Full-Scale PIA - Introduction

Many aspects of business and government operations have only modest privacy implications. Yet a privacy disaster can damage a multi-million pound project in a short time. So organisations that interact with individuals need to be prepared for privacy problems.

This section provides access to introductory material about ideas underlying Privacy Impact Assessments. For many readers of this document, the introductory material will be superfluous. However, members of a project or PIA team who are unfamiliar with privacy concepts will benefit from this material.

The introductory material is provided as a matter of completeness, and so that a common reference-point is available for discussions between organisations and the Information Commissioner's Office.

The remainder of this part briefly highlights questions that may arise when an organisation is preparing to conduct a Full-Scale PIA, and provides access to introductory material on each topic.

To read general background information relating to the following questions, click on the questions below:

• What is privacy?
• How is privacy protected?
• Why is privacy important?
• Why have a privacy strategy?

Many readers of this Handbook will want to move directly to the following key questions.

(1) Benefits of a PIA

Even though the screening process may have indicated that a Full-Scale PIA is warranted, there may be some lack of clarity about why a PIA offers benefits to the organisation.

Background information is provided to assist in considering the question, Why do a Privacy Impact Assessment?.

(2) Triggers for a PIA

There are various factors that may be the immediate cause of a PIA being conducted.

Background information is provided to assist in considering the question, What triggers a PIA?

(3) Timing considerations

An organisation may want to know the stage of a project's life-cycle at which it is appropriate to commence a PIA. Generally, 'the earlier the better' is good advice, because that prevents small problems growing into bigger ones.

Background information is provided to assist in considering the question of When to do a PIA.

(4) Distinguishing PIAs from other privacy-related processes

An organisation may want to understand how a PIA relates to other processes that appear to have similarities.

Background information is provided to assist in clarifying What is and is not a PIA?