Global Guide to Privacy Impact Assessment

“Privacy is not a privilege. It is a fundamental human right.”

Human System began with a simple conviction: technology and organizations should serve people, not the other way around. Protecting personal data is the most concrete way we know to act on that conviction.

This Global Guide to Privacy Impact Assessment (PIA) was prepared by Human Identification Technologies for any organization in the world, public or private. Its purpose is practical: to help teams assess, manage and reduce the risks that the use of personal data creates for people’s rights and freedoms.

The moment calls for it. Organizations collect, process and transfer more personal data every year, and the growth shows no sign of slowing. SuperIntelligence, big data analytics, the Internet of Things, biometric systems and automated profiling have changed both the scale and the nature of privacy risk.

In that setting a PIA cannot be a bureaucratic formality. It has to be a careful, systematic exercise that begins when a system or process is designed, not after it has been built.

The Guide draws on the main regulatory and academic sources available worldwide: the EU General Data Protection Regulation (GDPR, 2016/679),¹ the Article 29 Working Party guidelines (WP248),² the AEPD practical guide to risk analysis,³ DLA Piper’s comparative study Data Protection Laws of the World,⁴ ISO/IEC 29134:2017, the OECD Privacy Framework (2013), the NIST Privacy Framework (2020), Mexican federal law, Brazil’s LGPD, California’s CCPA/CPRA and dozens of other frameworks.

1.1What is a Privacy Impact Assessment?

A Privacy Impact Assessment (PIA) is a systematic, documented and repeatable process for identifying, evaluating and managing the risks that the processing of personal data can create for individuals’ rights and freedoms. In the European context it is called a Data Protection Impact Assessment (DPIA).⁵

Roger Clarke, working in Australia in the 1990s, was the first to formalize the idea. He later described a PIA as a process that identifies and evaluates the effects a project, system or technology may have on privacy, involves consultation with the people affected, and looks for ways to avoid or reduce the negative effects.⁶

A PIA is a privacy governance tool. It lets an organization:

• (a) Understand how personal data flow through a processing activity;
• (b) Identify threats to the confidentiality, integrity and availability of the data;
• (c) Assess the resulting risk to data subjects’ rights and freedoms;
• (d) Adopt proportionate measures to reduce or remove that risk; and
• (e) Document and justify the analysis, and keep it up to date.

1.2History and evolution

1. 1967

   Alan Westin publishes Privacy and Freedom, setting out the modern theory of the right to privacy.

2. 1980

   The OECD publishes its first Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.

3. 1995

   EU Directive 95/46/EC on data protection, the first harmonized European framework.

4. 1996

   Roger Clarke coins and formalizes the concept of the Privacy Impact Assessment (PIA).

5. 2009

   Ann Cavoukian (Information and Privacy Commissioner of Ontario) publishes Privacy by Design: The 7 Foundational Principles.

6. 2010

   Mexico enacts its Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

7. 2011

   David Banisar (Privacy International) publishes the first global comparative study of PIAs.

8. 2013

   The OECD updates its Privacy Framework.

9. 2016

   The GDPR is adopted and makes the DPIA a legal obligation for high-risk processing (it applies from 2018).

10. 2017

    ISO/IEC 29134:2017 sets the international PIA standard.

11. 2017

    WP248: the Article 29 Working Party publishes its definitive DPIA guidelines.

12. 2018

    The GDPR becomes applicable (25 May). Brazil enacts the LGPD. The AEPD publishes its practical guide to risk analysis.

13. 2020

    The CCPA takes effect in California. NIST publishes Privacy Framework v1.0.

14. 2021

    UNESCO adopts the Recommendation on the Ethics of Artificial Intelligence.

15. 2023

    The CPRA amendments take effect in California, adding risk-assessment duties.

16. 2024

    The EU AI Act enters into force (1 August).

17. 2025

    Mexico replaces its federal data protection laws (March). Taiwan promulgates a major reform of its PDPA (November).

18. 2026

    Taiwan’s AI Basic Act takes effect (14 January). The EU’s Digital Omnibus on AI postpones the high-risk obligations of the AI Act to December 2027 and August 2028.

1.3Purpose and scope of this Guide

This Guide is designed to:

• Give any organization, whatever its size, sector or jurisdiction, a step-by-step methodology;
• Serve as a reference for controllers, processors and Data Protection Officers (DPOs), and for legal, technical and compliance teams;
• Bring in international best practice and the most widely recognized standards;
• Work in the public sector (government bodies, autonomous agencies, public hospitals) and in the private sector (companies, non-governmental organizations, digital platforms); and
• Adapt to SI (superintelligence), big data, IoT, biometrics and other emerging technologies.

1.4Key figures and hard data

The figures below are global. They show why a PIA is worth the effort. They come from published studies, and each one is dated. The studies use different methods and cover different groups of organizations, so the numbers are not directly comparable with each other. Check the latest edition before you quote them.

This chapter builds on DLA Piper’s Data Protection Laws of the World (2016), which describes the data protection rules of about 90 jurisdictions. UNCTAD counted 108 countries with national data protection legislation in the same year.⁷ Data protection is now a regulatory subject in every region of the world.

The chapter is organized by region: international and regional instruments, Europe, Latin America, North America, Asia-Pacific, the Middle East and Africa. It also takes a closer look at several jurisdictions that matter for PIA practice: Germany, France, Norway, Ukraine, Mexico, Bolivia, Cuba, Venezuela, Alaska and Taiwan. It selects jurisdictions rather than listing every one; for the rest, start with the sources in Chapter 10.

2.1International framework

2.1.1United Nations instruments

• Article 12, Universal Declaration of Human Rights (1948): “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence…”
• Article 17, International Covenant on Civil and Political Rights (1966): “No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence…”
• General Assembly resolutions: A/RES/68/167 and A/RES/69/166, on the right to privacy in the digital age.
• UN Special Rapporteur on the right to privacy: Joseph Cannataci (2015–2021) and Ana Brian Nougrères (since 2021). Their annual reports guide how the right to privacy is interpreted in digital settings.

2.1.2OECD and Council of Europe instruments

• OECD (2013), The OECD Privacy Framework: eight basic principles: collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation and accountability.
• Council of Europe Convention 108+ (2018): the update of Convention 108 of 1981, and the only legally binding international instrument on data protection. It is open to non-European states.
• ISO/IEC 29134:2017: the international standard that sets out requirements and guidelines for conducting privacy impact assessments.
• ISO/IEC 29101:2018: a privacy architecture framework for ICT systems.

2.1.3Regional frameworks

• APEC Privacy Framework (2005) and the Cross-Border Privacy Rules (CBPR) system: a voluntary framework for the Asia-Pacific economies, now also run through the Global CBPR Forum.
• ASEAN Framework on Personal Data Protection (2016): common principles for Southeast Asia, followed by ASEAN Model Contractual Clauses for cross-border data flows (2021).
• Ibero-American Data Protection Standards (2017): adopted by the Ibero-American Data Protection Network and used as a model by several Latin American countries.
• African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention, 2014): in force since 8 June 2023. See section 2.7.
• ECOWAS Supplementary Act A/SA.1/01/10 (2010): binding rules on personal data protection for West African states.

2.2Europe: the GDPR and national law

The General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, is the most influential privacy framework in the world. Article 35 makes a DPIA a legal obligation whenever processing is likely to result in a high risk to people’s rights and freedoms.⁸

2.2.1Selected European jurisdictions

Within the EU and EEA the GDPR applies directly, and each country adds its own implementing law and supervisory authority. Other European countries have their own regimes.

2.2.2Germany

• Legal framework. The GDPR applies directly. The Federal Data Protection Act (BDSG) supplements it for federal bodies and private organizations, each of the 16 states has its own law for state and municipal bodies, and the TDDDG covers digital services and terminal equipment.
• Supervision. The Federal Commissioner (BfDI) and the state authorities supervise, and they coordinate through the Data Protection Conference (DSK). Some states split public and private oversight between different authorities. The federal government has announced plans to centralize private-sector supervision; check the current status.
• DPIA. The DSK has published a list of processing operations that always need a DPIA (the “must list”, 2018) and the Standard Data Protection Model (SDM), a method for turning legal requirements into technical and organizational measures.
• Data protection officer. Section 38 of the BDSG requires a DPO where at least 20 people regularly work on automated processing, a lower bar than the GDPR, and also where processing requires a DPIA. The federal government has announced plans to repeal the 20-person rule by the end of 2026; Article 37 of the GDPR would still apply.
• Employees. Section 26 of the BDSG governs employee data. Technical systems that can monitor employees, including biometric time and access systems, usually need the works council’s agreement (Works Constitution Act, section 87(1) no. 6).

