Privacy Impact Assessment Template

• Created on

  Date

• Project Manager/System Owner

• Location
  Address

• Project/System Title

• Description

• Purpose

• What specific legal authorities, arrangements, and/or agreements require the collection of this information?

Data in the System

• What data is to be collected?

• What are the sources of the data?

• Why is the data being collected?

• What technologies will be used to collect the data?

• Does a personal identifier retrieve the data?

  Yes

  No

  N/A

Attributes of the Data (use and accuracy)

• Describe the uses of the data.

• Does the system analyze data to assist users in identifying previously unknown areas of note, concern, or pattern?

  Yes

  No

  N/A

• How will the data collected from individuals or derived by the system be checked for accuracy?

Sharing Practices

• Will the data be shared with any internal or external organizations?

  Yes

  No

  N/A

• How is the data transmitted or disclosed to the internal or external organization?

• How is the shared data secured by external recipients?

Notice to Individuals to Decline/Consent Use

• Was notice provided to the different individuals prior to collection of data?

  Yes

  No

  N/A

• Do individuals have the opportunity and/or right to decline to provide data?

  Yes

  No

  N/A

• Do individuals have the right to consent to particular uses of the data?

  Yes

  No

  N/A

Access to Data (administrative and technological controls)

• Has the retention schedule been established by the Records Officer? If so, what is the retention period for the data in the system?

  Yes

  No

  N/A

• What are the procedures for identification and disposition of the data at the end of the retention period?

• Describe the privacy training provided to users, either generally or specifically relevant to the program or system?

• Is the data secured in accordance with Federal Information Security Management Act (FISMA) requirements?

  Yes

  No

  N/A

• Provide date that the Certification & Accreditation was completed

• Which user group/s will have access to the system?

• How is access to the data by a user determined? Are procedures documented?

• How are the actual assignments of roles and rules verified according to established security and auditing procedures?

• What auditing measures/controls and technical safeguards are in place to prevent misuse (e.g., unauthorized browsing) of data?

Privacy Analysis

• Given the amount and type of data being collected, discuss what privacy risks were identified and how they were mitigated.

• Other Comments and Notes

• Project Manager/System Owner

  Sign

• Chief Privacy Officer

  Sign

• Chief Security Officer

  Sign

• Chief Information Officer

  Sign