Personal Information Impact Assessments: When And How To Conduct Them

With the Information Regulator increasingly requesting copies of Personal Information Impact Assessments ("PIIAs") from organisations as part of its compliance and enforcement activities, many organisations are finding themselves under heightened scrutiny. This article takes a look at the requirements should organisations not have a PIIA in place or what to do to ensure that existing documentation meets the requirements.

Compliance with data protection laws requires organisations to implement ongoing measures and align their internal practices with prescribed standards. A PIIA is a legally required document under many data protection lawsbut also serves a practical purpose in that it supports the organisation's objective to use information lawfully and to identify risk associated with the processing of the information.