What are the steps to run a privacy impact assessment before a new system starts collecting personal data?

A privacy impact assessment (PIA) is a structured review that identifies how a new system will collect, use, store, share, and dispose of personal data, and what risks those activities create. Running it before the system goes live lets you design protections in rather than retrofit them. The following steps describe a sound, principle-based process.

1. Determine whether a PIA is needed

Confirm the system will collect or process personally identifiable information (PII). If it will, a PIA is generally required. Screen early, during planning or procurement, so privacy is built into the design rather than added later.

2. Map the data flows

Document what personal data will be collected, why it is needed, where it comes from, who will access it, where it is stored, with whom it is shared, and how long it will be retained. Diagramming the full lifecycle (collection through disposition) makes hidden flows visible.

3. Identify the authority and purpose

Establish the legal or business basis for collecting the data and define a specific, limited purpose. Apply data minimization: collect only what the purpose requires, and avoid retaining data longer than necessary.

4. Assess privacy risks

Evaluate risks such as unauthorized access, excessive collection, inaccurate records, unclear retention, or sharing without a basis. Consider impacts on individuals, not just the organization.

5. Define controls and mitigations

For each risk, specify safeguards: access restrictions, encryption, notice to individuals, consent or opt-out mechanisms where appropriate, accuracy and correction procedures, and a defined retention and disposition schedule.

6. Document, review, and approve

Record findings, residual risks, and decisions in a written PIA. Have privacy, legal, security, and records management stakeholders review it, and obtain sign-off from an accountable official before the system collects data.

7. Monitor and revisit

Treat the PIA as a living document. Reassess whenever the system, data, or sharing arrangements change materially.

Why it matters

A PIA ties privacy decisions to recordkeeping: defining purpose, access, and retention up front supports both compliance and good information governance. Frameworks like the NIST Privacy Framework offer a flexible model for identifying and managing these risks.

For related guidance, see the privacy and PII topic hub.