Privacy Impact Assessments

A Privacy Impact Assessment (PIA), also called a Data Protection Impact Assessment (DPIA) under GDPR, is a structured process for evaluating the privacy risks of a new data processing activity before you begin. For visitor intelligence deployments in regulated industries or EU-serving businesses, this may be required.

When a PIA is Required

Under GDPR Article 35, a DPIA is required when processing is "likely to result in a high risk to the rights and freedoms of natural persons." For most B2B visitor intelligence implementations (company-level identification, not individual tracking), a full DPIA may not be strictly required. However, conducting one proactively is best practice — it documents your privacy thinking and provides legal protection if your practices are ever challenged.

The PIA Structure

A compliant PIA covers: (1) Description of the processing operation and its purpose, (2) Assessment of necessity and proportionality, (3) Assessment of risks to individuals' rights, (4) Measures to address identified risks, (5) Conclusion: is processing appropriate to proceed with the identified safeguards?

Conducting a Kopimore PIA

For a visitor intelligence deployment, the key risk factors to evaluate: Who is identified (companies vs individuals)? What data is retained and for how long? Who has access to the data? How is it used (internal sales only vs shared)? Are there high-risk categories of data involved (health, financial, special categories)? What is the geographic scope (EU visitors, California residents)?

Documenting and Storing the PIA

Complete PIAs should be stored with your compliance documentation and reviewed annually or whenever the data processing activity changes materially. They don't need to be submitted to regulators proactively — but you may need to produce them on request in the event of an investigation or complaint.