Privacy Impact Assessment and DPIA Policy

1) Introduction and scope

Sets how Tanqory conducts Privacy Impact Assessments (PIA) and Data Protection Impact Assessments (DPIA) for projects/systems/processing involving personal data across all affiliates.
Covers new projects, system changes affecting personal data, new tech (AI/biometric/profiling/ADM), sensitive/large-scale processing, and cross-border transfers.
Use with the Privacy Policy, AI Data Usage Policy, Data Classification, Data Retention, DPA, and Security Standards; if conflicts arise, follow the stricter/more specific or the most stringent law.
English is the binding version; if translations are provided for convenience, English prevails on conflict.
“PIA” refers to general assessments; “DPIA” is per GDPR/UK GDPR Art.35 for high-risk processing.
Assessment outcomes must be stored in the central PIA register and retained per the Data Retention Policy.
Continuing a project after notice of assessment results implies acceptance of required measures.
Safety/legal emergencies may require immediate measures; notice via email/dashboard (durable medium) as soon as possible.
Contacts: dpo@tanqory.com, privacy@tanqory.com, security@tanqory.com, info@tanq.com.sg.

2) Principles and legal criteria

Apply Privacy by Design/Default, minimization, purpose limitation, lawfulness/fairness/transparency, accuracy, storage limitation, integrity/confidentiality, and accountability (GDPR Art.5).
Perform a DPIA when “likely high risk” per GDPR/UK GDPR Art.35 and EDPB guidance (e.g., systematic profiling, large-scale sensitive data, public-space surveillance, ADM with legal effects, data combination, vulnerable groups, new tech).
Follow PDPA SG PIA guidance, NIST Privacy Framework, ISO/IEC 29134 for process/reporting.
Use DTIA/TRA when transferring to non-adequate countries (EDPB/ICO approach) and SCC/IDTA/BCR per DPA appendices.
AI/high-risk ADM requires FRIA/DPIA aligned with AI Policy/AI Act-style transparency/incident rules where applicable.
Ensure proper notice/consent/legal basis before processing; reflect outcomes in contracts/Privacy Notices/UI.
Projects skipping PIA/DPIA may be paused until concluded and mitigations agreed.
Mitigations must be proportionate to impact and reference Security Standards technical/organizational controls.
DPO can provide opinions/require changes; if not followed, reasons must be logged in the report.

3) Triggers and screening

Complete a screening questionnaire for every project/change involving personal data (new collection/use/sharing) to decide if PIA/DPIA is required.
Mandatory DPIA triggers: profiling/ADM with legal or significant effects; large-scale sensitive data (health/biometric/belief); public surveillance; new tech (AI/biometric); combining datasets; vulnerable groups (children/employees); blocking data subject rights.
Recommended PIA triggers: new PII systems/features; new vendors; purpose/source changes; new cross-border transfers; customer-data marketing campaigns.
Record all screening results, even “no PIA/DPIA needed,” for audit trail.
Use standard screening form in GRC/PIA register; must be confirmed by Project Owner/Product Manager.
When in doubt, default to “do PIA.”
Screen before build/contract to avoid rework/legal risk.
AI/high-risk ADM projects must be reviewed by DPO/AI governance.
DTIA/TRA screening required when transferring to non-adequate countries; attach summary to the report.

4) PIA/DPIA process

Phase 1 Initiate: define scope, purpose, stakeholders, legal bases, data sources/types (including sensitive/child), and transfers.
Phase 2 Describe: data/system architecture/data flows, Sub-processors, SLA/retention, protections (encryption/access/DLP), link to Data Inventory/ROPA.
Phase 3 Assess Risk: assess impact/likelihood to rights/freedoms using EDPB/NIST/ISO 29134-aligned criteria; consider lawful basis/notice/consent/rights/ADM/AI/DTIA.
Phase 4 Mitigate: propose controls (technical/organizational/contractual) such as minimization, pseudonymization, access controls, reduced retention, transparency, opt-out/opt-in, human review for ADM.
Phase 5 Consult: if high residual risk remains, consult DPO; in the EU, if risk cannot be sufficiently reduced, consult Supervisory Authority per GDPR Art.36.
Phase 6 Approve: Project Owner + DPO/Privacy review set conditions; if not followed, log reasons and obtain appropriate executive acceptance.
Phase 7 Implement & Sign-off: implement required measures, update contracts/Notices/UI, test controls pre–go-live, record results in the PIA register.
Phase 8 Monitor & Review: review on scope/tech/legal basis changes or at least annually for high-risk; incorporate incidents/complaints into improvements.
Core artefacts: Screening, PIA/DPIA report, risk register, DTIA (if any), decision log, action plan/owner/due date.

