As discussed in the Privacy Impact Assessments video, the Privacy Impact Assessment $($PIA$)$ is a general staple for many government organizations, as well as GDPR$-$compliant tenant environments. When performing a PIA against internal departments or organizations, you are usually looking to achieve very specific and objective outcomes. These scenarios may include determining the risks associated with data privacy or sharing, examining protective processes to mitigate potential privacy risks, or addressing legal, regulatory, or policy requirements.

The US Department of Homeland Security has highlighted several key considerations that serve as guidelines for the PIA process within the department, and assist with identifying and mitigating privacy risks within public and government organizations. These include:

B

What personally identifiable information $($PII$)$ is being collected?

Why is the PII being collected?

How will the PII be collected, used, accessed, shared, safeguarded, and$/$or stored?

Now that you have an understanding of the components of a PII, choose from one of the sample scenarios that the

DHS highlighted, and perform a PIA for a specific area of your organization. Examples include:

$$

Developing or procuring a new technology or system that handles or collects PII.

Creating a new program, system, technology, or information$-$collection method that may have privacy implications. Updating a system that results in new privacy risks.

Issuing a new or updated policy that facilitates the collection of PII.

You may find the following resource helpful when putting PIA into practice:

$.$

Privacy Impact Assessments

by the Department of Homeland Security