Privacy Impact Assessments 3.20 In early 2008, the Cabinet Secretary commissioned a review of data-handling procedures within the public sector. The subsequent report6 introduced a mandatory requirement for Privacy Impact Assessments (PIAs) to be carried out by all government departments when developing new policies or initiatives, or amending existing work streams that involve the handling of personal data.