Producing the assessment is the easy part. Saying, without checking, that it still describes the service running today is harder.
That gap does not require neglect. A privacy impact assessment is written at a point in time, against a design. The service then does what services do: a supplier changes, a field is added to a form, a reporting layer gets built on top, a team finds a second use for information it already holds. None of those arrive labelled as a privacy event. They arrive as ordinary delivery work.
So the useful question is not whether the assessment was good when it was signed. It is whether it describes the work your organization is doing today — and whether you can show how you know.
Start with what the assessment actually describes
Before comparing anything, fix the boundary. Write down the service name, the assessment's version and date, and the operational owner accountable for the service now — not the person who commissioned the assessment, the person who runs the thing. Retrieve the process description the assessment relied on.
If any of those four are unclear, that is your first finding. An assessment whose current owner cannot be named is not a document you can maintain; it is a document you will eventually rewrite from scratch.
Compare the service with that description
Sit with the operational owner and walk the service as it runs. Five questions do most of the work:
- Are you collecting any information the assessment does not describe?
- Is anyone receiving it who is not named — another team, another body, a vendor?
- Has a supplier, platform or hosting arrangement changed?
- Is information being used for a purpose beyond the one recorded?
- Has anything been added on top — a dashboard, an export, a reporting copy?
Capture the evidence behind each answer as you go, and mark what nobody can answer yet. An unanswered question is a legitimate output of this review. What is not legitimate is letting it stay unassigned.
Build a change record
Record what you find in one place, with six fields: the change; the evidence supporting it; the section of the assessment it affects; who reviews it; the decision; and the follow-up date. A process diagram, an approved change request, or written confirmation from the service owner all count as evidence. "Someone mentioned it" does not.
Keep the evidence beside the decision rather than in a separate file. The reviewer who picks this up in eighteen months needs to see why a change was judged minor without reconstructing the conversation that led there.
Decide what needs attention
Not every change needs a new assessment, and treating them as though they do is how a review program collapses under its own weight. Ask the privacy lead to sort each entry into one of three outcomes: the assessment still holds; a section needs correcting; or the change warrants a fuller reassessment.
Record the reasoning either way. In Ontario, provincial institutions must update a PIA before a significant change to the purpose for which personal information is used or disclosed — the duty sits in FIPPA s.38(5), part of the PIA framework in ss.38(3)–(6) in force since July 1, 2025. A regulator asking about that duty will want to see how "significant" was assessed, not merely whether an update happened. A one-line note written at the time, explaining why a change was or was not treated as significant, is worth more later than a confident answer reconstructed under pressure.
Close the review with evidence
Update the affected sections, make the current version identifiable, and leave the outstanding items visible rather than quietly carrying them forward. A review that closes with three open questions and named owners is in better shape than one that closes clean because nobody wrote the awkward items down.
Make the next change easier to catch
The structural fix is to stop relying on the privacy office noticing. Add one question to the change process the organization already runs — does this change what information we collect, who receives it, or what we use it for? — and name an operational contact who answers it. Do not build a second tracking system to sit alongside the first. The assessments that stay current are the ones wired into a process that was going to happen anyway.
This is the same failure mode that shows up at launch, when a system goes live holding personal information with no approved retention schedule. We wrote about that in Nobody owns retention until it's too late.
What to do now
- Choose one active service — ideally one that has changed suppliers or added a reporting layer in the past year.
- Pull its assessment and confirm the version, date and current operational owner.
- Book forty-five minutes with that owner and walk the five comparison questions above.
- Record every change and every unanswered question in the six-field change record.
- Have the privacy lead sort each entry into holds, correct, or reassess — with the reasoning written down.
- Add the collection-recipients-purpose question to your existing change process before you close the review.
Where this fits
Mosaic Effect works with privacy offices on exactly this: keeping assessments connected to the services they describe, through an expert-led, standardized methodology and senior practitioner review. If a scoping conversation about your assessment inventory would help, we are happy to have one.