Welcome to the Research Assistant Weekly Newsletter - a subscriber-only resource for insight into emerging compliance challenges, details on peer calls, and links to new Research Assistant reports, documents, tools, and more.
In this week’s Research Assistant Peer group call, we discussed Privacy Impact Assessments (PIAs) and how they differ from PCI assessments.
As compliance professionals in the debt collection space, many of you are familiar with PCI compliance if your business accepts card payments. The Payment Card Industry Data Security Standard (PCI DSS) is an evaluation of security practices conducted by a Qualified Security Assessor (QSA). Businesses must identify vulnerabilities in how they handle cardholder data and ensure compliance with PCI standards.
Businesses need to identify vulnerabilities of their breaching cardholder data and verify compliance with PCI standards. PCI has 12 security standards that must be met when accepting credit card payments and processing, transmitting, and storing data. While PCI compliance is not legally required, it is a widely recognized industry standard—and often mandatory when working with certain clients. When selecting a PCI assessment, be sure to choose the correct one for your specific needs. Otherwise, you may find yourself repeating the process, especially as newer PCI assessments have become more comprehensive.
But what is a Privacy Impact Assessment (PIA) and how does it differ from a PCI Assessment?
A Privacy Impact Assessment (PIA) is a tool organizations use to identify and mitigate privacy risks. Any technology projects, proposed programs and policies or initiatives that involve possible risk to Personal Identifiable Information (PII) of individual consumers, should have a PIA to analyze and determine the impact on the privacy of individuals.
PIAs are part of the Privacy Compliance Process of the Department of Homeland Security (DHS). Required by the E-Government Act of 2002, The Homeland Security Act of 2002, or DHS Privacy policy, the DHS Chief Privacy Officer uses it as a decision tool. If a high risk is identified in a PIA, a Data Protection Impact Assessment (DPIA) These assessments must be completed. DPIA’s are mandatory for some states with new privacy laws, including CPRA, Colorado, Virginia, and Connecticut.
In a nutshell, PIA is a preliminary screening used to identify risks. PCI is to comply with protections when taking credit card payments.
Any formal assessment to determine the risk of private information of a consumer will be lengthy and time consuming. Be sure you know what risk assessment tools are required in your state, by your clients and for the best overall health of your company.
Documents and Crowdsourced Materials:
Top Reads:
Upcoming Webinars/ Other Announcements:
- RA Compliance Corner: Why Your Compliance Tribe is Crucial, Thursday, March 6th at 2:00 ET. Register here.
- Important Announcement: All AI Notetaking Bots will be removed from Research Assistant Peer Group Meetings. This is to maintain the confidentiality of our peer members.
- Have topics you want to discuss during the peer call? Please send them to Sara_Consultant@roundtables.us by Thursday to ensure it makes it on our agenda!
|
