During which of the following system lifecycle stages is it BEST to conduct a privacy impact assessment (PIA) on a system that holds personal data?

A privacy impact assessment should be started as soon as the system’s privacy-relevant requirements and architecture are being defined. ISO/IEC 29134 and NIST SP 800-37 both state that PIAs are most valuable early in the system development life-cycle so that identified risks can drive design changes before costly re-work. Of the choices given, the Development phase is the earliest point at which the system exists in a form that can be assessed, making it the BEST stage for conducting the PIA.

A. Functional testing happens after coding; many design decisions are fixed, limiting the ability to address privacy weaknesses.
C. Production occurs after deployment; a PIA here is late and mainly corrective.
D. UAT is late-stage testing focused on business functionality, leaving little room for design-level privacy remediation.

1. ISO/IEC 29134:2017, 7.2 “Planning and preparation” – PIA initiated “at an early stage of the project.”

2. NIST SP 800-37 Rev.2, §3.1 “Prepare – System Development Life Cycle integration” – privacy risk assessment integrated “early.”

3. IBM Center for The Business of Government, “Privacy Impact Assessments,” p.11 – value when “conducted during development.”