What it covers. An international standard giving guidance on the process for privacy impact assessments and on the structure and content of a PIA report. It helps organisations identify and treat privacy risks of processing personal data.
In practice. Organisations decide when an assessment is needed, describe the processing and data flows, consult stakeholders, assess risks to individuals and agree treatment measures, then document and review the result. It is often used to structure data protection impact assessments under GDPR, alongside regulator guidance. Evidence includes completed assessments, treatment plans and follow-up records.
Common gaps. Common gaps are assessments done after a system is built, reports not updated when processing changes and agreed measures not tracked to implementation. Assessments also often focus on legal compliance rather than real risks to individuals.