Services / Packages
Privacy Impact Assessment
A focused assessment of the privacy risks in one system or project, including AI systems, with specific safeguards.
From $3,000 per system2–3 weeks
Public agencies receive quotes structured to fit their procurement rules.
You own everything we produce.
Who this is for
Organizations usually call us about this when:
You’re launching a system that uses personal data in a new way.
A state privacy law requires a data protection assessment for your processing.
An AI tool will process customer, patient, or client information.
Overview
A privacy impact assessment examines how a system collects, uses, shares, and protects personal data, and what could harm the people it affects. Several state privacy laws require data protection assessments for higher-risk processing, and the GDPR requires them in many cases. We complete the assessment and recommend specific safeguards.
What’s included
- Description of the system and its data flows
- Legal basis and applicable privacy laws
- Risks to the individuals affected
- Recommended safeguards and controls
- Assessment report ready for records or regulators
- Review date and triggers for reassessment
Available under attorney-client privilege. We can perform this work at the direction of your counsel, so findings may be protected by privilege. Ask us about privileged engagements.
How it works
Map
We document the system, the personal data involved, and how it flows.
Assess
We identify legal requirements and risks to individuals.
Recommend
You receive the assessment report with specific safeguards.
How it works for your organization
The same service, tailored to the obligations and realities of each sector.
Private Sector
Companies use privacy impact assessments to launch products and AI features that meet state privacy laws.
- Assessments required by state privacy laws
- AI features that use personal data
- Targeted advertising and profiling
- Records ready for regulator requests
Public Sector
Agencies use privacy impact assessments before launching systems that collect resident data.
- New public-facing systems
- AI tools using case or program data
- Data sharing between agencies
- Public transparency documentation
Nonprofits
Nonprofits use privacy impact assessments before adopting tools that handle client information.
- New client management systems
- AI tools with client data
- Data sharing with partners
- Funder privacy requirements
Frequently asked questions
How much does Privacy Impact Assessment cost?
Privacy Impact Assessment starts at $3,000 per system. The final price depends on scope, and we confirm it in writing before any work begins.
How long does it take?
Most engagements take 2–3 weeks, depending on scope and how quickly information is available.
What do we receive?
The engagement includes: description of the system and its data flows; legal basis and applicable privacy laws; risks to the individuals affected; recommended safeguards and controls.
Can this be done under attorney-client privilege?
Yes. When your counsel engages us and directs the work for the purpose of giving legal advice, our findings may be protected by privilege. Ask your counsel to contact us and we’ll structure the engagement with them.
What if a deliverable doesn’t meet the agreed scope?
We revise it until it does, at no extra cost. And if we miss an agreed delivery date, we take 10% off that deliverable.
Who owns the deliverables?
You do. Everything we produce for you is yours to keep, use, and share.
Related Guides
- Privacy Program Guide for Credit UnionsThe privacy laws, notices, data map, and member rights a credit union privacy program needs to cover, including AI tools.
- Data Protection Assessment Template for Credit UnionsA filled-in example assessment of an AI member service chatbot, covering data flows, risks, and safeguards, ready to adapt for your own systems.
- AI Regulation Map for Credit UnionsThe federal and state laws that apply when credit unions use AI in lending, fraud detection, member service, and marketing, and what each requires.
- AI Laws by StateWhere each state’s AI and privacy rules stand, with key dates and a page for every state.
Related services
Privacy Program Build
A complete privacy program: data map, policies, notices, rights requests, and vendor oversight.
Data Mapping and Privacy Notice Update
A complete inventory of the personal data you hold, plus an updated privacy notice that matches it.
AI Risk Review
An independent review of one AI tool, vendor, or use case before you adopt it or expand it.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.