Personal data analysis records (GRS-16597)

Description

These records are created in the process of managing personal data. Records document whether certain privacy and data security laws, regulations, and agency policies are required; how the agency collects, uses, shares, and maintains personal data; and how the agency has incorporated of privacy protections into records and data systems as required by privacy laws, regulations, and agency policies. Includes official records of analyses, such as privacy threshold analyses (PTAs) and initial privacy assessments (IPAs), on whether or not an agency should conduct a privacy impact assessment; privacy impact assessments (PIAs); data protection impact assessments (DPIAs), and similar records.

Retention and Disposition

Retain for 4 years after the IT system, online application, or activity is no longer processing personal data and the related personal data is destroyed, and then destroy.

Appraisal Value

Appraisal

Having a complete record of all of the privacy analyses conducted for a set of personal data would provide much better information for the agency than only having records about the most recent analysis. It will protect them during audits and enable them to better measure privacy program progress (or lack thereof).