.
7. Quick Summary
- A PIA is a proactive, systematic, documented assessment of how processing affects individuals' privacy.
- It is triggered by new or changed processing, and is mandatory as a DPIA for high-risk processing under GDPR.
- Its lifecycle is: threshold, scope, describe data flows, assess necessity and compliance, identify and evaluate risks, mitigate, sign off on residual risk, report and integrate, then monitor and review.
- On the exam, favor answers that are early, risk-based, individual-focused, integrated into the SDLC and continuously maintained.
