Privacy impact assessment

A PIA describes the personal information involved, why it is needed, where it flows, who can access it, how long it is kept, how it is secured and what could go wrong. It ends with recommended measures and, ideally, sign-off by someone accountable.

Under Quebec Law 25, PIAs are mandatory for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information, and before communicating personal information outside Quebec, which includes using many cloud and SaaS providers hosted elsewhere. The assessment must be proportionate to the sensitivity of the information and the scale of the project. Elsewhere in Canada, PIAs are required for many public bodies and are considered good practice for private organizations under PIPEDA.

For a business, PIAs are most useful when done early, before contracts are signed or systems are configured. Security input is essential: encryption, access control, logging, vendor security and incident notification terms all feature in a sound PIA. New AI tools are a common trigger.