Privacy Impact Assessments (PIAs)

A Privacy Impact Assessment (PIA) is a structured analysis that an organization performs to identify and evaluate the privacy risks created when an information system, program, or process collects, uses, stores, shares, or disposes of personally identifiable information (PII). Rather than treating privacy as an afterthought bolted on after a system goes live, the PIA forces privacy questions to the surface early — ideally while a system is still being designed — so that risks can be mitigated before they harden into operational reality. In the United States federal context, PIAs became a recognized discipline under the E-Government Act, which obliges agencies to assess the privacy consequences of electronic information systems, but the underlying methodology has spread well beyond government into healthcare, finance, education, and any sector that handles sensitive personal data.

For records management professionals, the PIA is not a separate compliance silo. It is deeply intertwined with how records are created, classified, retained, and destroyed. Because a PIA documents exactly what PII a system holds, why it is collected, who can access it, and how long it will be kept, it produces precisely the information a records program needs to apply schedules, enforce access controls, and defend disposition decisions. Conducting a PIA without consulting the records function — or building a retention schedule without consulting the PIA — leaves both efforts incomplete.

What a PIA Examines

A well-constructed PIA walks through the full life cycle of personal information and asks a consistent set of questions at each stage. Typical areas of inquiry include:

• Collection: What PII is gathered, from whom, and under what legal authority? Is the collection limited to what is genuinely necessary, or does it sweep in more than the purpose requires?
• Use and purpose: How will the data be used, and is that use consistent with the purpose for which it was collected? Are there secondary uses that individuals would not reasonably expect?
• Sharing and disclosure: Who inside and outside the organization receives the data? What agreements, controls, or routine uses govern those disclosures?
• Access and security: Who can view, edit, or extract the information, and what technical and administrative safeguards protect it?
• Retention and disposition: How long is the PII kept, under what authority, and how is it destroyed when no longer needed?
• Individual participation: How are people notified about the collection, and what avenues exist for them to access or correct their own records?

The output is not merely a checklist. A mature PIA narrates the privacy reasoning, identifies residual risks that cannot be fully eliminated, and records the decisions made by accountable officials.

When to Conduct One

The most common trigger is the development of a new system or program that will handle PII. But PIAs are not a one-time event. They should be revisited whenever a material change alters the privacy posture of an existing system — for example, a new data source, an expanded user population, a change in how data is shared, the introduction of automated decision-making, or migration to a cloud environment. Treating the PIA as a living document, refreshed at meaningful intervals or upon significant change, keeps the analysis aligned with how the system actually behaves rather than how it was originally imagined.

Connecting the PIA to Records Retention

The retention and disposition portion of a PIA is where privacy and records management most clearly converge. A foundational privacy principle is data minimization — holding personal information only as long as it serves a legitimate purpose. Retention schedules operationalize that principle by setting defensible time limits and disposition methods. When a PIA documents that a category of PII has no continuing business or legal value, the records program can schedule it for timely, authorized destruction, shrinking the organization’s risk surface. Conversely, where a PIA reveals PII being kept indefinitely with no schedule, it exposes a gap that both privacy and records governance must close. In federal practice, disposition authority ultimately flows through approved records schedules, including the government-wide General Records Schedules issued by the National Archives, so a PIA’s retention findings should reconcile with an actual, approved schedule rather than an informal assumption.

Methodology and Standards

PIA methodologies vary by sector, but they share a common spine: describe the information flow, map it against applicable legal and policy requirements, assess the resulting risks, and document mitigations and accountable decisions. Frameworks such as the NIST Privacy Framework provide a vocabulary and structure for identifying privacy risk and aligning it with broader risk management, helping organizations move from ad hoc judgment toward repeatable, comparable assessments. The fair information practice principles that underlie most privacy regimes — transparency, purpose specification, minimization, use limitation, security, and accountability — give PIAs their analytical backbone regardless of the specific template an organization adopts.

It is worth noting that records management standards landscape has been shifting in ways that affect how privacy-relevant electronic records are governed. The National Archives revoked its endorsement of the longstanding DoD 5015.2 records management application standard in 2022, moving instead toward the Universal Electronic Records Management (ERM) Requirements developed through the Federal Electronic Records Modernization Initiative (FERMI). For practitioners, the practical takeaway is that system requirements for capturing, controlling, and disposing of electronic records — including records containing PII surfaced by a PIA — are now expressed through these functional requirements rather than a single product-certification standard.

Governance, Roles, and Documentation

A PIA is only as useful as the governance around it. Effective programs assign clear ownership, often vesting a privacy officer or equivalent with responsibility for reviewing and approving assessments, while system owners supply the operational detail and records staff contribute schedule and disposition expertise. Legal counsel weighs in on statutory authorities and obligations under instruments such as the Privacy Act of 1974, which governs how federal agencies handle systems of records about individuals. The completed PIA should be retained as a record in its own right, version-controlled, and made available — often in summary form — for transparency. Treating PIAs as durable evidence of due diligence not only strengthens privacy protection but also provides a defensible account of the choices an organization made, which is valuable if those choices are ever questioned in audit, oversight, or litigation.

For related concepts and adjacent guidance, see the privacy and PII topic hub.