5) Risk criteria and mitigations

Assess: data type/volume, sensitivity, retention, sharing/transfer scope, identifiability, vulnerable groups, ADM/legal effects, rights risks (discrimination/financial/reputation/freedom).
Use severity/likelihood scales aligned with enterprise risk framework; state residual risk after controls.
Common mitigations: minimization/pseudonymization/encryption; access/MFA/role-based controls; logging/monitoring/DLP; retention reduction; transparency notices; opt-in/opt-out; human review for ADM; DPIA for AI/biometric; tenant isolation.
Cross-border: SCC/IDTA/BCR plus technical measures (encryption in transit/at rest, exporter key control), policy measures, contractual limits, local law assessment (DTIA).
AI/ADM: fairness/bias testing, explainability, appeal/human override, dataset quality checks (AI Act Art.10-like), watermarking/provenance for generative outputs.
Sensitive/child data: restricted access, consent/allowed exceptions, clear notices, minimal retention.
Apply Secure SDLC/Threat Modeling early to reduce risk at design.
Check alignment with Data Classification/Retention to avoid over-retention or under-protection.
Link controls to owners/due dates and track in the action plan.

6) Roles and responsibilities

Project Owner/PM: initiate Screening/PIA, supply complete info, implement controls, and record in PIA register.
DPO/Privacy: advise, require DPIA/DTIA when needed, review reports, give opinions/conditions, and keep evidence.
Security/IT/Engineering: design architecture/technical controls (encryption, access, logging, DLP, DR), threat modeling, secure SDLC evidence.
Legal/Compliance: check legal bases/contracts/transfer appendices/court orders, update Notices/Terms, manage SCC/IDTA/BCR.
Business/Marketing/AI: provide use case/data/model/vendor details and follow transparency/opt-out/human review requirements.
Procurement/Vendor Mgmt: verify provider DPA/SCC/measures, Sub-processor checks, deletion/return clauses.
Data Owner: confirm data accuracy/source/classification/retention and approve sharing.
Relevant executives: accept residual risk if still high after mitigations and provide resources.
All must complete PIA/DPIA training per Section 9 and meet set SLAs.

7) Recording, retention, and cross-border

All Screening/PIA/DPIA/DTIA must be stored in the PIA register with metadata (project, owner, dates, risk, measures, status, review date).
Retention: keep reports/evidence per the Data Retention Policy (at least project life + 7 years or longer if law/disputes require).
Documents with sensitive data must be classified per Data Classification and stored encrypted with access control.
Sharing reports with third parties (auditors/authorities) requires NDA/confidentiality and need-to-know.
Transfers noted in PIA must align with DPA Appendix C (SCC/IDTA/BCR) and DTIA; update if context changes.
Restores must not revive erased data unless legally required; promptly delete after the event.
Vendors for document/scan/storage must pass security/legal review and contract terms.
Log access/download of DPIA reports for audit and leak reduction.
English is the primary language; translations are for reference.
When deleting on expiry, use secure deletion and retain proof.

8) Communication, training, and review

Teams (project/engineering/product/marketing/AI) must complete PIA/DPIA training at least annually and before starting high-risk projects.
Communicate policy/changes via email/dashboard (durable medium) and keep announcement evidence.
Provide guides/templates/FAQ/cheat sheets for Screening, DPIA, DTIA, action plans, ADM/AI transparency.
Run tabletop exercises for high-risk/AI projects to test PIA/DPIA steps and residual-risk decisions.
Incorporate incident/complaint/audit lessons into templates/processes.
Evaluate training (quiz/feedback) and update based on risk/new laws.
Adjust policy/templates for new laws (e.g., AI Act secondary rules) and announce.
Questions: privacy@tanqory.com, dpo@tanqory.com, security@tanqory.com.
Managers must ensure timely, quality PIA/DPIA completion.
Keep training records for compliance (ISO/IEC 27701, SOC 2, GDPR accountability).

9) Changes and enforcement

Changes adding burden/reducing rights: announce ≥30 days via email/dashboard (durable medium) unless immediate safety/legal need.
Projects lacking DPIA approval or mitigation may be paused/delayed/blocked from go-live until compliant.
Noncompliance with PIA/DPIA steps may lead to disciplinary/contractual action per internal policy/law.
Update appendices/templates when requirements change and notify.
If documents conflict, use the latest relevant (Order Form/SOW/DPA/Terms).
Review processes at least annually and report to management/privacy governance.
Record approvals/exceptions/residual-risk acceptance in the PIA register.
If regulator consultation (Art.36) is needed, follow guidance before go-live.
High-risk AI/ADM must have monitoring/post-market and serious-incident reporting plans per applicable law.

Appendix A: Process and SLA summary

• Screening for all personal-data projects before build/contract.
• Target timelines: Screening ≤5 Business Days; standard PIA ≤15 Business Days; complex DPIA/DTIA 30–45 Business Days (or notify if longer).
• Rights/SLA: intake ≤2 Business Days, updates every 10 days, target closure 30 days (see rights policies).
• Required artefacts: Screening form, PIA/DPIA report, risk/action plan, DPO opinion, approval log, DTIA (if applicable).
• DPO objections/notes must be recorded and resolved or risk accepted by authorized management.
• Store records in the PIA register (encrypted/access-controlled) per retention policy.
• Announce changes/emergencies via email/dashboard (durable medium) for access/record.
• High-risk/ADM projects require monitoring/post-market plan and at least annual review.
• Attach DTIA/TRA for transfers to non-adequate countries.
• Key stakeholders: Project Owner, DPO/Privacy, Security/IT, Legal, Procurement, Business/AI owner, Vendor (if any).

Change history