Privacy Impact Assessments, DPIAs & AI Risk Assessment Services
We help organizations evaluate the privacy risks of new systems, products, vendors and AI applications. Our assessments document how personal information is used, identify control gaps and provide prioritized recommendations to support informed decisions and risk mitigation.
Structured Assessment of Products, Systems and Data Uses
A privacy assessment is most useful when it happens before a decision is locked in. We review how personal information will be collected, used, shared and retained, then document the risks and what to do about them.
Determine whether a PIA or DPIA is required or advisable, and how detailed it needs to be. This keeps the effort proportionate to the risk.
Capability 01 / 06For assessments of an external provider before you commit, see Third-Party, Vendor & Cloud Privacy Risk.
Situations That Call for a Privacy Assessment
Launching a Product or Feature
A new product, feature or customer platform changes what personal information you collect or how you use it.
Adopting AI or Automation
An AI tool or automated workflow will process personal information or influence decisions about individuals.
Onboarding a Vendor or Cloud Platform
A third party will store or process personal information on your behalf.
Introducing Monitoring or Tracking Technology
Analytics, cameras, biometrics or location tracking will capture information about customers, employees or visitors.
Sharing Data or Entering a New Market
Information will move to a new partner, a new jurisdiction or a new purpose.
Responding to an External Request
A customer, regulator or contract requires documented evidence that privacy risk was considered.
Documented Findings and a Clear Path to Remediation
Depending on the agreed scope, deliverables may include:
- 01
Assessment Report
Documented findings, the processing described, and the conclusions reached.
- 02
Data Flow Map
A record of the personal information involved, its sources, systems, recipients and retention.
- 03
Risk Register
Inherent risk, control effectiveness and residual-risk ratings for each identified issue.
- 04
Prioritized Remediation Plan
Recommended actions with suggested owners and priorities.
- 05
Risk Acceptance & Approval Record
Documentation of decisions made, by whom, and on what basis.
- 06
DPIA Documentation
Where GDPR requires a DPIA, documentation prepared to support accountability.
- 07
Reusable Assessment Template
A method your team can apply to future assessments, where included in scope.
The aim is a record that management can act on and that shows how privacy risk was considered.
Discuss Your Requirements
PIA or DPIA: Which Applies to You
Whether an assessment is required depends on where you operate, the type of processing and the risk it creates. Some laws require one in defined circumstances. Others treat it as good practice and regulators may expect to see one. Some U.S. state privacy laws also require documented risk assessments for certain high-risk processing.
PIA
Privacy Impact Assessment
DPIA
Data Protection Impact Assessment
Canadian privacy requirements and broader privacy risk management
GDPR and other frameworks that use DPIA terminology
Privacy implications of projects, systems or processing changes
Processing likely to present high risk to individuals
Depends on applicable law, sector, project and organizational requirements
Required under GDPR when its high-risk threshold is met
We run a threshold review first to determine which applies, and prepare one assessment that covers more than one framework where appropriate.
For jurisdiction detail, see:
From Scoping to Documented Remediation
- STEP 01
Scope
Define the product, system or change, confirm whether an assessment is required and identify the requirements and stakeholders involved.
- STEP 02
Assess
Review data flows, purposes, safeguards, vendors and retention, then evaluate the risks and the controls already in place.
- STEP 03
Document
Prepare findings, risk ratings and recommendations in a report that management can review and approve.
- STEP 04
Remediate
Prioritize actions, assign owners and support risk decisions. Reassess when the project changes materially.
Assess Privacy Risk Before It Becomes Exposure
Tell us what you are launching, changing or evaluating. We will confirm whether an assessment is needed and propose a practical scope.
Frequently Asked Questions
A PIA is a general assessment of the privacy risks of a project or system. A DPIA is the term GDPR uses for the assessment required where processing is likely to result in high risk to individuals. The two overlap, and one assessment can often serve both.
It depends on the law that applies, the personal information involved and the risk the processing creates. We begin with a threshold review so you know whether an assessment is required, advisable or unnecessary.
Yes. We review personal data use, transparency, retention, profiling and human oversight. These are privacy assessments, not technical evaluations of model performance or security testing.
Yes. We can assess a vendor’s handling of personal information as part of the buying decision. A broader vendor due-diligence program is covered under third-party privacy risk.
Typically a description of the project, the personal information involved, relevant system or vendor documentation and any existing policies. We work through gaps with your team.
Yes. An assessment can be scoped as a defined project, separate from ongoing support.
Explore More Ways We Can Help
Privacy Program Development & Governance
Governance frameworks, policies, data inventories, consent processes and staff training.
Learn MoreCanada Privacy Compliance
PIPEDA, Quebec Law 25, provincial privacy laws and CASL compliance.
Learn MoreU.S. Privacy & Sectoral Compliance
CCPA/CPRA, state privacy laws, GLBA, FTC requirements and HIPAA/HITECH.
Learn More