When should a privacy impact assessment (PIA) be conducted?

When should a privacy impact assessment (PIA) be conducted?

• A. For new systems, processes, or when data use changes
• B. Only after a data breach
• C. Every decade
• D. Only for external vendors

Answer: (D)

A privacy impact assessment is a proactive check to identify privacy risks in how personal data is collected, stored, used, and shared, and to put safeguards in place before processing begins. When you work with external vendors who will process personal data, conducting a PIA is essential because it examines the data flows to the vendor, the protections the vendor has, and how data is retained, shared, and secured under contract. This helps ensure third-party practices meet privacy requirements and that any gaps are addressed before data is handled by the vendor. While PIAs are also common for new systems or when data use changes, the focus here is on third-party risk management—verifying that external vendors don’t introduce privacy problems. A PIA after a breach is too late to prevent harm, and waiting a decade ignores ongoing privacy risks and evolving threats.

A privacy impact assessment is a proactive check to identify privacy risks in how personal data is collected, stored, used, and shared, and to put safeguards in place before processing begins. When you work with external vendors who will process personal data, conducting a PIA is essential because it examines the data flows to the vendor, the protections the vendor has, and how data is retained, shared, and secured under contract. This helps ensure third-party practices meet privacy requirements and that any gaps are addressed before data is handled by the vendor.

While PIAs are also common for new systems or when data use changes, the focus here is on third-party risk management—verifying that external vendors don’t introduce privacy problems. A PIA after a breach is too late to prevent harm, and waiting a decade ignores ongoing privacy risks and evolving threats.