Privacy impact assessment · Service design · Accountable implementation
A PIA should change a decision—not simply describe a system after the choices are fixed.
Arcus helps leaders examine how personal information moves through a program, service or technology, evaluate practical alternatives and assign responsibility for risk treatment. We connect privacy analysis with procurement, operations and implementation decisions.
The decision before the program
01 / What purpose requires each category of information?
02 / Which design or operating choice reduces the risk?
03 / What evidence must exist before collection or launch is authorized?
What decision should a privacy impact assessment inform?
A project team may ask for a PIA after selecting a platform and agreeing its default data collection. At that point, the easiest response is often to document the chosen approach and add safeguards. Yet the more consequential question may be whether the service needs that information at all, whether a less intrusive design would work, or whether a vendor’s actual configuration matches the intended process.
Arcus’s central thesis is that a useful PIA connects purpose and authority, verified information flows, realistic design alternatives and evidence that controls operate. This is an original management synthesis, not a validated assessment instrument. Privacy analysis and security testing complement each other: encryption and access controls do not establish that every collection or secondary use is justified.
The approach must fit the institution, activity and applicable law or policy. It does not replace legal advice, a technical security assessment or the organization’s authorized decisions. A consultant can help develop evidence and recommendations; the responsible institution remains accountable for its decisions and operations.
Start with the applicable regime, not a universal template
Federal departments, provincial or municipal institutions, health organizations and private organizations can face different requirements. Establish the applicable obligations, internal policy, decision authority, assessment trigger and required documentation with the organization’s privacy lead and legal advisers. Do not assume that PIPEDA governs every Canadian organization or that one PIA template settles all requirements.
For federal institutions within its scope, the Treasury Board Directive on Privacy Practices and Appendix C: Standard on Privacy Impact Assessment took effect on October 9, 2024, replacing the earlier separate PIA directive. The federal Digital Privacy Playbook describes assessment, approval and submission steps before launch and ongoing review when an initiative changes. These are federal instruments, not a universal private-sector process.
Ontario’s IPC August 2026 PIA guide distinguishes requirements under FIPPA in force from July 1, 2025 from MFIPPA requirements effective January 1, 2027. As of this October 2026 review, that municipal effective date is still ahead. The guide also identifies exceptions and institution-specific requirements. Confirm the precise application and timing with qualified advisers; do not treat a future requirement as already in force or infer that the guide covers every health or private organization.
What a documented investigation teaches about design choices
The June 2022 joint investigation into the Tim Hortons app found that the app collected granular location information, including while it was not open. The regulators’ June 2023 follow-up explains that collection exceeded what was needed for the stated targeted-advertising purpose, and that the information was not used for that purpose. It also states that the company had implemented its commitments and the recommendations. This is a historical regulatory case, not an allegation of continuing noncompliance.
Arcus’s management inference is that assessment must reconcile the proposed business purpose with actual configuration, collection and downstream access. A supplier description or a permission screen is not, by itself, evidence of how a service operates. The case does not prove that completing a PIA would necessarily have prevented the conduct.
That limitation matters. Iwaya and colleagues’ 2024 scoping review, Privacy Impact Assessments in the Wild examined 45 studies and identified substantial gaps in empirical evidence on PIAs in practice, including methodological weaknesses. The review supports caution about claims of proven effectiveness. A completed report should therefore be followed by implementation evidence and review, rather than presented as a guarantee against breaches or complaints.
Four reasons a PIA may fail to influence the project
Test these explanations before assuming that a longer report is the solution.
01 / The purpose or authority is unresolved
Teams may disagree about the decision the information will support or assume that a useful feature justifies collection. Ask the program owner and qualified advisers to establish purpose, necessity and authority for each material flow before evaluating safeguards.
02 / The operating facts are incomplete
The diagram may omit a vendor, integration, support role, backup, export or secondary use. Compare descriptions with relevant configuration, documentation and appropriately authorized technical evidence. Treat an unverified assertion as an evidence gap, not an implemented control.
03 / The alternatives are no longer considered
Procurement, funding or delivery commitments may have narrowed the design before privacy review begins. Identify which decisions can still change, the cost of doing so, and whether reducing scope or delaying a feature is warranted. Do not invent a legal basis to preserve sunk investment.
04 / Recommendations have no implementation owner
Controls may exist only as planned actions, with no funded delivery, verification or ongoing responsibility. Distinguish the recommendation, approval, implemented configuration and evidence of operation. A risk accepted by management is not thereby made lawful.
The Arcus privacy decision trace
Apply this original framework to one important collection, use or disclosure. It is a management diagnostic, not a legal determination or validated risk score.
01 / Purpose and authority
Identify the service decision or activity, the information needed and the applicable authority or basis, as determined with qualified advisers. Test whether a less intrusive route can meet the objective. Record unresolved questions explicitly.
02 / Flow and exposure
Trace collection, access, sharing, storage, retention and disposal, including service providers and integrations. Identify who can act on the information and how it might affect individuals. Separate intended design from verified operating facts.
03 / Alternative and treatment
Compare removing a field or feature, narrowing precision or frequency, changing access, separating purposes, redesigning a workflow or changing supplier terms. Examine feasibility, operating costs and remaining risk to individuals rather than choosing controls solely for convenience.
04 / Evidence and accountable decision
For each material treatment, specify the owner, due date, verification evidence and authority for the next decision. Separate proposed controls from implemented ones. Set conditions for collection, launch and later changes under the applicable requirements.
