What is a Privacy Impact Assessment (PIA) and when is it typically used?

• A. A systematic assessment of privacy risks associated with a project or system; used during design and before deployment.
• B. An audit of system performance after deployment.
• C. A financial risk assessment for data privacy investments.
• D. A legal compliance check performed only after deployment.

Answer: (A)

A Privacy Impact Assessment is a proactive, structured process to identify and mitigate privacy risks within a project or system. It involves examining how personal data will be collected, used, stored, shared, and protected, mapping data flows, and evaluating potential impacts on individuals. The goal is to address privacy concerns early in the project lifecycle by designing controls and safeguards before the system is deployed, embodying privacy-by-design principles. This makes it a design-time activity that informs decisions prior to release, rather than an after-the-fact audit or a financial or purely legal check.