Recommendations for a privacy impact assessment framework for the European Union

Abstract

This deliverable offers recommendations with regard to policy-making and practice on privacy impact assessments (PIAs). These recommendations are split into two sets. The first set is addressed to policy-makers intending to develop a PIA policy in their jurisdictions or improving existing ones. This part analyses the rationale and methods of introduction of a PIA policy, identifies and describes the constitutive elements of a PIA and discusses the role of data protection authorities (DPAs) in the process of PIA. The second set of recommendations is addressed to the assessors actually carrying out PIAs for whom the guidance on the best practice is offered.