Privacy Impact Assessments (PIAs) must systematically identify, evaluate, and help reduce privacy risks arising from how an organization collects, uses, shares, and retains personal data.

Core things PIAs must do

  1. Identify and describe the processing
    • Clearly describe what personal data is collected, for what purpose, how it flows through systems, who accesses it, and who it is shared with.
 * Map information flows: sources, systems, recipients, storage locations, and retention periods.
  1. Assess necessity and proportionality
    • Check whether each data element and processing activity is necessary for the stated purpose, or excessive/irrelevant.
 * Evaluate whether the processing is proportionate to its aims and consistent with legal bases (for example, GDPR lawful grounds).
  1. Identify privacy risks
    • Analyze how individuals’ rights and freedoms could be impacted (e.g., via misuse, unauthorized disclosure, over‑collection, long retention).
 * Consider likelihood and severity of harms such as identity theft, discrimination, financial loss, or loss of confidentiality.
  1. Evaluate and document safeguards
    • Review existing controls (access controls, encryption, minimization, retention limits, consent mechanisms, transparency measures) and how well they address risks.
 * Propose additional technical and organizational measures to reduce high or medium risks to an acceptable level.
  1. Balance benefits and risks
    • Weigh the benefits of the project or processing (to the organization, users, or society) against residual risks to individuals after safeguards.
 * Where risks remain high, consider whether the activity should be changed, delayed, or not proceed in its current form.
  1. Support legal and regulatory compliance
    • Demonstrate compliance with applicable privacy laws and principles (lawfulness, fairness, transparency, data minimization, storage limitation, integrity, and confidentiality).
 * For regimes like GDPR, conduct a DPIA where processing is “likely to result in a high risk” and document the assessment before starting the processing.
  1. Engage stakeholders and record decisions
    • Involve relevant stakeholders such as privacy officers, IT/security, legal, and business owners; for some projects, also consult user representatives or regulators.
 * Record outcomes: identified risks, chosen mitigations, approvals, and any conditions for the project to go ahead.

If you’re answering a multiple‑choice question

When you see a question like “which of the following must privacy impact assessments do,” the correct option is typically the one that refers to:

  • Identifying and evaluating privacy risks in planned or existing processing of personal data,
  • And recommending or documenting measures to mitigate those risks while supporting legal compliance and project objectives.

For example, if the options included:

  • “Describe information flows and assess risks to individuals’ privacy,”
  • “Set the organization’s overall IT budget,”
  • “Replace security audits,”
  • “Guarantee there will never be a breach,”

…the required function of a PIA would be the first option, because PIAs focus on understanding data use, identifying privacy risks, and defining controls, not on budgeting, replacing other audits, or guaranteeing absolute security.

Information gathered from public forums or data available on the internet and portrayed here.