Summary
Many organizations use privacy impact assessments to find risks in how they handle personal data, but how these assessments are done varies a lot. The authors talked to privacy professionals from many countries to learn how they plan and carry out these assessments. They found people often don’t follow official methods closely, and sometimes don’t fully consider the rights of individuals. The study also looks at how these assessments connect to new regulations like the EU AI Act, and how combining different types of impact assessments could help but might also cause extra work.
What this means in practice
- •For privacy compliance teams: Improve planning and execution of privacy impact assessments by learning common challenges and trade-offs from experienced professionals worldwide.
- •For data ethics officers: Design integrated frameworks that combine fundamental rights and data protection assessments while managing concerns about workload and assessment fatigue.
A survey. It maps existing work.
Abstract
Organisations frequently utilise Privacy Impact Assessments (PIAs), Data Protection Impact Assessments (DPIAs), or even Fundamental Rights Impact Assessments (FRIAs) to identify and evaluate potential risks and possible infringements of fundamental rights. While the adoption of PIAs and DPIAs has grown significantly in recent years, robust scientific evidence regarding their operational challenges, implementation strategies, and tangible benefits remains scarce. In particular, empirical research conducted post-enactment of the General Data Protection Regulation (GDPR) is notably limited -- especially studies that directly interview professionals about their PIA/DPIA practices or their engagement with FRIAs. To do so, in this paper we leveraged semi-structured interviews to elicit privacy professionals' perspectives on PIA/DPIA activities and analysed the responses using reflexive thematic analysis. As a result, this work provides a comprehensive thematic framework for the field, offering a rich and thick description of professionals' views and experiences. In total, 26 participants from 17 countries were interviewed, revealing how they plan and conduct PIAs/DPIAs, including how they assess trade-offs, the benefits and challenges they perceive, and how they view the interplay between PIAs/DPIAs and the EU AI Act. Among the main findings were low adherence to established DPIA methodologies; differences and similarities between PIAs and DPIAs; a perceived neglect of data subjects' interests during DPIA processes; discussions on building FRIAs on top of DPIAs; and the potential for holistic impact assessments, though accompanied by concerns regarding assessment fatigue. Thus, this study informs privacy professionals about real-world challenges and experiences of PIA/DPIA implementation, and guides researchers toward future research directions.