# RA-08 Privacy Impact Assessments

NIST SP 800-53 control. Family: RA Risk Assessment. Function: detective. Baselines: privacy. Mapping licence: CC BY-SA 4.0.

Statement: Conduct privacy impact assessments for systems, programs, or other activities before: a. Developing or procuring information technology that processes personally identifiable information; and b. Initiating a new collection of personally identifiable information that: 1. Will be processed using information technology; and 2. Includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.
Guidance: A privacy impact assessment is an analysis of how personally identifiable information is handled to ensure that handling conforms to applicable privacy requirements, determine the privacy risks associated with an information system or activity, and evaluate ways to mitigate privacy risks. A privacy impact assessment is both an analysis and a formal document that details the process and the outcome of the analysis. Organizations conduct and develop a privacy impact assessment with sufficient clarity and specificity to demonstrate that the organization fully considered privacy and incorporated appropriate privacy protections from the earliest stages of the organization’s activity and throughout the information life cycle. In order to conduct a meaningful privacy impact assessment, the organization’s senior agency official for privacy works closely with program managers, system owners, information technology experts, security officials, counsel, and other relevant organization personnel. Moreover, a privacy impact assessment is not a time-restricted activity that is limited to a particular milestone or stage of the information system or personally identifiable information life cycles. Rather, the privacy analysis continues throughout the system and personally identifiable information life cycles. Accordingly, a privacy impact assessment is a living document that organizations update whenever changes to the information technology, changes to the organization’s practices, or other factors alter the privacy risks associated with the use of such information technology. To conduct the privacy impact assessment, organizations can use security and privacy risk assessments. Organizations may also use other related processes that may have different names, including privacy threshold analyses. A privacy impact assessment can also serve as notice to the public regarding the organization’s practices with respect to privacy. Although conducting and publishing privacy impact assessments may be required by law, organizations may develop such policies in the absence of applicable laws. For federal agencies, privacy impact assessments may be required by [EGOV]; agencies should consult with their senior agency official for privacy and legal counsel on this requirement and be aware of the statutory exceptions and OMB guidance relating to the provision.

## Patterns that use it (2)
- Critical (2): SP-027 Secure LLM Usage; SP-045 AI Governance and Responsible AI

## Clauses by framework (17 frameworks)
- iso_27002_2022: 5.34
- cobit_2019: APO12
- nist_csf_2: ID.RA-04
- iso_42001_2023: A.5.2, A.5.4
- osfi_b13: B-13.1.3
- finma_circular: IV.B.c(54), IV.D(78)
- gdpr: Art.35(1), Art.35(3), Art.35(7), Art.35(7)(c)
- bio2: 5.34
- lgpd_bcb: LGPD.Art.10, LGPD.Art.37-38
- bog_cisd: CISD-III
- bom_ctrm: 2.1
- sebi_cscrf: ID.RA
- cmmc_2: RA
- nhs_dspt: NDG-5.2
- csa_ccm_v4: DSP-09
- csa_aicm: DSP-09
- dpdpa: Act.9(2), Act.10(2)(c), Rules.13(1)-(2), Rules.13(3)
OSA's mapping for nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/RA-08
- Clauses only: /api/v1/controls/RA-08?fields=mappings
- Page for people: /controls/ra-08/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.