PIA program readiness check.
Eleven questions on the parts of a privacy impact assessment program that a commissioner, an auditor or a new statute will test first: the trigger, the inventory, the template, the risks, the approvals, the re-assessment and the devices staff bring in. Score yourself honestly; the value is in the gaps it names, not the number.
Readiness assessment
Pick one option per question. "In place" means it is written down, followed, and you could show the evidence today.
The mandate
Do you know which statute or directive requires a privacy impact assessment for your organization, and what triggers it — a new collection, a project, or a substantial change?
What good looks like: The trigger and the required contents are written down for your regime and reviewed against the statute each year. Which regimes require a PIA →
Find the section of your Act or directive that requires the assessment, write the trigger down in one paragraph, and circulate it to the people who start projects.
The inventory
Do you keep an inventory of the programs, systems and activities that collect, use or disclose personal information, each with a named owner?
What good looks like: A durable subject record per program with its owner, personal-information categories, retention and vendors, updated as part of the assessment itself. Privacy subjects and the ROPA register →
List every program or system that handles personal information on one sheet with a named owner, and review it at the same meeting where new projects are approved.
The screener
Does every new initiative or change pass through a written threshold screener that records whether a full assessment is needed, and why not when it is not?
What good looks like: A preliminary screener whose answers instantiate the full assessment or a lightweight compliance record, with the determination stored. Documenting the decision to assess →
Adopt a one-page threshold screener of five to eight questions, and record the outcome and the reason for every new initiative — including the ones that do not need a full assessment.
Template coverage
Does your template cover purpose and necessity, legal authority, the information inventory, sources, who has access, limits, retention, safeguards, risks to individuals, and mitigation steps?
What good looks like: A pack-maintained template built on your regulator's own methodology, versioned when the regulation changes. What every template must contain →
Compare your template section by section against your regulator's published guidance and add the missing headings before the next assessment starts.
Program-area input
Do program areas answer the sections only they can — flows, retention practice, real safeguards — rather than the privacy office guessing?
What good looks like: Section delegation to the people who run the program, with autosave, hours and documents, and coordinator approval. Section delegation →
Split the template so the program area answers the sections on flows, retention practice and real safeguards, and the privacy office reviews rather than drafts.
Risks and mitigations
Are risks to individuals scored on likelihood and impact, with every mitigation assigned an owner and a date and tracked to completion?
What good looks like: A risk register with a harm-to-individuals determination, controls from a library, and commitments tracked to done. Risks that outlive the assessment →
Give every identified risk a likelihood and impact score, an owner and a date, and keep the list open until each mitigation is confirmed done.
Approval and freeze
Is every approved assessment signed off, read-only afterwards, and versioned when the program changes?
What good looks like: A review workflow that moves the assessment to In Effect, freezes it, and routes change through Re-assess on the same subject. Approval and re-assessment →
Have each approved assessment signed by the accountable executive, lock the document, and log any later change as a new version.
Re-assessment triggers
Do you have a defined trigger that reopens an assessment when purpose, data or vendors change, or when a substantial change occurs?
What good looks like: A change-of-purpose trigger that pulls the reassessment date forward and surfaces it on the day view. The substantial-change trigger →
Name the three events that reopen an assessment — a new purpose, new data or vendors, a substantial change — and add a check for them to your change-approval process.
Regulator readiness
Could you produce any assessment, with its approvals, risks and evidence, for a commissioner within a day?
What good looks like: A regulator summary generated as a document and an export of the assessment, its documents, approvals and activity trail. Submitting to the Commissioner →
Do a dry run: pick one assessment and assemble it with its approvals, risks and evidence in a day. Whatever you could not find is the gap.
AI and automated decisions
Are AI and automated decision systems in your inventory, with an algorithmic impact assessment beside the PIA wherever they affect people?
What good looks like: An AI systems register, an AIA on the same engine as the PIA, and a compliance profile that flags a system deployed without one. Algorithmic impact assessments →
Add a column to your inventory for automated decision-making, list every system that uses it, and schedule an algorithmic impact assessment beside the PIA for each.
Employee-owned devices
Does your PIA trigger reach the devices staff bring to work — smart glasses, watches, phones with AI assistants — when they change how work information is collected or where it goes?
What good looks like: A BYOD or acceptable use policy that names cameras, always-on microphones and cloud AI assistants, and a screener question that fires when a personal device gains a capability, not only when something is bought. Smart glasses and employee-owned devices →
Ask one question at the next privacy or IT meeting: which personal devices with a camera, a microphone or an AI assistant are already being used for work? Then check whether your BYOD policy, and the assessment behind it, mention them.
What your score means
Three bands. Ontario, Alberta, British Columbia and the federal government now test these elements in statute or directive; Nova Scotia joins them on April 1, 2027.
Exposed
Assessments happen ad hoc, if at all. A commissioner's request or a new collection would be answered from scratch, and the mandate may already apply to you.
Building
The pieces exist — a template, some assessments, a person who owns it — but the trigger, the risk follow-through or the re-assessment is not yet systematic.
Defensible
A program, not a document: screened intake, delegated sections, tracked mitigations, frozen approvals, and an export a regulator can read on demand.