2.2.3France

• Legal framework. The GDPR applies directly, together with the Loi Informatique et Libertés (Law No. 78-17 of 6 January 1978), which was amended in 2018 to align it with the GDPR.
• DPIA guidance. The CNIL has published its own DPIA guidelines and a list of 14 types of processing operations for which a DPIA is mandatory (2018), along with a list of operations that do not need one. Its working rule: two or more of the nine WP248 criteria generally mean a DPIA.
• Tools. The CNIL offers a free, open-source PIA software and a knowledge base, in French and English (see section 10.4).
• Biometrics. The CNIL takes a restrictive line on biometric systems. It has a model regulation (règlement type) for biometric access control at work (2019). Employers who want to use biometric access control should start there, and a DPIA is the norm for such systems.
• Employees. The works council (CSE) must be informed and consulted before monitoring tools are introduced, and employees must be told in advance.
• DPO. DPOs are designated under Article 37 of the GDPR, and the designation is notified to the CNIL.

2.2.4Norway

• Legal framework. Norway is not in the EU but belongs to the European Economic Area (EEA), so the GDPR applies there. The Personal Data Act of 2018 gives the GDPR the force of law in Norway. It entered into force on 20 July 2018, after the EEA Joint Committee incorporated the Regulation on 6 July 2018, and it adds national rules where the GDPR allows them.
• Supervision. Datatilsynet, the Norwegian Data Protection Authority, enforces the GDPR and the Personal Data Act over public and private bodies alike, and also oversees privacy rules in employment. Its decisions, including fines, can be appealed to the Privacy Appeals Board (Personvernnemnda) or to the courts.
• DPIA and AI. The usual GDPR rules on DPIAs and DPOs apply. Datatilsynet publishes DPIA guidance and runs a regulatory sandbox where organizations can develop AI projects with the authority’s support.
• Enforcement example. In December 2021 Datatilsynet fined Grindr NOK 65 million for passing personal data to advertising partners without a valid legal basis, including data that revealed sexual orientation, a special category. The Privacy Appeals Board upheld the fine in September 2023. The case shows how costly it is to combine special-category data with advertising partners.
• Children and health data. The age of consent for information society services is 13. Sector laws such as the Health Register Act and the Patient Rights Act add rules for health data.
• Data flows. As an EEA state, Norway shares the free flow of personal data with the EU. Transfers outside the EEA follow Chapter V of the GDPR.

2.2.5Ukraine: the Law on Personal Data Protection and the road to a GDPR-style law

Ukraine’s general data protection regime rests on Law No. 2297-VI of 1 June 2010, which covers both the public and the private sector and is anchored in Article 32 of the 1996 Constitution.¹⁵ Ukraine signed Convention 108 in 2005 and ratified it in 2010.¹⁶ The supervisory authority is the Ukrainian Parliament Commissioner for Human Rights (the Ombudsman), an office inside the human-rights ombudsman function rather than a stand-alone data protection authority.¹⁷

Reform is under way. Aligning the framework with the GDPR is one of Ukraine’s obligations under its Association Agreement with the EU,¹⁸ and Draft Law No. 8153 passed its first reading on 20 November 2024. As at mid-2026 it was still being prepared for a second reading.^19,20 Until it is enacted, the 2010 law applies.

Key provisions of the Ukrainian law for the PIA

Key trends and considerations for Ukraine

• Status of Draft Law No. 8153. Reports on the first-reading text say it would require DPIAs before high-risk processing (large-scale profiling, systematic monitoring and special categories), a DPO for large-scale processors, breach notification to the authority within 72 hours, and fines of up to UAH 150 million or 8% of annual turnover for legal entities.^32,33 Commentators do not agree on how far the draft goes on DPIAs and breach notification,³⁴ and the text can still change at second reading. Plan for these duties now, but do not treat them as law.
• A new authority. The Ombudsman remains the supervisor for now.³⁵ A companion bill, No. 6177, would create a National Commission for Personal Data Protection and Access to Public Information.³⁶
• War-time measures. The 2010 law has been amended in connection with martial law, for example to let personal data go to foreign providers of telemedicine and rehabilitation care under the rules of the country that licenses them.³⁷ Check for emergency rules before assessing any processing in Ukraine.
• Digital identity and biometrics. Law No. 1368-IX, adopted on 30 March 2021 and in force from 23 August 2021, amended the law on the Unified State Demographic Register so that e-passports in the Diia app have the same standing as paper documents; they are available only to holders of an ID card or biometric passport.³⁸ Because Art. 7 lists biometric data among the special categories, a PIA for any identity or authentication system in Ukraine should treat it as critical risk by default (section 7.4).

2.3Latin America

2.3.1Mexico: credit institutions and biometric databases (CNBV, 2026)

The 2025 LFPDPPP applies to banks as it does to any private party, and the Secretaría Anticorrupción y Buen Gobierno (SABG) is the authority. Banking regulation adds its own layer. In 2026 the National Banking and Securities Commission (CNBV) changed the rules on biometric identification in credit institutions.

• The rule. The CNBV resolution amending the general provisions applicable to credit institutions (the Circular Única de Bancos, CUB) was published in the Official Gazette (DOF) on 1 July 2026 and took effect on 2 July 2026. It adds facial biometrics to fingerprints for in-person operations and replaces Annex 71, which sets the technical requirements.^54,55
• Verification against official records. Biometric data may be used only to authenticate identity, and the institution must verify online a match of at least 90% against the records of the INE, the SRE, the SAT or another competent authority.⁵⁶
• Biometric databases. Credit institutions may now build their own database of clients’ biometric data, for now only fingerprints and facial biometrics, after validating the data against official records.^57,58 They may hire third parties to build it, but each institution verifies only against its own database.⁵⁹ Selling, transferring, sharing, exchanging or reusing these databases between institutions or with third parties is prohibited.^60,61
• Notices and deadlines. Institutions notify the CNBV (Annex 75) within 20 business days after they begin using the database; institutions that already had one had 30 calendar days from entry into force to notify; the deadline to comply is 90 business days. When an institution stops using the database it must notify the CNBV and securely delete the data.⁶²
• Security. Annex 71 requires logical segregation of the biometric databases, dedicated infrastructure with separate network segments, encryption in transit and at rest, access control with audit logs, periodic vulnerability and penetration tests, and an annual validation. Institutions must also have documented procedures for people who cannot give a fingerprint.⁶³
• Consent and sensitive data. Under Art. 8 of the 2025 LFPDPPP, sensitive data need express written consent (handwritten signature, electronic signature or another authentication mechanism), and databases of sensitive data may only be created for legitimate, concrete purposes consistent with the entity’s explicit activities.⁶⁴ Fines can be doubled when sensitive data are involved.⁶⁵ Facial biometrics count as sensitive data.⁶⁶ The CNBV rules do not replace these duties.
• Enforcement example. In July 2026 the SABG fined the Mexican Football Federation MXN 42.8 million over its FAN ID stadium system: it had not warned fans that the photographs collected were sensitive biometric data, had not obtained express written consent, and had breached the principles of lawfulness and accountability.⁶⁷ The decision shows how the authority reads biometric consent.
• Scope. The resolution applies only to credit institutions.⁶⁸ Other financial entities and technology providers should not assume the same rules apply, but the LFPDPPP applies to all of them.

Exercising your rights before public bodies. To file an access request, an ARCO request or a review appeal with a Mexican public body, use the National Transparency Platform (PNT); its deadlines and a direct link are in section 10.6.

2.3.2Bolivia: the constitutional route to data protection (no general law yet)

Bolivia has no general data protection law.^69,70 Two bills, one by the e-government agency AGETIC and one by InternetBolivia.org, have not advanced in the legislature, and no specialized office has powers to review how personal data are used.⁷¹ Access Now and InternetBolivia.org (2019), the authors of document 10 in the credits, describe a country where protection comes from the Constitution and scattered sector rules that are incomplete, uncoordinated and without an integrated view.⁷²

Key provisions of Bolivian law for the PIA

Key trends and considerations for Bolivia

• The pending bills. AGETIC’s draft would create a Data Protection Authority with powers to investigate, supervise, promote compliance and sanction, and a Bolivian register of databases.⁸⁶ Access Now, InternetBolivia.org and other organizations sent observations on 18 of its articles.⁸⁷ A PIA should track the bill but cannot rely on it.
• Judicial redress. Without an authority, the Acción de Protección de Privacidad is the main route for data subjects.⁸⁸ Keep a documented channel for access, correction and deletion requests, so that a dispute is resolved before the judicial stage.
• Identity and civil registry systems. SEGIP is the controller of the national identification database,⁸⁹ and the civil registry is interoperable with it.⁹⁰ Projects that touch these systems are high-risk processing by public bodies (Chapter 6).
• Reported misuse. Access Now and InternetBolivia.org report the unauthorized disclosure of an official’s HIV status⁹¹ and the unauthorized use, sale and transfer of databases.⁹² See section 2.3.5.
• AI and biometrics. In October 2025 the Senate approved a bill on the promotion, management and use of artificial intelligence (PLS 178/2024-2025) and sent it to the Chamber of Deputies. It would make AGETIC the regulator and, according to press reports, prohibit mass facial recognition without judicial authorization.⁹³ Other AI bills are also listed as pending.⁹⁴
• Access to information. On 27 August 2026 the Senate approved a framework access-to-information bill (No. 066/2025-2026) and sent it to the Chamber of Deputies; Bolivia is described as the only South American country without such a law.⁹⁵ Public-sector PIAs should weigh transparency against privacy.
• Transfers. The adequacy principle in document 10 says data should not go to a country without adequate protection.⁹⁶ Treat Bolivia as a destination without a general data protection law and use contractual safeguards (section 7.6).

