Privacy Impact Assessment (PIA)

A privacy impact assessment asks questions before a new data practice becomes routine. What personal information will be collected, why is it necessary, who can access it, where will it go, and when will it be deleted? A PIA documents those answers, identifies possible harms, and evaluates controls or alternatives. It is useful when a website introduces customer tracking, a new scheduling vendor, or an intake form that collects more than a name and phone number.

For a service business, the exercise might reveal that a quotation tool passes customer addresses to multiple processors or keeps unsuccessful leads indefinitely. The response could be to limit collection, tighten vendor access, change retention settings, or explain data use more clearly. A PIA should name an owner and revisit assumptions when the service changes.

The term appears in government privacy requirements, but not every private US business is legally required to produce a formal PIA. Legal obligations vary by organization, jurisdiction, and processing activity. A PIA is also different from a privacy policy: the former is an internal assessment of effects and safeguards, while the latter explains practices to readers.