What is the purpose of a privacy impact assessment (PIA)?

• A. To assess financial risk.
• B. To identify and mitigate privacy risks of a program affecting individuals.
• C. To document security incidents.
• D. To determine the best encryption method.

Answer: (B)

A privacy impact assessment focuses on privacy risks in a program that processes personal data. It aims to identify what information is collected, how it is used, who has access, where it is stored, how long it is retained, and whether it is shared with others. By evaluating the potential impact on individuals’ privacy and the likelihood of harm, you select mitigations to reduce those risks, such as data minimization, strong access controls, limited retention, privacy-by-design measures, and updated policies and training. The goal is to address privacy risks proactively and show compliance with privacy laws and requirements before the program launches.

The other options miss the broader privacy risk management scope: financial risk concerns money, not privacy; documenting security incidents is reactive and about breaches after they occur; and selecting an encryption method is only one technical control rather than the overall process of identifying and mitigating privacy risks.