2.3.3Cuba: Law 149 of 2022 on Personal Data Protection

Cuba adopted its first general data protection statute, Law No. 149 “De Protección de Datos Personales”, on 14 May 2022. It was published in the Official Gazette on 25 August 2022^98,99 and entered into force on 21 February 2023, 180 days after publication.¹⁰⁰ It applies to public and private entities and to natural and legal persons that process personal data, in physical or digital form.¹⁰¹ The 2019 Constitution protects personal and family privacy and a person’s own image and voice (Art. 48), and recognizes everyone’s right to access their personal data held in registers, archives and other databases and to have them corrected (Art. 97, a habeas data guarantee).¹⁰²

There is no independent data protection authority. The Ministry of Justice was given one year to create a national control of personal databases and is charged with monitoring compliance; sanctions are imposed by officials authorized by the bodies of the Central State Administration.¹⁰³ For data in electronic form, the Ministry of Communications (MINCOM) issued Resolution 58/2022, a security regulation for telecommunications and ICT operators, hosting and application providers and anyone else who processes personal data electronically.¹⁰⁴

Key provisions of Cuban law for the PIA

Key trends and considerations for Cuba

• No impact-assessment duty. Law 149 does not require a PIA; the closest provisions are the rules on sensitive data and proportionality.¹¹⁸ A PIA is still the clearest way to show that consent, purpose, retention and security meet the law.
• Supervision inside the executive. Oversight sits with the Ministry of Justice and the bodies of the Central State Administration, not with an independent authority.¹¹⁹ This Guide could not confirm whether the national control of personal databases has been set up; check before relying on it.
• Data localization. MINCOM requires databases with personal data to be hosted or replicated only on servers in Cuba, unless the law provides otherwise.¹²⁰ Cloud services abroad, backups and remote support need a specific legal basis.
• Broad public-order and security exceptions. Independent media criticized the exceptions for public order and national security (Art. 16.1) and the treatment of recordings from personal devices (Art. 54).¹²¹ A PIA for processing that state bodies could reach should document how those exceptions would apply.
• Civil registry and identity. Law 180/2025 on the Civil Registry, published in the Official Gazette on 16 March 2026, creates a single, central electronic registry, applies the data protection security measures to it, places sensitive data under restricted publicity and recognizes the right to rectify and update records.¹²² Identity projects that connect to the registry are high-risk processing (Chapter 6).
• Deceased persons. Law 149 lets a person decide in life what happens to their data after death and otherwise gives the decision to heirs or successors (Art. 16.2); see section 7.7.¹²³

2.3.4Venezuela: constitutional habeas data without a general law

Venezuela has no general personal data protection law.¹²⁴ Protection rests on the 1999 Constitution: Art. 28 gives everyone the right to access the information and data about them held in public or private registers, to know their use and purpose, and to ask a court to update, rectify or destroy them when they are wrong or unlawfully affect their rights; Art. 60 protects honor, private life, intimacy, own image, confidentiality and reputation and says the law will limit the use of informatics; Art. 143 gives access to administrative files and records.¹²⁵

The Constitutional Chamber of the Supreme Court of Justice filled the gap with case law. Judgment No. 1318 of 4 August 2011 set out principles for any processing of personal data: autonomy of will (consent), informational self-determination, legality, purpose and quality, security and confidentiality, temporality (retention), accuracy, foresight, protection and accountability.¹²⁶ Later judgments defined personal data as any information related to an identified or identifiable person (No. 855 of 2012) and required the strictest confidentiality for medical records (No. 1335 of 2011).¹²⁷ There is no data protection authority, no registration or DPO duty, and no mandatory breach notification.¹²⁸

Key provisions of Venezuelan law for the PIA

Key trends and considerations for Venezuela

• Case law instead of a statute. Without a general law, a PIA should use the principles of judgment 1318/2011 as its checklist and document consent, purpose, retention and security against them.¹³⁸
• No authority, court enforcement only. Data subjects must go to court through the habeas data claim; there is no regulator to consult or notify.^139,140 Organizations should still keep an incident log and a response plan.
• State databases and biometrics. Identity data are increasingly linked: notaries and registries check fingerprints against the SAIME identification database,¹⁴¹ and civil-society researchers report that data from Sistema Patria, the VEN911 camera network and intelligence databases can be cross-referenced, with facial recognition used without judicial oversight or consent.¹⁴² Identity projects that connect to these systems are high-risk processing (Chapter 6).
• History of exposure. The Lista Tascón published the names and identity numbers of people who signed a recall petition in 2004, and doubts about the 2011 census led to calls for a data protection law.¹⁴³ A PIA should treat political opinion and affiliation as sensitive data.
• Bills in progress. A draft Artificial Intelligence Law passed first reading in November 2024 and includes data protection and consent duties (Art. 9), but had not advanced by December 2025.¹⁴⁴ Check its status before relying on it.

2.3.5Reported incidents in Latin America (illustrative)

The following cases were reported by Access Now and InternetBolivia.org (2019), document 10 in the credits. The Guide has not verified them independently, and they date from 2015–2019. Each points to a failure that a PIA is meant to catch: insider access, exposed registries, weak vendor security and the uncontrolled sale of databases.

2.4North America

• United States: CCPA/CPRA (California, 2020/2023). A federal framework built from sector laws, plus a general California law. It gives rights to know, delete and port data. The CPRA adds data minimization duties and risk assessments for sensitive data. Other sector rules include HIPAA (health), FERPA (education), COPPA (children) and GLBA (finance).
• Canada: PIPEDA (2000) and Bill C-36 (2026). PIPEDA remains the federal private-sector law. Bill C-27, which would have replaced it, died when Parliament was prorogued in January 2025. On 15 June 2026 the government introduced Bill C-36, the Protecting Privacy and Consumer Data Act. It would replace Part 1 of PIPEDA and, according to published summaries, add privacy impact assessment and privacy management program requirements. At the time of writing it was still before Parliament.

2.4.1United States, Alaska: constitutional privacy without a consumer privacy law

Alaska is one of the few U.S. states whose constitution names a right to privacy. Art. I, § 22, added in 1972, says: “The right of the people to privacy is recognized and shall not be infringed. The legislature shall implement this section.” Art. I, § 14 separately protects against unreasonable searches and seizures.¹⁵² The clause mainly limits government action, and courts weigh it against the state’s interests.¹⁵³

Alaska has no comprehensive consumer privacy law. Its main statute is the Alaska Personal Information Protection Act (AS 45.48), enacted in 2008 and in force since 1 July 2009, which covers breach notification, Social Security numbers, credit freezes and the disposal of records.^154,155 HB 367, a Consumer Personal Information Privacy Act with data broker registration, cleared the House Judiciary Committee on 8 May 2026 and was sent to Finance,¹⁵⁶ but the regular session adjourned on 20 May 2026 and bills that did not pass must be reintroduced in the next Legislature.¹⁵⁷ Federal sector laws (HIPAA, GLBA, COPPA, FERPA) still apply.

Key provisions of Alaska law for the PIA

Key trends and considerations for Alaska

• Breach-centered law. Alaska law reacts to incidents rather than requiring assessments. A PIA should still document security, encryption (the safe harbor) and a breach-response plan that meets the notice, Attorney General and credit-agency rules.¹⁶⁶
• Genetic data need written consent. Projects that use DNA, ancestry or health-genomics data must obtain informed, written consent under AS 18.13.¹⁶⁷
• Government processing. State and local agencies are covered by the breach law,¹⁶⁸ and the constitutional right to privacy limits government action;¹⁶⁹ identity and surveillance projects of public bodies are high-risk processing (Chapter 6).
• A comprehensive law may return. HB 367 reached the House Finance Committee in 2026 before the session ended;^170,171 watch for a new bill in the next Legislature.

2.5Asia-Pacific

2.5.1Taiwan: the Personal Data Protection Act (PDPA)

Taiwan has a comprehensive data protection statute, the Personal Data Protection Act (PDPA). It covers public bodies as well as individuals, companies and other private organizations.¹⁷² The law began in 1995 as a statute on computer-processed data. A full revision in 2010 renamed it, and most of its provisions came into force in October 2012.¹⁷³ Later amendments followed in 2015 (special categories of data and consent rules), 2023 (higher fines and the legal basis for a dedicated authority) and 2025 (a structural reform that is not yet in force).

