Privacy engineering policy and impact assessment

Privacy engineering policy and impact assessment

PR-01 — Privacy engineering policy

[Organisation] identifies and manages privacy risks arising from the information processing performed by its systems, suppliers and development activities. Privacy considerations enter stakeholder needs, requirements, design, testing, operation and retirement. The privacy owner maintains the assessment and coordinates with security, engineering, operations and the people responsible for applicable obligations.

The organisation considers effects on individuals and groups whose information is processed or whose opportunities and experiences are influenced by that processing. Privacy risk is not limited to unauthorised access. Collection, linking, inference, disclosure, retention or use can cause adverse effects even when the processing functions as designed. The assessment preserves these effects alongside information-security risks.

PR-02 — Identify processing and purposes

The owner maintains an inventory of processing activities, information categories, sources, purposes, recipients, locations, retention and responsible parties. The inventory includes derived or inferred information, identifiers, logs, test data, model interactions and information sent to suppliers. Data flows identify where information crosses organisational or technical boundaries and what each recipient may do with it.

Each processing purpose is linked to a business or stakeholder need and the applicable authority or obligation. The owner records whether processing is necessary for that purpose and whether less information or a different method could fulfil it. A proposed new use is assessed before it is treated as covered by an earlier purpose. Existing possession of information does not by itself establish authority for every later use.

PR-03 — Assess effects on people

The assessor identifies how the processing could affect people’s autonomy, access to services, confidentiality, reputation, safety, finances or other interests relevant to the context. Assessment considers the scale, sensitivity, linkability, duration and visibility of processing and the ability of affected people to understand or influence it. The stakeholder register identifies representation and consultation arrangements.

The assessor records problematic processing actions, potential consequences, likelihood or other estimation basis, uncertainty and affected groups. The risk record distinguishes organisational consequences from consequences to individuals. Where the same processing benefits some stakeholders and disadvantages others, the assessment preserves the trade-off for an accountable decision.

PR-04 — Define privacy requirements

The owner translates assessment results and applicable obligations into requirements for collection, purpose limitation, access, use, sharing, correction, retention, deletion and communication. Requirements identify the system behaviour and operational work needed to give them effect. Selection may include minimisation, separation, aggregation, de-identification or other privacy engineering approaches where they address the actual processing risk.

Controls are assessed for limitations. Aggregated data may still expose small groups; pseudonymous data may remain linkable; deletion from a primary store may leave replicas, exports or supplier copies. The design record identifies residual exposure and the evidence needed to assess the chosen approach. Privacy requirements remain testable and connected to the information flows they govern.

PR-05 — Transparency and requests

The responsible owner provides information about processing through the notices and communication methods required for the context. The content reflects actual purposes, information, recipients, retention and contact arrangements. Changes in processing are reviewed for their effect on notices and any required choice or authorisation. The organisation does not describe processing as optional where the service actually makes it compulsory.

Requests to access, correct, delete, restrict or otherwise address information are handled under the applicable obligation record. The procedure identifies intake, identity verification proportionate to the request, search scope, decision authority, response period and evidence. The owner records downstream actions needed to correct or remove information already shared, together with limitations and the basis for the response.

PR-06 — Assess and approve change

A privacy assessment is initiated for new processing or a material change in purpose, information, recipients, technology, scale, inference or affected people. The owner records the trigger and relevant system baseline. Assessment outcomes identify requirements, treatments, unresolved questions and the authority responsible for the processing decision. Where a formal privacy impact assessment is required, its applicable process and approval are identified.

Before operation, verification checks whether the selected requirements are implemented and whether notices and procedures match the delivered system. The decision-maker receives the assessment, evidence and outstanding risk. Approval of a system release is linked to, but does not silently replace, any separate processing authority required by the organisation’s obligations.

PR-07 — Monitor and map

The privacy owner reviews processing at [schedule] and following relevant changes, complaints, incidents or new information. The review checks actual information flows, supplier practices, retention, request handling and the continuing validity of purposes. Findings enter the risk and corrective-action records.

Privacy activities are organised using the NIST Privacy Framework 1.0 functions Identify-P, Govern-P, Control-P, Communicate-P and Protect-P. Related cybersecurity outcomes can also be reported under CSF 2.0, with the mapping source and version recorded. A cybersecurity mapping does not remove privacy outcomes without a complete counterpart. The privacy assessment remains authoritative for the risks to people it identifies.