Updated September 25, 2026: every legal and factual statement in this article was re-checked against the primary source and corrected where needed.
The Privacy Impact Assessment (PIA) — or Data Protection Impact Assessment (DPIA) — is the heartbeat of a mature privacy program. It is the checkpoint where 'privacy by design' moves from a slogan to a documented reality. Yet product teams can come to treat the assessment as a bottleneck.
It does not have to be. Here is how to keep it rigorous and moving.
In short: whether you need a PIA depends on the law that governs you. In Canada, federal policy and several provincial statutes make it mandatory for public bodies and, in Quebec, for private-sector system projects; under the GDPR, a DPIA is required where processing is likely to result in a high risk. The method is the same everywhere: describe the processing, test necessity and proportionality, assess the risk, and resolve it with concrete mitigation measures. The step that matters most is the last one: a risk you name but do not close is still open.
1. Know your triggers (when a PIA or DPIA is required)
Not every project needs a deep-dive assessment — you need a triage step first.
In Canada, the trigger is set by the law that governs your organization:
- Federal institutions: the Treasury Board Directive on Privacy Practices and its Standard on Privacy Impact Assessment, in effect since October 9, 2024, require a PIA before a new program or activity uses personal information for an administrative purpose, and when an existing one is substantially modified.
- Quebec: enterprises must conduct a PIA for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information, and before communicating personal information outside Quebec. Public bodies carry a parallel duty for system projects.
- Ontario: since July 1, 2025, institutions under the provincial Freedom of Information and Protection of Privacy Act must prepare a written privacy impact assessment before collecting personal information, unless the regulations provide otherwise.
- British Columbia and Alberta: BC's FIPPA requires public bodies to conduct PIAs in accordance with the minister's directions; Alberta's Protection of Privacy Act, in force since June 11, 2025, requires public bodies to prepare one in circumstances set by regulation.
Where no statute or policy requires a PIA, it is still the clearest record that privacy was considered before launch.
Under the GDPR, a DPIA is required before any processing likely to result in a high risk, and always when you are:
- automating decisions through systematic profiling or evaluation that produce legal or similarly significant effects (credit checks, hiring);
- processing special-category data (health, biometric, political opinions) or criminal-offence data on a large scale; or
- carrying out systematic monitoring of a publicly accessible area on a large scale (public CCTV).
European regulators' guidance adds further warning signs, including innovative technology such as AI or facial recognition and systematic monitoring of employees, and treats processing that meets two of them as generally needing a DPIA.
2. The four-step workflow
- Step 1 — Describe the processing. What data are you collecting, and where does it go? (Tip: start from a structured data map so you are not working from memory.)
- Step 2 — Necessity and proportionality. Do you really need the user's date of birth, or just their age band? Minimization is the point.
- Step 3 — Risk assessment. What happens if this data leaks? What if the model is biased?
- Step 4 — Mitigation measures. The most important part. Don't just list risks — resolve them (for example, 'anonymize after 30 days').
3. Where Mosaic makes the difference
Tools can flag a risk, but they cannot make the subjective legal judgment the assessment turns on. Under the GDPR, is your 'legitimate interest' strong enough to outweigh a user's reasonable expectations? That is a reasoned argument, not a checkbox. Mosaic's assessments are expert-led: a named senior privacy practitioner owns the analysis, every risk is rated against the same severity and residual-risk criteria, and the work lands in one standardized, regulator-ready report. You get a defensible result with an individual's reputation behind it — not a generic export.