Worked illustration: three ways to provide service-location information
Consider a fictional service that wants to show a user the nearest office. Option A asks the user to select a town or enter a general location. Option B requests precise device location only when the user asks for nearby offices. Option C collects continuous background location for possible future analysis. These are illustrative designs, not a client case.
Option A may reduce collection but require more user effort and provide less precise results. Option B may improve convenience while requiring a justified purpose, appropriate user information, configuration and limits. Option C adds a different scale and duration of collection; the service-location objective alone does not establish why continuous monitoring is needed. Legal and technical assessment must evaluate the actual design and circumstances.
Leadership should compare service quality, accessibility, information exposure, retention, supplier access and operating cost. A simple design may be preferable if it meets the service need. If a feature depends on an unresolved purpose, authority or control, the choice may be to redesign, defer that feature or stop it. Do not use a risk score to average away an unmet legal requirement.
Choose the scope that matches the decision
A privacy assessment can require several connected workstreams. Agree their boundaries and dependencies.
Screen and scope the initiative
Useful for identifying the relevant activity, regime, information and assessment requirements with the privacy lead. Produces a documented scope and workplan. Screening is not a substitute for a PIA where one is required.
Assess a new or changed program
Useful when collection, service delivery, data sharing or purpose is being designed or materially changed. Requires program, privacy, legal, procurement and technical input as appropriate. Findings must remain linked to the design that is actually implemented.
Review a supplier or technology decision
Useful when a platform, hosted service or integration affects information handling. Examine functions, data flows, access, terms and evidence. A vendor questionnaire or security certification may inform the assessment but does not answer every privacy question.
Update an assessment and verify treatment
Useful when the project or operating environment changes, or recommendations remain unresolved. Reconcile the current configuration and responsibilities with the approved assessment. Define further assessment or testing rather than assuming an old report covers new uses.
How should implementation and ongoing review work?
Begin early enough for findings to influence service design and procurement. Agree the program owner, privacy lead, approving authorities and specialist roles. Establish an appropriately controlled evidence channel; initial scoping usually does not require disclosure of identifiable production records to a consultant.
Map the information lifecycle and confirm important assumptions with the people who operate and configure the service. Identify missing evidence, alternative explanations and effects on individuals. A complaint may reflect excessive collection, inadequate explanation, inappropriate access or a failed technical control; each needs its own evidence and response.
Compare alternatives before selecting treatment. Include contract changes, technical configuration, staff training, retention and disposal processes, auditability and recurring monitoring. Budget for evidence collection, specialist analysis, implementation and review. Fixing a design after commitment may require integration changes or delays; quantify these with project-specific estimates rather than generic savings claims.
Turn recommendations into a treatment register with owners, dependencies, dates and evidence requirements. The authorized decision-maker should understand unresolved issues and any prerequisites for proceeding. Where applicable requirements are not met, management acceptance of a risk is not a substitute for compliance.
Before the relevant collection or launch decision, verify required approvals and completion of necessary treatments. After implementation, define triggers for reassessment: new purposes, information categories, sharing, suppliers, functionality or operating changes. Monitor control completion and operation, complaints and relevant incidents. Track whether safeguards work, not merely whether a report was signed.
What Arcus can deliver
Scope and specialist requirements are agreed with the client before work begins.
01 / Assessment scope and evidence plan
A decision brief, applicable-requirements workplan developed with the client’s privacy and legal leads, stakeholder map and evidence inventory. The output distinguishes facts, assumptions and questions requiring specialist determination.
02 / Information-flow and risk analysis
Lifecycle maps, stakeholder interviews, document review and a structured account of privacy impacts and alternatives. Technical testing or legal opinions require the appropriate qualified specialists and agreed scope.
03 / PIA report and treatment register
A report tailored to the relevant institutional process, with practical recommendations, residual issues, owners and verification requirements. Arcus can support the approval package; it does not grant regulatory approval or certify universal compliance.
04 / Implementation and update support
A sequenced action plan, responsibilities, review triggers and management reporting. Arcus can help coordinate follow-through and assess changes so the report remains connected to the operating service.
Discuss the program or technology decision under review
Describe the organization, initiative, planned decision date and the general categories of information involved. Arcus can help define a proportionate assessment and identify required legal, privacy or technical expertise. Begin with a general description rather than personal records, credentials or detailed production data.
Related support includes regulatory research and filing support and organizational review. Relevant experience is presented through the central consultant directory.
Retained historical consulting context
The retained examples and testimonial concern broader Arcus consulting work. The quoted role is historical; these are not privacy-assessment certifications, measured privacy outcomes or regulator endorsements.
Below is a sample of the range of services that Arcus has provided to clients.
- A survey of 2,350 consumers and 1,320 business leaders for feedback on sustainability trends
- Architecting a multi-year change strategy for a Fortune 500 company
- Mentoring a CEO on organizational change
- Excellence transformation of a leading B2B services company
- Creating a new sales deployment model for a healthcare company
- Developing a position evaluation and compensation model for a professional medical association
- Improving services to customer segments by deepening their understanding of customer attitudes
“Arcus manages to consistently deliver tangible results on market research and strategy projects. They combine deep business expertise, powerful research capabilities, and innovative thinking to deliver substantial value.”
– Vice President, Nikon