Which of the following should be the FIRST consideration when conducting a privacy impact assessment (PIA)?

Which of the following should be the FIRST consideration when conducting a privacy impact assessment (PIA)?

A. The applicable privacy legislation

B. The quantity of information within the scope of the assessment

C. The systems in which privacy-related data is stored

D. The organizational security risk profile

View Answer

Answer: A

Explanation:

The first consideration when conducting a privacy impact assessment (PIA) is the applicable privacy legislation that governs the collection, processing, storage, transfer, and disposal of personal data within the scope of the assessment. The applicable privacy legislation may vary depending on the jurisdiction, sector, or purpose of the data processing activity. The PIA should identify and comply with the relevant legal requirements and obligations for data protection and privacy, such as obtaining consent, providing notice, ensuring data quality and security, respecting data subject rights, and reporting data breaches. The applicable privacy legislation also determines the criteria, methodology, and documentation for conducting the PIA.

Reference: ISACA, Performing an Information Security and Privacy Risk Assessment1 ISACA, Best Practices for Privacy Audits2

ISACA, GDPR Data Protection Impact Assessments3

ISACA, GDPR Data Protection Impact Assessment Template4