A company is designing a new cloud-based analytics platform that will combine customer purchase histories with location data to build behavioral profiles. Architecture decisions are still open. What should the privacy team do, and when?
Select an answer to reveal the explanation.
Short Explanation
A privacy impact assessment is like a building inspection before the walls go up: it's cheap to move a pipe on paper and expensive once the concrete sets. You run it during design so its findings change the architecture. The trap is treating it as a post-launch audit or swapping it for a security test.
Full Explanation
A privacy impact assessment identifies how a system will collect, use, share and retain personal data, evaluates risks to individuals and recommends measures to reduce them, such as data minimization, purpose limitation, pseudonymization, retention limits and transparency. Its value comes from timing: performed while design decisions are open, it allows privacy by design to be built in rather than retrofitted. Under the GDPR, a data protection impact assessment is required before processing that is likely to result in a high risk, which includes systematic profiling combined with location data in many cases. Performing the assessment after go-live means personal data is already being processed with unassessed risks, and changes become costly or impossible. An ISO/IEC 27001 certificate demonstrates an information security management system at the provider, but it does not evaluate the customer's purposes, legal bases or effects on individuals. A penetration test checks technical exploitability of the system; it does not consider whether the processing is necessary, proportionate or transparent. Exam caveat: a PIA should be revisited when processing changes significantly, not treated as a one-time form. Operational check: confirm the PIA is completed and signed off before the deployment gate, with each identified risk tracked to an owner and a control.