For most of its history Taiwan has had no single data protection authority. Ministries and local governments supervise their own sectors. The 2025 reform is meant to change that.

Key provisions of the PDPA for the PIA

Key trends and considerations for Taiwan

• Status of the 2025 reform. The Legislative Yuan passed the amendments on 17 October 2025 and they were promulgated on 11 November 2025. They take effect on a date to be set by the Executive Yuan, Taiwan’s cabinet. The official law database still showed no effective date in June 2026, so the current text keeps applying until then.¹⁷⁴
• A new authority. Article 1-1, added in 2023, names the Personal Data Protection Commission (PDPC) as the competent authority. Its Preparatory Office has worked since December 2023, but the Commission cannot be formally established until its organic law passes. The move follows a 2022 Constitutional Court ruling that called for an independent supervisory mechanism.¹⁷⁵ Once the PDPC exists, some private sectors will stay under their current ministries for up to six years, with a review every two years (Art. 51-1).
• Biometrics. The PDPA lists fingerprints as personal data (Art. 2), but biometric data are not among the special categories of Art. 6. Treat them as critical-risk data anyway, as section 7.4 recommends, and check sector rules before deploying identification systems. The Art. 51 exclusion for audio-visual data captured in public places covers only footage that is not combined with other personal data, so it should not be assumed for systems that identify or link people.
• Security and incident response. In January 2026 the PDPC Preparatory Office released draft regulations on personal data file security, on incident notification and response, and on the duties and training of data protection officers (which the PDPA requires of public bodies only), together with draft changes to the Act’s implementing rules. The security draft includes extra measures for special categories of data.
• SuperIntelligence. The AI Basic Act, passed on 23 December 2025 and in force since 14 January 2026, sets seven principles that include privacy and data governance. The National Science and Technology Council is its central authority.¹⁷⁶

2.6Middle East

The Middle East has one of the fastest-changing regulatory landscapes in the world for data protection. The region mixes traditional legal systems rooted in Islamic law (Sharia) with quick regulatory modernization, driven by digital transformation, the rise of international financial centers and national innovation strategies such as Vision 2030 (Saudi Arabia) and the UAE AI Strategy 2031.

2.6.1Trends and key considerations for the Middle East

• GDPR convergence. Saudi Arabia (PDPL), the UAE (DIFC and ADGM), Israel and Turkey have adopted frameworks that the GDPR strongly influenced, which makes international data flows easier to manage.
• Sharia and privacy. In Saudi Arabia, Kuwait and other Gulf states, Sharia (the principles of the Quran and the Sunnah) is the primary legal framework. Islamic privacy principles such as ‘Hifz al-‘Ird’ (protection of personal honor) and ‘Hurmat al-Hayah al-Khassah’ (the inviolability of private life) shape how privacy rules are read.
• Saudi Arabia: PDPL and SDAIA. The PDPL (2021) is the region’s most advanced instrument and is managed by the Saudi Data & AI Authority (SDAIA). It requires impact assessments for sensitive processing and sets a strict cross-border transfer regime.
• UAE: a dual framework. The UAE runs two systems. The special economic zones (DIFC and ADGM) have their own GDPR-aligned laws, while the federal territory follows Federal Decree-Law No. 45/2021.
• Israel: EU adequacy. The European Union has recognized Israel as providing adequate data protection since 2011, and reaffirmed that status in January 2024. Amendment 13 narrows database registration, adds a DPO requirement in certain cases and gives the PPA stronger enforcement powers, bringing Israeli law closer to the GDPR.
• Cross-border transfers. Organizations that transfer personal data to or from the region must check which safeguards apply. Israel has EU adequacy, DIFC and ADGM require contractual safeguards, and Saudi Arabia requires SDAIA authorization for transfers to certain destinations.
• Data sovereignty. Several countries in the region are introducing data localization rules, which can affect how multinational organizations structure their processing.

2.7Africa

Data protection law has spread quickly across Africa. By early 2024, 36 of the 54 African countries had enacted a national data protection law, and many others have bills in progress. Cape Verde was the first, in 2001. Two regional instruments shape the picture: the African Union’s Malabo Convention (adopted in 2014), which entered into force on 8 June 2023 after its fifteenth ratification, and the ECOWAS Supplementary Act of 2010, which binds West African states.

2.7.1Trends and key considerations for Africa

• Several layers of law. National laws sit alongside the Malabo Convention, the ECOWAS Supplementary Act and the SADC Model Law (2013). Check which regional instrument binds the country you are working in.
• Registration. Several regulators require controllers and processors to register, including those of Kenya, Ghana and Nigeria.
• Biometric and digital ID systems. National ID programs that enroll large populations make a PIA essential, as the Kenyan ruling shows.
• Cross-border transfers. Many laws restrict transfers to countries that do not offer an adequate level of protection, so transfer mechanisms should be mapped early.
• Uneven enforcement. The strength of regulators varies widely from one country to the next. A law on paper is not the same as active supervision, and the PIA should reflect how the authority actually behaves.

3.1Essential glossary

Personal data

Any information relating to an identified or identifiable natural person (the “data subject”). GDPR Art. 4(1), and equivalent definitions in national laws.

Processing

Any operation or set of operations performed on personal data: collection, recording, organization, storage, adaptation, retrieval, consultation, use, communication, interconnection, restriction, erasure or destruction.

Controller

The natural or legal person, public authority, agency or other body that, alone or jointly with others, decides the purposes and means of the processing.

Processor

The natural or legal person that processes personal data on behalf of the controller.

Data subject

The natural person whose personal data are processed.

DPO / DPD

Data Protection Officer, a mandatory role in certain contexts. The DPO oversees compliance and takes part in the PIA.

Sensitive data / special categories

Racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, health data and sexual orientation. They receive reinforced protection.

Risk

The combination of the likelihood that a threat materializes and the negative consequences for data subjects.

Threat

A factor that can cause harm to the data or to data subjects’ rights.

Inherent risk

The level of risk before any control measures are applied.

Residual risk

The level of risk that remains after the adopted control measures are applied.

Pseudonymization

Processing in such a way that the data can no longer be attributed to a specific data subject without additional information, which is kept separately.

Anonymization

An irreversible process after which the data no longer relate to an identifiable person. Test the claim: some anonymization or dissociation techniques can be reversed, so the data protection principles, above all minimization, still apply until irreversibility is shown.¹⁷⁷

Post-mortem data

Personal data of a deceased person. Many laws, including the GDPR, do not protect them directly, but some countries do, and they can still affect relatives and heirs. See section 7.7.

Risk priority

The order in which risks are treated, set by combining the risk score with factors such as sensitivity, irreversibility and scale. See section 3.4.

Metadata

Data about data, such as the time a message was sent or the GPS position where a photo was taken. On their own they may not identify anyone, but analyzed together they can reveal where a person lives, works and travels and who their family and friends are. Treat them as personal data in a PIA.¹⁷⁸

Informational self-determination

The freedom to decide about one’s own information. It explains why data protection law protects the person behind the data, not the data themselves.¹⁷⁹

Consent

A free, informed and explicit expression by the data subject approving a third party’s processing of their data. Some frameworks treat consent as a principle, others as one legal basis next to law and contract.¹⁸⁰

Right to explanation

The right to obtain an explanation of decisions made through automated processing, including AI systems and algorithms. It is not a single article of the GDPR but is drawn from the interpretation of several provisions, and its scope is debated (see Wachter et al. in Chapter 10).¹⁸¹

Right to be forgotten

The right to ask that outdated, irrelevant personal information be delisted from search engines. It is narrower than the erasure covered by “Oblivion” in ARCO-POL, and it can conflict with the public’s right to information. It arose from the Costeja case before the Court of Justice of the EU.¹⁸²

ARCO-POL rights

Access, Rectification, Cancellation and Objection (ARCO, the model used in Mexican law), plus Portability, Oblivion (erasure) and Limitation (restriction), which come from GDPR-style frameworks. Core rights of the data subject.

Privacy by Design

Ann Cavoukian’s approach: privacy must be built into systems proactively, from the design stage, not added afterwards.

3.2The three pillars of privacy risk management

In its Practical Guide to Risk Analysis, the AEPD sets out three types of threat that must be assessed in every processing of personal data.¹⁸³

3.3Principles for processing personal data

Article 5 of the GDPR, and its equivalents in other laws, set out the principles that every processing activity must respect:¹⁸⁴

• Lawfulness, fairness and transparency: data must be processed lawfully, fairly and in a transparent way for the data subject.
• Purpose limitation: collected for specified, explicit and legitimate purposes, and not processed in a way that is incompatible with them.
• Data minimization: adequate, relevant and limited to what is necessary.
• Accuracy: accurate and kept up to date; inaccurate data must be erased or corrected without delay.
• Storage limitation: kept no longer than necessary for the purposes of the processing.
• Integrity and confidentiality: protected by appropriate technical and organizational security measures.
• Accountability: the controller must be able to demonstrate compliance with all the principles above.

