Overview
Projects with potentially substantial privacy impacts warrant a full-scale privacy impact assessment (PIA) process. Other projects require attention, but do not warrant as great an investment of time and resources. A small-scale PIA involves analysis of the privacy issues arising from the aspect or aspects that the screening process in Chapter III has highlighted through the application of the criteria for small-scale PIA in Appendix 1, Step 2.
A small-scale PIA process differs considerably from a full-scale PIA. In particular:
- it is less formalised;
- it involves less investment;
- it calls for less exhaustive analysis and information-gathering, and
- it is more likely to be focused on specific aspects of a large-scale project rather than the project as a whole.
Because projects vary greatly, a process should be devised that fits the need, is as comprehensive as it needs to be, but is only as resource-intensive as is appropriate in the circumstances. This part draws on the full-scale privacy impact assessment process described in Chapter IV of this handbook, but is much briefer. The guidance is in two parts:
- Background information intended to assist organisations to gain an appreciation of the kinds of projects for which a small-scale PIA is appropriate, and its key characteristics.
- The PIA process:
- preliminary phase;
- preparation phase;
- consultation and analysis phase(s);
- documentation phase;
- review and audit phase.