Privacy impact assessment

A buyer of a business that holds customer data may plan to merge databases or move systems after closing. A PIA is the structured way to look at what that does to people’s personal information before it happens. See the cybersecurity and data privacy checks to do before buying a business.

Where one is required

Quebec’s Act respecting the protection of personal information in the private sector requires a PIA under s. 3.3 for the projects described above, and the person must consult the person in charge of protecting personal information from the outset. The assessment must be proportionate to the sensitivity of the information, its purposes, its quantity and distribution, and the medium on which it is stored. Section 17 requires one before personal information is communicated outside Québec, and where a person or body outside Québec is entrusted with collecting, using, communicating or keeping it, subject to an exception for communications under s. 18.

Federal public sector

The Office of the Privacy Commissioner of Canada describes a PIA as a risk management process and publishes guidance for federal public sector institutions under the Privacy Act. That guide is not a rule for private businesses. This entry covers Quebec’s private-sector Act and the federal guide only; check the rules in the province where the business is, and whether PIPEDA applies.