Impact Assessment (PIA)
The Impact Assessment (or Privacy Impact Assessment) complements the technical assessment. Where the technical report measures a theoretical re-identification risk, the impact assessment evaluates the likelihood and severity of this risk in the real world.
This report takes into account the global context of data usage:
- Probability of occurrence: Are the elements needed to perform an attack reasonably accessible?
- Impact: What would be the consequences if an attack were successful, considering data sensitivity?
- Trust level: Who are the data recipients?
- Data subjects: Who are the individuals concerned?
- Demographic variables: How many variables could be used for attacks?
Reasonable Means and the Attacker Model
The impact assessment should not be reduced to a theoretical “all possible attacks” exercise. The relevant question is whether a reasonable attacker, with the means reasonably likely to be used in the real world, could re-identify individuals from the released dataset.
This includes:
- access to external records or public information,
- realistic linkage strategies,
- practical technical capabilities and time investment,
- and the actual security context of sharing.
This is why the assessment is contextual: the same dataset may be acceptable under controlled access and rejected for broad external release.
For a practical checklist on how “reasonable means” is evaluated in real cases, see How do we assess whether a means is reasonable?.
Decision Making
These two reports are complementary and allow for a complete vision for the final decision: is the residual re-identification risk reasonable regarding the context?
- If yes: Data is considered anonymous in this context.
- If no: Additional measures can be added (encryption, limited sharing, etc.).
Customization Possibility
The automatically generated impact assessment report adapts based on the data usage context, sensitivity, and trust level provided by the user. The format of this report is also intentionally editable (docx) to meet the specific customization and arbitration needs of each organization or industry sector.