Privacy impact assessments: what IT suppliers need to know

When a public body brings in a new system that handles personal information, it often needs to complete a privacy impact assessment (PIA) first. In Europe and the UK this is a data protection impact assessment (DPIA) under the GDPR. If you're the supplier, you'll be asked to help, and slow answers can delay the whole project.

When a PIA is needed

• Canada: federal institutions do PIAs for new or substantially changed programs involving personal information, and provinces such as British Columbia and Ontario have their own requirements for public bodies.
• EU and UK: a DPIA is required for processing likely to result in high risk, such as large-scale processing of sensitive data or new technologies.
• Australia and New Zealand: privacy regulators and many agencies expect PIAs for high-risk projects.

What the supplier provides

Expect questions like:

• What personal information does the system collect, and why?
• How does data flow, from collection to deletion? A data flow diagram helps.
• Where is it stored, including backups? See data residency.
• Who can access it, including your staff and subprocessors?
• How is it secured, in transit and at rest?
• How long is it kept, and how is it deleted?
• How can individuals see or correct their information?
• Is any of it used for analytics, AI or training models?

Make it easy

Keep a privacy pack for your product or standard service:

• A data flow diagram.
• A list of data fields and their purposes.
• Hosting locations and subprocessors.
• Security controls and certifications.
• Retention and deletion settings.
• A template data processing agreement.

Offering this early, even in your bid, shows you understand public sector privacy and lowers the buyer's risk.

Privacy by design in your bid

Tenders increasingly ask how you build privacy in. Talk about collecting only what's needed, default settings that protect privacy, role-based access, audit logs, and easy deletion.

Common questions

Who is responsible for a privacy impact assessment?

Usually the public body, as the organization responsible for the personal information. The supplier provides information and may help draft parts.

How long does a PIA take?

From a few weeks for simple systems to several months for complex ones. Fast, complete answers from the supplier make a big difference.

Is a PIA the same as a DPIA?

They're very similar. DPIA is the term used under the GDPR in the EU and UK, while PIA is common in Canada, Australia and New Zealand.