Introduction to Privacy Impact Assessments (PIAs)

A PIA is a scalable tool for identifying, assessing and mitigating privacy risks. A PIA assists an IPP entity to identify: 

• whether a project involves the handling of personal information
• the privacy risks of the project and whether the project complies with the privacy requirements of the PRIS Act, including the Information Privacy Principles (IPPs), and
• strategies to manage, reduce or eliminate privacy risks. 

A PIA can also be used to highlight the positive privacy aspects of a project. For example, a PIA might identify how a project minimises the collection of personal information and how privacy is embedded into the design of the project. 

A PIA is usually conducted on a project and is an important step in the project management lifecycle. The term ‘project’ is used throughout this suite of resources to refer to initiatives undertaken to implement IPP entities’ functions and activities. For example, this might include the implementation of new systems or processes, changes to existing systems or processes or the development of new legislation or government policy.

A good PIA adds value by building privacy into the planning, implementation and ongoing improvement of a project. PIAs can help turn privacy considerations into practical actions and embed good privacy practice in day-to-day decision making.

A PIA supports an IPP entity to embed robust privacy practices into its functions and activities from the outset. This is known as ‘privacy by design’. Privacy by design is the most effective method of managing privacy risks. This is because it is more effective to manage privacy risks proactively rather than to make retrospective changes to address issues after they arise.  

There are some circumstances where the PRIS Act requires an IPP entity to conduct a PIA. These include: 

• before an IPP entity first performs a high privacy impact function or activity
• when an IPP entity makes a significant change to the way in which personal information is handled as part of a high privacy impact function or activity, or
• before entering into an information sharing agreement if the activity is likely to have a significant impact on privacy, involves data integration or data linkage, or any of the proposed recipients is an external entity.

Even where a PIA is not required under the PRIS Act, a PIA can assist an IPP entity to understand its privacy risk exposure and identify how it meets its obligations under the IPPs. A PIA can be particularly valuable to understand privacy risks related to legacy systems or activities that commenced before 1 July 2026 when PRIS became operational.

A PIA can be an effective way for an IPP entity to demonstrate to the public it is actively considering privacy. To this end, making PIAs publicly available helps support Open Government Principles and is an opportunity for an IPP entity to build public trust and confidence in the way it handles personal information. This can, in turn, improve public uptake and increase the likelihood of project success.

A PIA undertaken early in the development of a project has the best chance of having a meaningful impact. A PIA should be conducted during the design or planning phase of a project. This allows the privacy impacts to be identified and addressed upfront, before key decisions have already been made. 

Identifying privacy impacts early allows IPP entities to consider different design options and implement measures to reduce or eliminate privacy risks before they become embedded. When undertaking a PIA, the IPP entity must remain open to performing the project in a different way to reduce the impact on individuals’ privacy, whilst still achieving the intended outcome.

In any case, a PIA should not be done simply to justify decisions that have already been made.

A PIA is not a one-off exercise. This is because projects often evolve as they progress and new privacy risks become evident after implementation. This means PIAs need to be conducted (or reviewed) at multiple stages including:

• during the development stage of the project 
• prior to implementation, and
• any time there is a change that could result in new or increased privacy impacts.

There are no prescribed rules about who must conduct a PIA. However, PIAs are usually conducted under the oversight of the IPP entity’s privacy officer. 

The appropriate approach will depend on a range of factors, including the resources available and the risk profile of the project. PIAs are often overseen by an IPP entity’s privacy officer or members of their team. However, a PIA will always require substantial input from the project’s business owner.

A PIA is most effective when it incorporates input from a range of stakeholders, including people with privacy expertise and people with a sound understanding of the project’s technical and operational design. The project owner also has an important role in considering the findings of the PIA and making decisions in relation to any recommended actions. 

When might an IPP entity seek an independent view?

Some projects may benefit from the PIA being conducted by an independent provider. An IPP entity might engage a suitably qualified provider, such as a privacy consultant, legal adviser or other specialist where:

• the project is particularly complex
• the potential privacy impacts are significant
• specialist expertise is not available internally, or
• an independent assessment would help build public confidence in the outcome.

An independent provider can also provide a “second pair of eyes” and identify issues internal project teams may have overlooked. 

The next step is to determine whether a PIA is required by undertaking a privacy threshold assessment.

A privacy threshold assessment is a preliminary assessment to help an IPP entity determine whether it should undertake a PIA. The outcome of a privacy threshold assessment will be a recommendation about whether a PIA should be conducted. It is not a “mini” PIA to determine the level of risk and identify mitigation strategies.

For more information on how to do a privacy threshold assessment see ‘Do I need to do a PIA’.