What is a privacy impact assessment and how do I do one?

A privacy impact assessment (PIA) is a tool used by agencies to help them identify and assess the privacy risks arising from their collection, use or handling of personal information. A PIA will also propose ways to mitigate or minimise these risks.

A PIA can be particularly useful when an agency is considering introducing a new policy or operating system, or when making changes to an existing process.

Use our PIA toolkit for guidance on whether you should do a PIA and how to do a PIA. 

Updated October 2025