How do privacy impact assessments relate to processing personal data?

• A. They focus only on system performance.
• B. Evaluate privacy risks and mitigations after data processing.
• C. They evaluate privacy risks and impacts of processing personal data; identify mitigations to protect privacy.
• D. They replace the need for data protection impact assessments.

Answer: (C)

This item tests how privacy impact assessments relate to processing personal data. A privacy impact assessment looks at how personal data are processed—what data are involved, the purposes, the context, who has access, how long data are kept, and what potential privacy risks arise for individuals. It then identifies concrete measures to mitigate those risks and protect privacy, such as data minimization, access controls, encryption, retention limits, and transparency about processing. Because the focus is on preventing privacy problems before and during processing, these assessments are proactive rather than purely retrospective. They also support designing systems with privacy by default.

The best answer captures both parts: evaluating the privacy risks and impacts of processing personal data, and identifying mitigations to protect privacy. The other options miss essential aspects—focusing only on system performance ignores privacy risks; evaluating after processing doesn’t reflect the proactive nature of PIAs; and claiming they replace data protection impact assessments misrepresents how these assessments relate in practice.