5. Review and audit phase
This is phase five of the five-phase PIA process.
The purpose of this phase is to ensure that the undertakings arising from the consultation and analysis phase are carried through into the running system or implemented project.
The following tasks are suggested:
- Undertake a review of the implementation of the mitigation and avoidance measures that were documented in the issues register and/ or the privacy design features paper.
- Prepare a review report.
- Present the privacy review report to the PCG.
- Make the privacy review report publicly available.
As with the preceding phases, it is beneficial to perform this phase at the appropriate stage in the life-cycle of the overall project. This could be, for example, at a milestone such as the detailed design review, or its equivalent in the project method.
Another approach that organisations may consider appropriate or cost-effective is to build the review of performance into the organisation’s standard, periodic or occasional internal audit or external audit processes.