What is a privacy impact assessment?
A privacy impact assessment (in French, évaluation des facteurs relatifs à la vie privée, EFVP) is an analysis carried out before a project, to identify the risks it poses to personal information and decide on the measures that reduce them. It is proportionate to the sensitivity of the information, its quantity, its use and its medium.
Why it matters for your organization
Law 25 makes it an obligation, not a good practice. Transfers of information outside Quebec without an assessment are among the most frequent gaps: a cloud service hosted elsewhere, a provider abroad, a tool adopted by a team without going through anyone.
What it contains
- The project: what it does, which information it involves, who has access.
- The risks for the individuals concerned.
- The measures that reduce those risks, and who answers for them.
- For a transfer outside Quebec: the legal framework of the destination and the contractual safeguards.