Regional note. Latin American proposals often add two principles to the GDPR list: respect for data subjects’ rights in every processing activity, and adequacy, meaning transfers only to countries that guarantee an adequate level of protection. Access Now and InternetBolivia.org (2019), document 10 in the credits, list eight principles: fairness and legality, purpose limitation, minimization, accuracy, limited retention, data subject rights, integrity and confidentiality, and adequacy.¹⁸⁵ This Guide treats rights in the ARCO-POL framework (3.1) and transfers in section 7.6.

4.1General rule

Every organization that processes personal data should carry out, at a minimum, a preliminary risk assessment for each processing activity. A full PIA is mandatory (in the EU and in many other jurisdictions) when the processing is likely to result in a high risk to the rights and freedoms of data subjects.

4.2Processing that requires a mandatory PIA

Article 35(3) of the GDPR and the Article 29 Working Party’s WP248 guidelines identify the situations that always require a DPIA:¹⁸⁶

• Systematic and extensive evaluation of personal aspects (profiling)

  Including the building of profiles that produce legal or similarly significant effects.

• Large-scale processing of special categories of data

  Health, biometric, genetic, ideological and criminal data, among others.

• Large-scale systematic monitoring of publicly accessible areas

  Mass public video surveillance and location tracking.

WP248 adds nine criteria. When two or more are present, a PIA is very likely to be required:

Transfers to countries without an adequate level of protection are not one of the nine WP248 criteria. They do raise the risk of a processing activity, and they appear as a separate question in the pre-screening tool (section 4.3) and in Template A.

4.3Pre-screening tool (decision matrix)

Use this matrix to decide the level of analysis needed before starting the formal PIA process:

This Guide uses two reference points for scale. Above 5,000 data subjects, a simplified PIA is recommended even if no other criterion applies. “Large scale” in the WP248 sense (criterion 5) is assessed separately and, for the purposes of Template A, starts at 50,000 data subjects or national reach.

The methodology in this chapter brings together ISO/IEC 29134:2017,¹⁸⁷ the WP248 guidelines,¹⁸⁸ the AEPD guide,¹⁸⁹ the NIST Privacy Framework¹⁹⁰ and the best practices documented by Roger Clarke and David Banisar.¹⁹¹ It runs in seven phases, numbered 0 to 6.

Phase 0Preparation and governance

0.1Identifying the PIA team

• Controller: makes the final decisions on the purposes and means of the processing.
• Data Protection Officer (DPO): advises, supervises the process and validates the results. Mandatory in many jurisdictions.
• Technical / IT team: describes the system architecture and the data flows.
• Legal / compliance team: checks the legal basis of the processing and the applicable regulatory framework.
• Relevant stakeholders: representatives of data subjects, business areas and key suppliers.

0.2Defining the scope

• Name and description of the processing or system under assessment.
• Period of analysis and PIA version.
• Jurisdictions involved and the regulatory frameworks that apply.
• Confirmation of the risk threshold: full PIA, simplified PIA or basic analysis.

Phase 1Description of the processing

1.1Minimum content of the description

1.2Record of processing activities (GDPR Art. 30)

The description of the processing should feed, and stay in step with, the Record of Processing Activities (RoPA) that every organization must keep. The AEPD offers templates for controllers and processors, which Human System adapted in Chapter 8 of this Guide.¹⁹²

Phase 2Necessity and proportionality analysis

2.1Necessity and proportionality questions

1. Is the processing strictly necessary to achieve the stated purpose?
2. Are there less intrusive ways to reach the same goal?
3. Are the data collected the minimum indispensable (data minimization principle)?
4. Are the retention periods the shortest necessary?
5. Is the purpose legitimate and important enough to justify the processing?
6. Does the processing respect data subjects’ fundamental rights?
7. Have data subjects been properly informed (transparency)?
8. Can data subjects exercise their rights effectively?
9. Is there a reasonable balance between the organization’s interest and data subjects’ rights?

Phase 3Risk identification and assessment

3.1Catalogue of typical threats

3.2Risk assessment scale

The risk level comes from combining the likelihood that the threat materializes with the potential impact on data subjects:

3.3Risk assessment matrix

Scoring anchors. Use these anchors so that different assessors give the same threat the same score.

Record the inherent risk. The score in this matrix is the inherent risk: probability × impact before any control measures are applied, as set out in the Phase 3 objective. The proposed measures are what bring it down. After they are in place, score the threat again; the new score is the residual risk (section 3.4, Step 4, and Template C).

For each threat you identify, record the following attributes:

3.4Prioritizing risks

Scoring tells you how serious a risk is. Prioritizing tells you what to deal with first, because teams rarely have the budget, people or time to treat everything at once. Prioritize after you have scored every threat in the matrix above, and record the order in the risk register (Template D).

Step 1: Start from the score. Multiply probability by impact (1 to 25) and read the starting priority from this table.

These bands and deadlines are suggestions. Adjust them to your organization’s risk appetite, and document the change.

Step 2: Adjust for priority factors. Raise a risk by one level if any of these factors applies. Use judgment: a score can hide what really matters.

Step 3: Order the risks within each level. Put legal blockers first. Then take the risks that affect the most people or cause the most irreversible harm. Then take quick wins, meaning measures that cut a lot of risk for little effort or cost. Schedule structural fixes that need a long lead time, so they do not get lost.

Step 4: Choose a response for each risk. There are four: mitigate it, avoid it, transfer or share it (for example through a contract), or accept it.¹⁹³ Treat the risks in priority order and re-score each one once its measures are in place. The new score is the residual risk.

Step 5: Decide who may accept the residual risk.

An example. A hospital adds facial recognition for staff door access. This is an illustration, not a full assessment.

Phase 4Measures to manage and reduce risks

4.1Types of measures

Technical measures

• Encryption of data in transit and at rest (AES-256, TLS 1.3).
• Pseudonymization and anonymization wherever possible.
• Role-based access control (RBAC) and the principle of least privilege.
• Multi-factor authentication (MFA) for privileged access.
• Audits and access logs for personal data.
• Encrypted backups, verified on a regular schedule.
• Vulnerability management and security patching.
• Incident detection and response (SIEM, SOC).
• Privacy-enhancing technologies (PETs): differential privacy, k-anonymity, homomorphic encryption.

Organizational measures

• A documented data protection policy approved by senior management.
• Data processing agreements (DPAs) with every processor.
• Regular staff training and awareness.
• Breach response procedures (notification to the authority within 72 hours, GDPR Art. 33).
• Periodic review of the PIA (see Phase 6 for the review triggers).
• Channels for data subjects to exercise their ARCO-POL rights.
• Due diligence on third parties and suppliers with access to the data.
• Ongoing assessment of emerging technologies (AI, IoT) from a privacy perspective.

Privacy by Design: Ann Cavoukian’s seven principles

Ann Cavoukian (2009) set out seven foundational principles that should guide the design of any system that processes personal data:¹⁹⁴

1. Proactive, not reactive; preventive, not remedial. Anticipate and prevent privacy-invasive events before they happen.
2. Privacy as the default setting. Maximum privacy protection by default, with no action needed from the user.
3. Privacy embedded into design. Built into the design and architecture of the system, not bolted on afterwards.
4. Full functionality: positive-sum, not zero-sum. Privacy should not cost functionality or security; everyone can win.
5. End-to-end security: full life-cycle protection. Data are protected securely from creation to destruction.
6. Visibility and transparency. All practices must be visible and transparent to data subjects.
7. Respect for user privacy. Keep it user-centric: design the system around the interests of the individual.

Phase 5Consultation, approval and documentation

5.1Consulting the DPO

Where the organization has a DPO, the DPO must take an active part in the PIA and issue a formal opinion on the results. Under the GDPR a DPO is mandatory for public bodies, for core activities that involve regular and systematic monitoring on a large scale, and for large-scale processing of special categories of data.

5.2Consulting stakeholders

Where appropriate and possible, ask data subjects or their representatives for their views on how the processing affects their rights and freedoms.

5.3Prior consultation with the data protection authority

If the residual risk is still high after the planned control measures, the controller must consult the competent supervisory authority before starting the processing (GDPR Art. 36). The authority has up to eight weeks to respond, which can be extended by six more weeks in complex cases.

5.4Approval and signature

• The controller and, where there is one, the DPO must sign the PIA report.
• If the controller decides to go ahead despite an unfavorable DPO opinion, it must record its reasons explicitly.
• In the public sector, approval from the entity’s highest authority may be required.

