Not too long ago, privacy was an after-thought. Something that most customers and companies weren’t overly concerned about.

Now, most consumer concerns around connected devices include privacy breaches and unauthorized information gathering. Company privacy departments have grown from one person to an entire staff.

Conducting a Privacy Impact Assessment (PIA) is a common process to ensure consumer data is collected safely and transparently while mitigating risk for the organization.

Risks are identified and assessed while privacy and security teams act to minimize privacy risks for specific products, services, and systems.

The assessment serves to help companies see where they stand in terms of privacy practices, thereby also helping companies protect consumers’ personal data

Big data presents many commercial business opportunities but must be mined safely. Several high-profile companies have made headlines for privacy breaches, and although it’s possible to recover, it can be a long and slow process.

Businesses of all sizes should consistently conduct PIAs. For companies that want to be around long-term, data privacy is not an option.

Consumer Privacy Concerns

In the past, TrustArc conducted numerous surveys asking people about their thoughts regarding smart technology, connected devices, and privacy issues.

It’s clear from our surveys and external research that consumers are concerned about privacy, and businesses need to alleviate those concerns.

• 65% of American consumers say they are slightly or not at all confident that personal data is private.
• 96% of Americans agree that more should be done to ensure that companies protect consumers’ privacy.
• 62% of smart product owners worry about the potential loss of privacy.

A company’s privacy team is responsible for ensuring that the organization uses personal data ethically and in a way that’s consistent with the company’s privacy policy.

Before Starting a Privacy Impact Assessment

To handle personal data, organizations must be as transparent as possible with customers while providing notice about how they will use customer data.

If you give customers choices and control over how their personal data is used, they’re more likely to provide information and trust the organization.

Examples of personal data include contact information, social security numbers, driver’s licenses, financial account information, individually identifiable health information, log-in credentials, device IDs, browsing habits, and personal preferences.

Many businesses collect data without even thinking about it. Nevertheless, it’s vital to be aware that you’re collecting this information and ensure its protection.

PIA Budget and Timeline

Agree on a budget and clarify the PIA expenses to be incurred throughout this process before you start. Factor in the ROI of reducing the company’s risk.

These expenses typically include consulting fees, tools to automate the assessment process, and employee labor to conduct the assessment.

For start-ups, employees sometimes abandon the process to put-out fires and launch other projects. All companies to set realistic timeframes and schedule regular meetings to monitor assessment progress.

The privacy office will need an adequate number of employees to support the PIA process, which needs cross-department support on occasion. Assembling the right PIA team is essential to conducting a successful assessment.

Some of the members a PIA team should include are:

• An executive responsible for the budget for the PIA – perhaps the CISO, CIO, DPO, CPO, or CTO.
• Privacy office staff to lead the effort and track daily progress.
• Product managers, IT managers, and marketing managers.
• Members of the company’s legal team who are experts in data privacy.
• External privacy consultants to offer outside perspective and help ensure compliance.

6 Steps for Conducting Privacy Impact Assessments

1. Identify the need for a PIA with a Privacy Threshold Analysis
2. Describe the data flows by data mapping
3. Identify and assess privacy risks
4. Identify and evaluate the solutions (remediation)
5. Sign-off and record PIA outcomes
6. Integrate the PIA outcomes back into the PIA plan of record

Conducting a PIA is an efficient way for a company to evaluate its privacy practices and pinpoint any weak areas.

Starting a PIA

The first step in the PIA process is identifying the need with a Privacy Threshold Analysis.

Analyze each business asset and the privacy concerns surrounding those assets to determine the potential privacy impact.

The questions in the threshold analysis are high-level, and the answers will determine which assets collect data in a way that needs further analysis.

If the answers to the threshold analysis demonstrate that personal data is collected and used in a manner that requires further analysis, then the privacy team will fill out a PIA questionnaire.

This questionnaire is more specific regarding the nature of data collection and other data practices. This initial process helps determine the scope of the assessment.

Answers to the assessments analyze the collection of personal data, the sources of information collected, the intended use of the information, if it’s shared with any third parties, and the mechanism for individuals to grant or decline their consent.

Meticulously examining high-level privacy practices from the very start of this process will ensure the accuracy of the PIA. Going forward, the PIA will dive deeper into a company’s privacy practices.

Describe Data Flows with Data Mapping

The second step of a PIA is to describe the information flows, also called data mapping.

Using a data map, organizations can ensure executives – in addition to the privacy team – know how data flows through their organization.

By examining the data map, those conducting the PIA can focus on how data flows into, through, and out of an organization – and identify any gaps where data is not protected.

Data mapping also precisely answers why data is collected, where it’s stored, who can access it, and other important questions.

Identify and Assess Privacy Risks

The third step is to identify and assess privacy-related risks. After creating the data map, it can become easier to identify where potential risks in the data collection process are for the organization being assessed.

To start identifying risks, examine:

• where notice and choice to an individual are not adequate
• when security controls are insufficient
• and when data quality is compromised

This step helps communicate to executives and stakeholders the exact privacy risks that the organization could face.

