Imagine launching a new product, app, or service — and realizing too late that it exposes thousands of people's personal data to risks nobody on the team ever considered. For regulators, that is not an oversight; it is a red flag. For the people whose data was exposed, it is a breach of trust. For the organization, it can mean fines, lawsuits, or reputational damage that outlasts the product itself.
A Privacy Impact Assessment — a PIA — exists to catch that problem before it happens, not after. Here is what it actually is, why it works, and two real Canadian cases that show exactly what is at stake when it is skipped or done badly.
A Privacy Impact Assessment, in Plain English
A PIA is not about protecting data for its own sake. Data on its own has no intrinsic value — what the law actually protects is the person connected to that data: their privacy, their dignity, and ultimately their freedom. That is why anonymized data, once the link to an identifiable person is irreversibly broken, is no longer treated as personal information under the GDPR, Brazil's LGPD, or Canada's PIPEDA.
So a PIA's real job is to assess how a project, system, or initiative may affect the rights and freedoms of real people, and to do it before the system goes live — so the organization can build in safeguards instead of explaining a breach after the fact.
Why a PIA Works Like an Environmental Study — or a Pre-Op Checkup
The closest real-world analogue to a PIA is the environmental impact study required before a factory can break ground — in Brazil, the EIA/RIMA. The object being protected is different (the environment instead of a person), but the logic is identical: environmental damage, especially deforestation or biodiversity loss, is often irreversible, so the law requires a preventive study before the project starts, not an inspection after the damage is done.
The same logic shows up in medicine. Before a non-emergency surgery, a patient goes through a pre-operative check-up — the surgeon needs to know about heart conditions, allergies, and blood test anomalies in advance, so nothing goes wrong on the operating table. A PIA is that check-up for data processing: it anticipates risk to fundamental rights so an organization can act before harm occurs, not after.
What Actually Counts as Personal Information?
Before any of this matters, there is a more basic question: what data are we even protecting? Every privacy law in the world starts here — if the information in question does not qualify as personal information, the law does not apply and no PIA is required. The moment data relates to a person, directly or indirectly, it becomes subject to rules, rights, and responsibilities.
- Direct identifiers single someone out on their own — a full name, a national ID number, a passport, a personal email or phone number, a facial image in a photo or scanned document.
- Indirect identifiers don't identify anyone in isolation, but can when combined with other data or context — an IP address, geolocation, a device ID, login credentials, or metadata like timestamps and system logs.
- The line between the two isn't fixed: a static IP tied to a residence can point directly to a household, and a job title like "CEO of the company" can uniquely identify someone in a small town.
- Some categories are treated as sensitive by default — race or ethnicity, political or religious belief, union membership, health and genetic data, biometric identifiers, and sex life or orientation — because their exposure risks discrimination or exclusion, not just inconvenience.
The more sensitive the data, the higher the chance the activity gets classified as high-risk — and high-risk processing is exactly what triggers a mandatory PIA (or DPIA, under the GDPR's terminology) under most of these frameworks.
Two Real Cases That Show Why This Isn't Theoretical
Canadian regulators and tribunals have already ruled directly on PIAs — once on the cost of not having one, and once on the cost of having one that wasn't good enough.
In Payne v. Public Service Alliance of Canada, 2023 FPSLREB 58, 155 federal workers argued that the Treasury Board should have completed a PIA before imposing its COVID-19 vaccination policy, and that their union, PSAC, had failed to defend that right — pointing to access-to-information requests that turned up no such assessment. The Federal Public Sector Labour Relations and Employment Board ultimately dismissed the complaint, finding that PSAC had in fact raised privacy concerns and supported grievances case-by-case, and that the allegations about a missing PIA were speculative rather than proof of bad faith.
The union won that round. But the case itself is the lesson: even where a PIA isn't strictly mandatory, its absence becomes the first thing employees, unions, and tribunals reach for when trust breaks down. Skipping the assessment doesn't just create privacy risk — it creates a permanent evidentiary gap that gets litigated later, on someone else's timeline.
The second case is more sobering, because a PIA had been done — just not well. In Department of Internal Services (Re), 2019 NSOIPC 2, Nova Scotia had launched a Freedom of Information website. Within a year, nearly 7,000 sensitive documents had been improperly accessed, because public and private files shared the same database and a user could simply alter a number in the URL to reach restricted records.
"Neither diligent nor rigorous" — the Nova Scotia Information and Privacy Commissioner's finding on a PIA that had technically been completed, but relied on vendor assurances instead of independent analysis.
That is the sharpest lesson in the whole chapter: a superficial PIA can be nearly as dangerous as skipping one entirely. A checkbox exercise gives an organization the comfort of having "done privacy" without the protection that a real, independent assessment actually provides.
The Takeaway
A Privacy Impact Assessment is not paperwork you produce for a regulator's file. It is a structured way to look at a project before it ships and ask what could go wrong for the people whose data it touches — and to fix that on paper, before it happens in production. Done well, it prevents harm, shields the organization from liability, and builds the kind of trust that a breach notification never can.
Payne v. PSAC and the Nova Scotia FOIA breach are two sides of the same coin: one shows what happens when a PIA is missing, the other shows what happens when it exists only on paper. Either way, the gap gets found — usually at the worst possible time.
This is the first article in a series drawn from Privacy Impact Assessment Basics, a practical guide for managers, entrepreneurs, and privacy teams who need to identify high-risk processing and document accountability in a way regulators actually respect. If you're ready to see whether a project on your desk right now would pass the same test PSAC's and Nova Scotia's didn't, the book's one-page Quick Check is built for exactly that — and it's the same judgment PIA Studio is being built to support at scale.