A Privacy Impact Assessment (PIA) is a systematic process to evaluate the potential effects on privacy of a new or significantly changed project, initiative, or system. An information audit, which results in a data inventory or data map, provides a comprehensive overview of the personal data an organization collects, processes, and stores. This existing inventory is a foundational and critical input for a PIA, as it provides the necessary baseline context about data elements, flows, and systems, allowing the PIA to be conducted efficiently and accurately.

A. Not all projects involving personal data require a PIA. PIAs are typically triggered by projects that meet certain risk thresholds, such as those involving new technologies or the processing of sensitive data.

B. This statement reverses the relationship. A Data Protection Impact Assessment (DPIA) is a specific type of PIA, often mandated by regulations like the GDPR for high-risk processing activities. The PIA is the broader concept.

C. While conducting a PIA early in the project lifecycle is a core principle of Privacy by Design and a critical best practice, option D describes a more fundamental procedural dependency within the privacy program.

1. Densmore

R. (2019). Privacy Program Management: Tools for Managing Privacy Within Your Organization (3rd ed.). IAPP (International Association of Privacy Professionals).

Page 158

Section 5.2.1

"Data Inventory": "The data inventory is a foundational tool for any privacy team... It is a precursor to undertaking a PIA

as it is difficult to assess the impact of a new product or service without first understanding the data life cycle." This directly supports that an information audit's results (the data inventory) are leveraged in a PIA.

Page 159

Section 5.2.2

"When to Conduct a PIA": "A PIA should be started early in the project life cycle..." This confirms the principle in option C

but the statement in D about leveraging a data inventory is a direct procedural link between two core privacy program components.

2. National Institute of Standards and Technology (NIST). (2010). NIST Special Publication 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII).

Section 4.2

"Identifying and Categorizing PII": This section discusses the importance of creating an inventory of PII held by the organization. It states

"The PII confidentiality impact level assessment process begins with the system PII identification and categorization process." This establishes the principle that assessment (like a PIA) builds upon the foundation of an inventory (the result of an audit).

3. Article 29 Working Party. (2017). Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679 (WP248 rev.01).

Page 9

Section IV.A: A DPIA must contain "a systematic description of the envisaged processing operations." To provide this description

an organization must leverage its existing knowledge of data assets and flows

which is typically documented in a data inventory or record of processing activities (as per GDPR Article 30)

a direct output of an information audit.