5.5Minimum documentation of the PIA

• Systematic description of the processing (Phase 1).
• Necessity and proportionality assessment (Phase 2).
• Risk assessment and inherent risk level (Phase 3).
• Measures to manage the risks and residual risk level (Phase 4).
• DPO opinion and results of consultations (Phase 5).
• Conclusion: is the processing approved, and under what conditions?
• Version and review history of the PIA.

Phase 6Continuous review and audit

A PIA must be reviewed when:

• A new technology, system or process is introduced;
• The defined review period has passed (recommended: at least once a year for high or critical risk, and no later than every two years for the rest);
• The applicable regulatory framework changes;
• There is a significant change in the purposes, means or scope of the processing; or
• A security breach or privacy incident related to the processing occurs.

The core principles of the PIA are the same everywhere, but applying them looks different depending on the type of organization. Human System prepared the following comparison to guide implementation in each context.

6.1Specific considerations for the public sector

• Strict legality principle: every state action that involves personal data must have an explicit legal basis.
• Interoperability and linked databases: each new database cross-match, and each interoperability project between public systems, needs its own PIA.
• Especially sensitive data: states handle tax, criminal, public health, migration and security data that call for maximum protection.
• Proactive transparency: public bodies must publish information about their processing systems on their own initiative, within the limits of national security and data subjects’ privacy.
• Citizen participation: in many jurisdictions, large government projects require public consultation before new processing systems go live.

6.2Specific considerations for the private sector

• Legitimate interest: private organizations must document the balancing test rigorously when they rely on legitimate interest as a legal basis.
• Chain of processors: companies must manage every subprocessor and supplier with access to personal data.
• International transfers: multinationals, and organizations that use cloud services, must put adequate mechanisms in place for every transfer outside the home jurisdiction (standard contractual clauses, Binding Corporate Rules and so on).
• Informed, granular consent: when consent is the legal basis, it must be freely given, specific, informed, unambiguous and easy to withdraw.
• Consumer rights: provide effective channels for exercising all data subject rights, with clear response times.

7.1Superintelligence and automated systems

AI systems that process personal data to make decisions about natural persons call for the highest level of scrutiny in a PIA. UNESCO (2021) established that AI systems must respect privacy by design.¹⁹⁵ The EU AI Act (Regulation 2024/1689) is already in force and applies in stages: obligations for general-purpose AI models since August 2025, transparency duties since August 2026, and the high-risk obligations, which include biometric identification systems, from December 2027 and August 2028 after a 2026 postponement. These categories overlap with the DPIA duties of the GDPR.¹⁹⁶ Taiwan’s AI Basic Act (in force since January 2026) lists privacy and data governance among its seven principles.

• Any AI system that makes automated decisions with legal or similarly significant effects requires a PIA.
• The logic of the algorithm, the training data and the steps taken to limit bias must be assessed and documented.
• The safeguards for significant automated decisions (GDPR Art. 22) must be guaranteed: meaningful information about the logic involved, human intervention and the ability to contest the decision.
• Facial recognition systems in public spaces face severe restrictions, or outright bans, in many jurisdictions.

7.2Big data and predictive analytics

As Mayer-Schönberger and Cukier (2013) point out, big data changes the nature of privacy risk, because it makes it possible to infer sensitive data (health, sexual orientation, political ideology) from data that look harmless.¹⁹⁷

• Assess the risk of re-identification when several datasets are combined.
• Predictive analysis about people needs a solid legal basis and a proportionality assessment.
• Apply differential privacy and k-anonymity techniques to statistical analysis.

7.3Internet of Things (IoT)

• IoT devices collect data continuously, and often without users being fully aware of it.
• Assess the volume, frequency and nature of the data collected.
• Secure the devices and the channels they use to transmit data.
• Give users clear information and real controls.

7.4Biometric and genetic data

• Assess whether a less intrusive alternative exists for the intended purpose.
• Use strong encryption and strictly controlled access.
• Set minimum retention periods and destroy the data securely.
• Mexico, credit institutions: the CNBV’s 2026 rules let banks build their own biometric databases (fingerprint and face), forbid sharing them and require verification against official records (section 2.3.1).
• Ukraine: biometric and genetic data are special categories under Art. 7 of the PDP Law (section 2.2.5).

7.5Minors

• Minors are especially vulnerable data subjects and need additional protection.
• In the EU (GDPR Art. 8), for online services, consent from children under 16 (or the lower national threshold, down to 13) requires authorization from a parent or guardian.
• In Mexico, the processing of minors’ data requires the consent of their parents or guardians; check the 2025 federal law for any reinforced duties.
• Any PIA that involves minors’ data must give particular weight to the best interests of the child.

7.6International data transfers

• Transfers to third countries without an adequate level of protection (judged by the originating jurisdiction) need specific safeguards.
• EU/EEA: adequacy decisions, standard contractual clauses (SCCs), binding corporate rules (BCRs) and administrative arrangements.
• Mexico: international transfers require contractual clauses or the data subject’s express consent (confirm against the 2025 federal law).
• Taiwan: the authority may restrict transfers by private organizations on four grounds (PDPA Art. 21; see section 2.5.1).
• The mechanism you choose must be documented in the PIA and reviewed periodically.
• Applicable law follows the person. Modern frameworks such as the GDPR look at where the data subject is, not only where the controller or the database is.¹⁹⁸ A PIA must therefore identify every jurisdiction whose residents are affected.
• Ukraine: transfers abroad need adequate protection in the destination state; EEA states and Convention 108 signatories are treated as adequate, and the Cabinet of Ministers keeps a list (PDP Law, Art. 29; see section 2.2.5).¹⁹⁹
• Bolivia: there is no general law and so no adequacy assessment; use contractual safeguards and document them (section 2.3.2).²⁰⁰
• Cuba: domestic communication and international transfers are allowed only in the cases listed in Law 149 (Arts. 63–66), and MINCOM requires personal databases to be hosted on servers in Cuba (see section 2.3.3).²⁰¹
• Venezuela: there is no transfer statute; under the security principle of judgment 1318/2011, data should not go to states whose laws do not guarantee comparable protection (see section 2.3.4).²⁰²

7.7Data of deceased persons (post-mortem data)

Most data protection laws protect living people. But when someone dies, their data does not disappear: it stays in databases, accounts, medical records and backups, and it can affect relatives, heirs and third parties. A PIA should ask what happens to that data when the data subject dies, even if the applicable law says nothing about it.

Why it matters

• The law does not always cover it. The GDPR does not apply to the data of deceased persons (recital 27), but it lets member states regulate them. The result is a patchwork: some countries protect these data and others do not.
• It is still other people’s data. A deceased person’s medical history, genetic data or messages can reveal information about relatives and about third parties who wrote to them.
• Accounts and digital assets. Email, social media, storage services and digital wallets set the heirs’ interest against the confidentiality of what other people shared with the person who died.
• Fraud and harm to dignity. Profiles of deceased persons that stay active can be used to impersonate them, or keep receiving advertising and messages that hurt their families.
• AI and digital recreations. Voice or image cloning, and chatbots trained on the messages of a deceased person, raise questions of consent, dignity and transparency that data protection law does not yet answer well.

Examples of post-mortem rules

Bank data and data of third parties after death

Bank records are the hardest case. They are among the most sensitive data a person leaves behind, and they are full of other people’s data: joint account holders, payers and payees, guarantors, beneficiaries and the businesses the person dealt with. Most legal systems keep banking secrecy alive after death, so the question is not whether the bank discloses, but to whom, how much and after what checks.

• Who can receive information. Usually the estate’s representative, the executor or heirs who have proved their status (death certificate, probate or heirship order, will, identification) and whom the bank has checked. In Germany, for example, heirs must first prove their status, although the Federal Court of Justice has held that a bank cannot always demand a certificate of inheritance.²⁰⁵
• Lifetime instructions come first. If the person told the bank not to disclose certain information, that instruction should be respected wherever the law allows it.
• Freeze first, disclose later. In Spain, the Banco de España explains that the bank may block the account in certain cases, after informing those concerned, and that direct debits ordered in life to preserve the estate (electricity, telephone, taxes, insurance, funeral costs) may continue unless all the heirs object.²⁰⁶
• Joint accounts. The surviving holder keeps their own rights and their own confidentiality, and the deceased holder’s share goes through the estate process. A bank statement shows far more than a list of regular payments. The UK Financial Ombudsman has noted that a bank still owes a duty of confidentiality to the surviving joint holder.²⁰⁷
• Data of living people inside the file. Statements and loan files contain data on payers, payees, guarantors and co-debtors. Release only what the estate needs, for example the balance at the date of death and the transactions required to settle it, and mask third-party details that are not needed.
• Heirs are data subjects too. Their identity documents, tax numbers and bank details are collected to settle the estate. They are living people, so the GDPR and similar laws fully apply to that data. Keep it only as long as the estate needs it.
• Fraud. Death notices and heir claims are a known route to account takeover and identity fraud. Verify identity and documents, use secure channels, and log every disclosure.
• Heirs abroad. If heirs live in another country, sending them account data is an international transfer of their data and sometimes of third parties’ data. Check the transfer mechanism (section 7.6).
• Retention. Keep the file for the periods that anti-money-laundering, tax and inheritance rules require, then delete it. Do not keep it just in case.

