The
Grid.
CONFERENCE OF CREATIVES
PRIVACY IMPACT ASSESSMENT
A Privacy Impact Assessment (PIA) is an analysis of how personally identifiable information is collected, used, shared, and maintained within the company. The Privacy Impact Assessment captures potential risks or vulnerabilities and the likelihood of these vulnerabilities to occur in a system. The purpose of a PIA is to demonstrate how privacy protections have been consciously incorporated at the system level and across the company throughout the information life cycle.
What is the need for PIA?
Maintaining a Privacy Risk Register and evaluating overall privacy maturity are necessary components to measure and manage the privacy and data ethics within the organization.
Privacy and security of personal information are the most important factors in today’s data-driven world. While organizations consciously make the effort to protect information privacy, it is difficult to determine how personally identifiable information will get impacted because of a project or a process.
Even a minor modification in a product/program could have a significant impact on information privacy. Conducting a PIA helps in identifying the risks and implementing the necessary controls to mitigate those risks. A PIA demonstrates the organization’s efforts towards the protection of personal information and reinforces its commitment to consumer privacy.
How is PIA Conducted?
The privacy impact assessment is based on the privacy impact drivers for each system or process. Privacy Risk Impact Drivers are the attributes of a system that contribute to the privacy risk in the system. These include the volume of personal information on a system, retention periods, access, storage method, and controls. Privacy Risk Impact Drivers will be tracked in the Data Map and an overall Privacy Risk Impact will be calculated for the system based on the Privacy Risk Impact Drivers.
Create Privacy Impact Assessments (PIA) in Minutes
01
Pre-defined Templates
02
Automated Workflows
03
Track and Monitor Progress. Prioritize
and Remediate
04
Score and Measure Progress
Simplify PIA with Meru Data
Our Data Map completely integrates with the existing and new systems to conduct an intensive privacy impact assessment. All the details related to personally identifiable information, including the types, usage, location, data transfer, level of access, regulatory requirements, retention period, etc. are made available within the Data Map. This enables easy identification of sensitive information and the risks associated with it. Meru’s application facilitates the smooth implementation of the required safety measures for the relevant system.
Demonstrate Compliance
Our tool displays how the personal information in the system was collected and how it is being used within the organization to enable:
-
Processing of data for the purpose that it was collected
-
Use of data based on the received consent
To ensure regulatory compliance, the data map indicates the system’s responsiveness to regulations like the CPRA/CCPA, the type of regulatory requests relevant to it, and the applicable regulatory exceptions for a system.
The level of risk across all systems can be quantified in a consistent manner based on the data stored in the system and its usage. According to the type of data, the systems can have different levels of vulnerabilities toward incidents like theft, unexpected changes, and illegitimate access to data.
The assessment evaluates how the data is being processed in a given context and identifies the inherent risks. Each risk is then analyzed to determine its severity, probability, and potential impact, which is then compared against existing risk controls and measures to identify the residual risks.
Based on this evaluation, an action plan is drafted to ensure the implementation of the required controls to address the residual risks. The PIA also ensures that the implemented controls are commensurate with the inherent data risk and the criticality of the system, and also consistent with the risk exposure of the systems.