Remediation

Step 4 is to identify and evaluate solutions for privacy gaps that were discovered in the initial steps. Experts should create a remediation plan and determine which features must be implemented.

Prioritize outstanding privacy risks that need to be addressed and changes to any privacy policies, procedures, or processes. Some risks will require escalation to executives with the authority to execute the solution.

Follow the documented remediation plan so you can later demonstrate how the organization address known privacy risks.

Sign-off and Record PIA Outcomes

The remediation plan from step 4 is recorded for future use as the PIA plan of record. A compliant business will document the problem and solution in detail, except for data covered under the non-disclosure agreements.

The main value of the plan of record lies in keeping it accessible and useful for the next time the same product or activity is up for review or if a problem arises. Maintain the plan to preserve its value.

Integrate Outcomes Into the PIA Plan of Record

The final step is to integrate the outcomes back into the PIA plan of record. Essentially, to fill the identified gaps.

This document lists the people responsible for overseeing the remediation effort and clarifies the steps required to remediate risk.

Don’t miss the opportunity to record the lessons learned to reduce the risk of future issues. A carefully maintained PIA plan of record details the ground that has already been covered and reduces the risk in future efforts to gather information.

Privacy Assessments Address a Broad Range of Compliance Requirements

No matter what industry you are in, your organization’s size, or your privacy program’s maturity, conducting regular privacy assessments is important to understand and ensure compliance.

Privacy assessments cover a wide range of legal requirements and best practices and will help build an action plan to identify gaps and define and manage remediation activities.

When assessments align with pertinent global privacy laws, they provide a structure for gathering information necessary to determine where your program is most successful and what gaps should be addressed.

These assessments can also help companies predict data privacy trends, assign resources appropriately, and resolve the right issues before a violation occurs.

Stakeholders participating in the process typically learn from the experience and become more engaged and educated about data privacy.

As a bonus, a historical record of assessment results can demonstrate a company’s progress along its privacy compliance journey.

Key Global Data Privacy Research Findings About Privacy Assessments

For the past three years, TrustArc has conducted a global state of privacy study to gauge organizational attitudes, actions, and the impact of data privacy management on business.

In the 2022 Global Privacy Benchmarks Report findings it’s evident that critical privacy program activities and teams are well established in organizations small to large across Europe and the U.S.

Feedback came from senior leadership inside the privacy office, privacy team members, and senior executives across 30 countries. Company size ranged from less than $50 million to over $5 billion in revenue.

Key Findings Include:

• 26% use privacy audit assessments as the primary (and most popular) method for measuring their privacy programs.
• 56% use Privacy Impact Assessment (PIAs) completion rates as a key performance indicator (KPI).
• Privacy Impact Assessments were the least likely area to be completely implemented throughout the supply chain.

The Key to A Successful Privacy Program

The first phase in building a successful compliance program is to review and identify gaps compared with all applicable data privacy regulations and to develop a remediation plan.

Some laws you may want to consider include:

• EU GDPR
• California CCPA
• HIPAA
• Brazil LGPD

Conducting a systematic evaluation of how personally data is collected, used, shared, and maintained by your organization provides your team with the greatest opportunity to shape the evolution of its offerings with as few data privacy risks as possible.

Proven 5-Step Process for Privacy Assessments

Step One: Data Inventory

Conduct a data inventory through a serious of questions, identify any personally identifiable information collected or used in the product or processes you are assessing. Map those data flows from the point of collection, storage, and processing.

Include any resources involved in processing, retention, and deletion. Also, gather supporting documents such as requirements, specs, database schemas, and any third-party data protection agreements for your data inventory and mapping exercise.

Step Two: Risk Clarification

The data inventory is mapped to the relevant products, systems, and business processes and data elements are classified according to purpose, uses, and associated risk levels.

Using automated technology, websites and mobile apps are scanned for trackers and technologies and given a Privacy Sensitive Index score, as well as insights into personally identifiable information collection otherwise unknown.

Step Three: Policy & Practices Compliance Review

With expert help, analyze your stated privacy policies and data management practices alongside the applicable frameworks dependent on the nature and location of your organization.

This step includes a broad look at risk factors, including those introduced by service providers, vendors, and other third parties throughout your supply chain.

Step Four: Findings Report & Gap Analysis

From the compliance review you’ll receive a Findings Report & Gap Analysis outlining the full data lifecycle analysis and risk classification, and describing any gaps found versus the applicable frameworks and against industry best practices.

For each gap, TrustArc provides a recommended remediation measure, with required and best practice changes.

Step Five: Policy & Practices Change Guidance

Armed with our gap analysis and remediation recommendations, TrustArc can assist in the development of policies and training programs, provide sample language and templates, and validate remediation steps.

Privacy Risks Affecting Organizations

Findings from the 2022 Global Privacy Benchmark Survey reveal organizations still have much work to do when it comes to avoiding risk and minimizing violations.

In the past three years, the following percent of organizations surveyed suffered:

• 34% data breaches
• 27% large scale cybersecurity attacks
• 25% regulatory investigations, actions or fines
• 24% data privacy lawsuits from consumers
• 21% adverse media scrutiny due to data privacy practices or breaches