Mexico: who identifies the dead and who can see the data

Mexico splits the work between federal and local authorities. In Mexico City, the Fiscalía General de Justicia (FGJCDMX) created the Unidad Central Especializada para la Identificación Humana y Búsqueda de Familia by an agreement published in the city’s Official Gazette on 19 June 2025.^208,209 The unit coordinates the identification of unidentified and unclaimed deceased persons and the search for their relatives until the body is returned with dignity, and it cross-checks information with the INCIFO, the forensic institute of the city’s Superior Court, and with the INE.^210,211 At federal level, the Centro Nacional de Identificación Humana (CNIH) was created by the reform of 13 May 2022 and is part of the Comisión Nacional de Búsqueda (CNB), a body of the Ministry of the Interior, not of the prosecutor’s office.^212,213 The Fiscalía General de la República (FGR) runs the Banco Nacional de Datos Forenses (BNDF), which gathers the forensic databases of the federation and the states.^214,215 Press reports in 2025 said the CNIH had been scaled back, so confirm its current status before relying on it.²¹⁶

• Access to search and identification data. The reform published on 16 July 2025 created the Plataforma Única de Identidad (PUID), interconnected with the national registry of missing persons, the national database of investigation files, the BNDF and administrative registries. Prosecutors and search commissions may use it only for search, location and identification; access is subject to security measures and access levels, and every query is logged.^217,218
• Biometric and genetic cross-checks. The FGJCDMX unit can run fingerprint, genetic and photographic comparisons.²¹⁹ Genetic profiles of relatives of missing persons are compared against the BNDF.²²⁰ The sources consulted do not document the use of facial recognition by these bodies, so this Guide does not state it.
• Bank data. Art. 142 of the Ley de Instituciones de Crédito makes information on operations and services confidential and lets a bank give it only to the depositor, debtor, holder, beneficiary or other party to the operation, to their legal representatives or to people with power over the account, with exceptions for certain authorities.²²¹ The first paragraph does not list heirs or executors, so each institution must set its own checks on their standing (death certificate, heirship or probate order, will, identification), as described above.
• Data protection law. For public bodies, the General Law (LGPDPPSO) lets a person with a legal interest exercise the ARCO rights of a deceased person if the person clearly expressed that wish or a court orders it.²²² The sources consulted show no specific procedure for the data of deceased persons in the earlier private-sector law of 2010, and this Guide did not verify whether the 2025 LFPDPPP adds one; check it before assuming that banks or other private parties must follow a data protection procedure for heirs.²²³

Information current to October 2026. Institutions and their powers change: confirm the status of each body and have a lawyer qualified in Mexican law review the assessment.

What the PIA should cover

• Identify the case. Find out whether the processing includes data of deceased persons or will keep processing data after death (accounts, medical files, policies, loyalty programs, profiles, biometrics).
• Find the applicable rule. In each jurisdiction, decide whether the data of deceased persons fall under data protection law, inheritance law, personality rights or sector rules.
• Define who can act and how they prove it. Heirs, relatives, executor, representative or the person named in life, with documents such as a death certificate, an heirship declaration or a power of attorney.
• Respect instructions given in life. Offer ways for people to leave instructions (legacy contact, digital directives, digital will), and respect them.
• Set time limits. Decide how long data are kept after death, when they are deleted, and when accounts are closed, frozen or memorialized.
• Protect third parties. Separate or limit relatives’ data and other people’s messages that appear in the deceased’s file or account.
• Prevent misuse. Prevent impersonation, and update records and suppression lists so advertising stops reaching deceased persons.
• Control AI. Do not train on, or generate replicas of, a deceased person (voice, image, chatbots) without a legal basis and without their documented consent in life or that of whoever legitimately represents them, and tell the people who interact with the replica.
• Bank and financial data. Define who may receive account data after death, what proof is required and what is redacted, as described above.
• Biometric and genetic data. Keep them as critical risk: their irreversibility, and what they reveal about living relatives, does not end with death.
• Document it. Record the post-mortem policy in the PIA and in the RoPA.

Human System prepared the following templates by adapting and extending the methodological templates in the documents it consulted. They are meant to be used directly in real projects.

9.1Actors in the privacy ecosystem

9.2Relevant supervisory authorities

The list is a selection that covers every region. Authorities and addresses change, so check the official site before contacting one.

No authority matches that filter. Clear the box or pick another region.

Contact details: Mexico (Secretaría Anticorrupción y Buen Gobierno)

Gobierno de México | Buen Gobierno (Secretaría Anticorrupción y Buen Gobierno)

Unidad de Protección de Datos Personales²³³

Áreas de Atención y Contacto (Service and contact areas)

Ubicación e Información General (Location and general information)

Nos encontramos en: Av. de los Insurgentes Sur 1735, 01020, Guadalupe Inn, Álvaro Obregón, Ciudad de México

Teléfono: 55 2000 3000

Sitio web: www.gob.mx/buengobierno

10.1Main source documents

• AEPD, Spanish Data Protection Agency (2018). Guía práctica de análisis de riesgos en los tratamientos de datos personales sujetos al RGPD. Madrid, Spain. The structure of the risk analysis, the confidentiality–integrity–availability triad, analysis templates, the DPIA concept, the FACILITA_RGPD tool, the WP248 criteria and GDPR Article 35.
• DLA Piper International LLP (2016). Data Protection Laws of the World. London, UK. A comparative framework of data protection legislation from about 90 jurisdictions, including Angola, Argentina, Australia, Austria, Belgium, Brazil, Canada, Chile, China, Colombia, Costa Rica, Denmark, Egypt, Spain, the United States, the Philippines, France, Germany, Hong Kong, India, Indonesia, Ireland, Israel, Italy, Japan, Mexico, the Netherlands, Nigeria, Norway, Poland, Portugal, Russia, Singapore, South Africa, South Korea, Switzerland, Taiwan, Thailand, Turkey, the UAE, Ukraine, the United Kingdom, Uruguay and many more.
• Taiwan: Personal Data Protection Act and related instruments (2025–2026). The consolidated text of the PDPA, announcements of the PDPC Preparatory Office and the draft regulations of January 2026. See sections 10.2 and 10.4.
• Access Now & InternetBolivia.org (2019). Guía básica sobre datos personales para Bolivia. Access Now. Basic concepts, data subject rights, principles and the state of Bolivian law in 2019. Used in sections 2.3.2 and 2.3.5, in the glossary (3.1), the principles (3.3), and sections 7.6 and 9.1. Document 10 in the credits.

