Question 1

What is the purpose of a privacy impact assessment?

Accepted Answer

The purpose of a privacy impact assessment (PIA) is to identify and evaluate the risks that a data processing activity poses to individuals’ privacy. A PIA helps organizations understand how personal data is collected, used, shared, and protected, and whether those practices comply with applicable privacy laws. Under US state privacy laws like the CCPA/CPRA, CPA, CTDPA, and VCDPA, privacy impact assessments (also called data protection assessments) are legally required for high-risk processing activities such as profiling, targeted advertising, sale of personal data, and processing of sensitive data.

Question 2

What is a privacy impact assessment (PIA)?

Accepted Answer

A privacy impact assessment (PIA), also known as a data protection impact assessment (DPIA) or data protection assessment (DPA), is a systematic process for evaluating how a project, system, or data processing activity collects and handles personal information. It identifies privacy risks, assesses their severity and likelihood, and documents mitigation measures. In the US, over 15 state privacy laws now require controllers to conduct PIAs before engaging in certain high-risk processing activities, including profiling, targeted advertising, selling personal data, and processing sensitive data categories like biometric or health information.

Question 3

Which US states require privacy impact assessments?

Accepted Answer

As of 2026, the following US states require data protection assessments (DPAs) or privacy impact assessments: California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Montana (MCDPA), Oregon (OCPA), Delaware (DPDPA), New Jersey (NJDPA), Nebraska (NDPA), Maryland (MODPA), Minnesota (MCDPA), New Hampshire (NHPA), Indiana (INCDPA), Kentucky (KCDPA), Rhode Island (RIDTPPA), Tennessee (TIPA), and Texas (TDPSA). Iowa, Utah, and Florida do not require DPAs. Each state specifies different triggers and submission requirements.

Question 4

What triggers a data protection assessment under state privacy laws?

Accepted Answer

Common triggers for a mandatory data protection assessment include: (1) processing personal data for targeted advertising, (2) selling personal data, (3) processing personal data for profiling that presents a foreseeable risk of harm, (4) processing sensitive data such as biometric, health, financial, or geolocation information, and (5) processing children’s personal data. California additionally requires assessments for automated decision-making technology (ADMT). The specific triggers vary by state, so businesses operating in multiple states should conduct assessments for the broadest set of applicable triggers.

Question 5

How do I create a privacy impact assessment template?

Accepted Answer

To create a privacy impact assessment template: (1) Identify the processing activity and its purpose, (2) Document the categories of personal data involved and data sources, (3) Describe data flows including third-party sharing and cross-border transfers, (4) Assess necessity and proportionality of the processing, (5) Identify and evaluate privacy risks to individuals, (6) Document safeguards and mitigation measures, (7) Include a benefits-vs-risks analysis as required by most state laws, and (8) Document your conclusion and any ongoing monitoring plans. Our free PIA generator creates state-specific templates pre-filled with your processing details and applicable legal requirements.

Privacy Impact Assessment Generator

Where Does Your Organization Operate?

Privacy Impact Assessment Generator

Where Does Your Organization Operate?