A privacy impact assessment is an exercise whereby a department proposing a change to policies or procedures tries to determine the privacy implications of these changes to programs. This is a process whereby these questions are to be considered. Normally the department in question consults with my office to ensure that these considerations are complete.
It is ultimately for the department in question proposing to change a program or procedure to determine how to mitigate any privacy issues raised by the change in program or procedure.