10.2Regulation and standards

• Regulation (EU) 2016/679 (GDPR): European Parliament and Council, 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. OJ L 119, 4.5.2016.
• Directive 2002/58/EC (ePrivacy): on the processing of personal data and the protection of privacy in the electronic communications sector.
• Regulation (EU) 2024/1689 (AI Act): laying down harmonised rules on artificial intelligence. In force since 1 August 2024; the high-risk obligations were postponed in 2026 by the Digital Omnibus on AI.
• Article 29 Working Party, WP248 rev.01 (2017): guidelines on data protection impact assessment (DPIA) and on determining whether processing is “likely to result in a high risk”.
• Council of Europe Convention 108+ (2018): the modernized convention for the protection of individuals with regard to automatic processing of personal data. CETS No. 223. Strasbourg.
• ISO/IEC 29134:2017: Information technology — Security techniques — Guidelines for privacy impact assessment. ISO/IEC JTC 1/SC 27. Geneva: International Organization for Standardization.
• ISO/IEC 29101:2018: Information technology — Security techniques — Privacy architecture framework. Geneva: ISO.
• ISO/IEC 27001:2022: Information security, cybersecurity and privacy protection — Information security management systems — Requirements.
• NIST Privacy Framework v1.0 (2020): A Tool for Improving Privacy through Enterprise Risk Management. NIST, Gaithersburg, MD, USA.
• NIST SP 800-53 Rev. 5 (2020): Security and Privacy Controls for Information Systems and Organizations. NIST.
• OECD (2013): The OECD Privacy Framework. Paris: OECD Publishing.
• LFPDPPP (Mexico, 2025): Federal Law on Protection of Personal Data Held by Private Parties. A new law, published in the Official Gazette (DOF) on 20 March 2025 and in force since 21 March 2025, which replaces the law of 5 July 2010. The 2011 regulations and the 2012–2013 guidelines should be checked for continued validity.
• LGPDPPSO (Mexico, 2025): General Law on the Protection of Personal Data Held by Obligated Subjects. A new law issued in March 2025; it replaces the 2017 law (DOF, 26 January 2017).
• LGPD (Brazil, 2018): Lei Geral de Proteção de Dados Pessoais. Law No. 13.709/2018. Brasília.
• Law 21.719 (Chile, 2024): regulates the protection and processing of personal data and creates the Personal Data Protection Agency. Published on 13 December 2024.
• CCPA/CPRA (California, USA): California Consumer Privacy Act (2020) and California Privacy Rights Act (2023). Cal. Civ. Code §§ 1798.100 et seq.
• PIPEDA (Canada, 2000): Personal Information Protection and Electronic Documents Act. S.C. 2000, c. 5. See also Bill C-36 (2026), the Protecting Privacy and Consumer Data Act.
• PDPA (Taiwan): Personal Data Protection Act. Enacted in 1995, fully revised in 2010, amended in 2015, 2023 and 2025 (promulgated 11 November 2025; effective date to be set by the Executive Yuan). Laws & Regulations Database of the Republic of China (Taiwan), https://law.moj.gov.tw/LawClass/LawAll.aspx?pcode=I0050021.
• AI Basic Act (Taiwan, 2026): Artificial Intelligence Basic Act. Passed on 23 December 2025 and promulgated on 14 January 2026.
• Constitutional Court of Taiwan, Judgment 111-Hsien-Pan-13 (12 August 2022): calls for an independent mechanism to supervise personal data protection.
• UNESCO (2021): Recommendation on the Ethics of Artificial Intelligence. Adopted by the 41st session of the UNESCO General Conference.
• Other European laws referred to in Chapter 2: Germany, Bundesdatenschutzgesetz (BDSG, 2017); France, Loi nº 78-17 of 6 January 1978 (Informatique et Libertés); Spain, Organic Law 3/2018 (LOPDGDD); Italy, Legislative Decree 196/2003; United Kingdom, Data Protection Act 2018 and Data (Use and Access) Act 2025; Switzerland, revised Federal Act on Data Protection (2023).
• African instruments referred to in Chapter 2: African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention, 2014); ECOWAS Supplementary Act A/SA.1/01/10 (2010); South Africa, POPIA (2013); Nigeria Data Protection Act (2023); Kenya Data Protection Act (2019); Ghana Data Protection Act (2012).
• Asia-Pacific laws referred to in Chapter 2: Vietnam, Law No. 91/2025/QH15 and Decree 356/2025; Thailand, PDPA B.E. 2562 (2019); Indonesia, Law No. 27 of 2022; Malaysia, PDPA 2010 as amended in 2024; Philippines, Republic Act 10173 (2012); New Zealand, Privacy Act 2020.
• Law of Ukraine No. 2297-VI “On Personal Data Protection” (2010): in force since 1 January 2011.²³⁴ Draft Law No. 8153 would replace it (section 2.2.5). Related: Ombudsman Order No. 1/02-14 (2014); Constitution of Ukraine (1996), Art. 32; Law No. 1368-IX (2021) on e-passports.
• Bolivia: Constitution (2009), Arts. 21, 25 and 130–131; Law 164 (2011); Law 1080 (2018). Privacy rights, the Acción de Protección de Privacidad, telecommunications and ICT, and digital citizenship (section 2.3.2).
• Cuba: Constitution (2019), Arts. 48 and 97; Law No. 149 “De Protección de Datos Personales” (2022); MINCOM Resolution 58/2022; Law 180/2025 “Del Registro Civil” (section 2.3.3).
• Venezuela: Constitution (1999), Arts. 28, 60 and 143; TSJ judgments 1318/2011, 1335/2011 and 855/2012; Organic Law of the Supreme Court (2022), Arts. 167–178; Ley de Infogobierno (2013); Special Law against Computer Crimes (2001) (section 2.3.4).
• United States, Alaska: Constitution, Art. I, §§ 14 and 22; Alaska Personal Information Protection Act, AS 45.48; genetic privacy, AS 18.13; HB 367 (2026, not enacted) (section 2.4.1).
• CNBV resolution on biometrics (Mexico): published in the DOF on 1 July 2026, amending the general provisions applicable to credit institutions (section 2.3.1).²³⁵ Disappearance law reform (Mexico, 2025): published in the DOF on 16 July 2025; created the Plataforma Única de Identidad (section 7.7).²³⁶

10.3Researchers, academics and experts

• Clarke, R. (1999–2009): Privacy impact assessment: Its origins and development. Computer Law & Security Review, 25(2), 123–135 (2009). Developer of the modern PIA concept. Australia.
• Westin, A. F. (1967): Privacy and Freedom. New York: Atheneum. The foundational work of modern privacy theory; it defines privacy as the right of individuals to control information about themselves.
• Cavoukian, A. (2009): Privacy by Design: The 7 Foundational Principles. Information and Privacy Commissioner of Ontario, Canada. Creator of the Privacy by Design framework, later adopted by the GDPR in Article 25.
• Banisar, D. (2011): Privacy impact assessments: International study of their application and effects. Privacy International / Privaatsusraportid. The most complete global comparative study of how PIAs are applied.
• Bennett, C. J. & Raab, C. D. (2017): The Governance of Privacy: Policy Instruments in Global Perspective. 2nd ed. Cambridge, MA: MIT Press. A thorough analysis of privacy governance instruments worldwide.
• Mayer-Schönberger, V. & Cukier, K. (2013): Big Data: A Revolution That Will Transform How We Live, Work, and Think. Boston: Houghton Mifflin Harcourt. An analysis of privacy risk in the age of big data.
• Cannataci, J. A. (2016–2021) and Brian Nougrères, A. (2021 onward): annual reports of the UN Special Rapporteur on the right to privacy to the Human Rights Council. Geneva: UN.
• Marx, G. T. (2016): Windows into the Soul: Surveillance and Society in an Age of High Technology. Chicago: University of Chicago Press.
• Solove, D. J. (2008): Understanding Privacy. Cambridge, MA: Harvard University Press.
• Zarsky, T. Z. (2016): The trouble with algorithmic decisions: An analytic road map to examine efficiency and fairness in automated and opaque decision making. Science, Technology, & Human Values, 41(1), 118–132.
• Wachter, S., Mittelstadt, B. & Russell, C. (2018): Counterfactual explanations without opening the black box: Automated decisions and the GDPR. Harvard Journal of Law & Technology, 31(2), 841–887.

10.4Tools and additional resources

• CNIL (France), PIA tool: open-source software for carrying out DPIAs. https://www.cnil.fr/en/open-source-pia-software-helps-carry-out-data-protection-impact-assesment
• ICO (United Kingdom), DPIA guidance: detailed guidance on carrying out DPIAs, on the ICO website (ico.org.uk).
• AEPD (Spain), Facilita RGPD: a tool for low-risk processing, on the AEPD website (aepd.es).
• ENISA (EU), Privacy and Data Protection by Design: technical guidance for building privacy by design into technological systems.
• IAPP, International Association of Privacy Professionals: training, certifications and tools for privacy professionals. https://iapp.org
• PDPC Preparatory Office (Taiwan): official announcements, the text of the law and draft regulations. https://www.pdpc.gov.tw

10.5Statistical sources

• Greenleaf, G. (2025): 172 countries with data privacy laws, year by year, 1973–2025. Privacy Laws & Business International Report, 195, 16–17.
• UNCTAD: Data Protection and Privacy Legislation Worldwide (tracker of national data protection legislation).
• Verizon (2026): 2026 Data Breach Investigations Report (DBIR). More than 31,000 security incidents and more than 22,000 confirmed breaches in 145 countries.
• IBM and Ponemon Institute (2026): Cost of a Data Breach Report 2026 (published 29 July 2026; 602 organizations, March 2025 to February 2026). The 2025 edition is cited for the AI governance figures.

10.6Mexico: the National Transparency Platform (PNT)

The National Transparency Platform (Plataforma Nacional de Transparencia, PNT) is Mexico’s single online channel for requests to public bodies. Since the 2025 reform it is run by the Secretaría Anticorrupción y Buen Gobierno, which also leads the National Access to Information System.^237,238 Use it to:

• Ask for public information held by any public body.
• Exercise your ARCO rights over personal data held by a public body: access, rectification, cancellation and opposition, plus portability. The platform assigns a folio number to track the request.²³⁹
• File a review appeal (recurso de revisión) if the answer is denied, incomplete or late.²⁴⁰

Key deadlines (business days)

Why it matters for a PIA. A PIA for a public-sector project should check that the privacy notice explains how to exercise ARCO rights through the PNT, and that the Transparency Unit can meet these deadlines (see Phase 5 and section 9.2).

Authorship, compilation and adaptation of this Guide: Human Identification Technologies, Privacy & Data Governance Division, 2026. Made in Mexico.

This Guide brings together and adapts material published by the sources listed below. The people named under each source wrote the original documents. They did not write, review or contribute to this Global PIA Guide.