Small-Scale PIA – Overview

Where a project has privacy impacts and implications, the conduct of a PIA is a means of ensuring that the issues are appreciated and addressed.

Projects with substantial impacts warrant a Full-Scale PIA process. Other projects require attention, but do not warrant as great an investment of time and resources. A Small-Scale PIA involves analysis of the privacy issues arising from the aspect or aspects that the screening process has highlighted through the application of the criteria for Small-Scale PIA.

A Small-Scale PIA process differs considerably from a Full-Scale PIA. In particular:

it is less formalised;
it involves less investment;
it calls for less exhaustive analysis and information-gathering, and
it is more likely to be focused on specific aspects of the project rather than the project as a whole.

Because projects vary greatly, a process should be devised that fits the need, is as comprehensive as it needs to be, but is only as resource-intensive as is appropriate in the circumstances.

This part draws on the Full-Scale Privacy Impact Assessment process described in Part II of this Handbook, but is much briefer. The guidance is in two parts:

Background information intended to assist organisations to gain an appreciation of the kinds of projects for which Small-Scale PIA is appropriate, and its key characteristics.
The PIA process:
- Preliminary phase
- Preparatory phase
- Consultation and analysis phase(s)
- Documentation phase
- Review and audit phase

Part III – Small-Scale Privacy Impact Assessment

Small-Scale PIA – Overview