Conducting Privacy Impact Assessment

Course Description

Conducting Privacy Impact Assessment – Issues about privacy could determine the success or failure of implementation and compliance to the requirements of the Law. Any project that have personal information could have risks. If you ignore privacy, you could lose clients’ trust, damage your reputation, fail to meet community expectations, and breach the Data Privacy Act of 2012 privacy principles, the rights of the data subjects and the preservation of confidentiality, integrity and availability of your data subjects’ personal information.

This course will help establish a systematic assessment that identifies any impact that your project/data processing systems might have on the privacy of data subjects and for you to provide recommendations for managing, minimizing or eliminating that impact.

At the end of this course participants should be able to:

•  This course aims to provide you a simple, practical and activity-filled way on how to conduct a Privacy Impact Assessment (PIA) and; for you to have the confidence to do a PIA in your organization.

Course Outline

I. Fundamental concepts and principles of DPA

• What is the Data Privacy Act?
• Who Must Comply?
• What Should Be Protected?
• Key DPA Actors
• Privacy Principles
• Rights of the Data Subjects
• Security Measures in the Data Lifecycle
  • Organizational Threats & Measures
  • Physical Threats & Measures
  • Technical Security Threats & Measures
• DPA Punishable Acts
• DPA Compliance Checks

II. Conducting the PIA

• What is a PIA?
• When to do a PIA?
• Risks of not doing a PIA
• Benefits of doing a PIA
• Description of the data processing systems
• The Threshold analysis
• Mapping information flows

Activity I

II.A. Planning your PIA

• Assessing the privacy scope
• How detailed should your PIA be?
• Who shall conduct the PIA?
• Resources needed to conduct the PIA
• Engaging the stakeholders
• How to consult with stakeholders

Activity II

III. Conducting the PIA, cont’d.

• Conduct Privacy Risk Assessment
• Identifying privacy risks
• Privacy risk analysis
• Privacy risk evaluation
• Addressing privacy risks
• Strategies to reduce or mitigate privacy risks
• Factors to consider when developing strategies for dealing with negative privacy
• impacts
• Overview of the PIA Report

Activity III / Question and Answer

Course Duration

• 1 day

Delivery Methodologies

• Lecture and Discussion
• Activity / Quizzes

This course is recommended for

• Data Protection practitioners
• Record and Database Administrators
• Legal, Regulatory and Compliance personnel
• People Who Deal with Customer Queries and Administer Personal Data
• IT and Other Staff, Including HR, Legal and Business Users
• Anyone who is involved in the processing of personal data