run-a-privacy-impact-assessment

name	run-a-privacy-impact-assessment
category	data
description	Assess privacy risk and control readiness before a consequential data change. Use when a product, model, vendor, monitoring practice, migration, or integration changes people, purposes, data, decisions, or exposure.

run-a-privacy-impact-assessment

Make the proposed data practice legible before approval. The assessment informs accountable decision-makers and does not replace legal advice or required consultation.

Preconditions

• Confirm assessment scope, change owner, decision authority, launch date, and applicable review process.
• Obtain the real design, data samples or schema, flows, vendors, user journeys, and control evidence.

Procedure

1. Describe the change, purpose, people affected, expected benefit, alternatives, and decision still open.
2. Map collection, inference, use, access, sharing, storage, transfer, retention, deletion, and downstream reuse.
3. Separate necessary data from convenient data and challenge each purpose and field.
4. Analyze notice, choice, access, correction, contestability, fairness, vulnerable people, surveillance, and power imbalance.
5. Model misuse, linkage, breach, inaccurate inference, exclusion, chilling effects, function creep, and irreversible disclosure.
6. Record likelihood, severity, affected groups, existing controls, evidence quality, and residual uncertainty.
7. Design prevention, minimization, access, retention, security, human-review, appeal, monitoring, and exit controls.
8. Test controls against representative normal, error, abuse, and deletion cases.
9. Identify required legal, security, accessibility, ethics, worker, or community review without inventing their conclusions.
10. Recommend proceed, revise, pilot, or stop; name conditions, owners, acceptance evidence, and review triggers.

Failure plan

• Stop launch when a required authority, lawful path, critical control, or affected-person safeguard is unresolved.
• Preserve dissent and uncertainty rather than averaging away material harm.
• Do not place sensitive examples or live credentials in the assessment.
• Reopen the assessment after purpose, model, vendor, population, jurisdiction, or data-flow changes.

Done

• A verified data-flow and risk register support the decision
• Alternatives and minimization decisions are recorded
• Residual risks have named acceptance authority
• Launch conditions and post-launch effectiveness checks are testable