The Office of the Privacy Commissioner (OPC) defines a privacy impact assessment (PIA) as "a risk management process that helps institutions ensure they meet legislative requirements and identify the impacts their programs and activities will have on individuals’ privacy."

This process is used to determine how a program or service could affect the privacy of an individual.

To give a brief overview of the Canadian regulatory landscape on this aspect:

• Federal public sector institutions must conduct a PIA to comply with the Privacy Act which sets out requirements for the collection, use and disclosure of personal information by the government.

• PIPEDA does not require organizations to conduct a PIA, although the upcoming CPPA (the Act that would replace PIPEDA) will require organizations to implement a privacy management program that would likely include such a process.

• QC Bill 64 requires firms to conduct impact assessments under certain circumstances, including when transferring data outside of Québec and acquiring, developing their IT infrastructure.