Human-centred privacy impact assessment

Informed consent and data privacy protections for your users

Knowing how data loss impacts your customers means you can make meaningful privacy policies and communicate better with your stakeholders.

Outcome

  • know and manage the risks of data breaches or inappropriate data exposure

  • find out about your customers and what they value in terms of their privacy

  • improve knowledge and appreciation of data privacy and security in your organisation.

Service description

The world of data security is a fast-moving one. You must understand who needs what kinds of data privacy protection and why. Data drives many new products and services to create value for customers with:

  • analytics

  • personalisation

  • a seamless user experience.

But customers are growing more concerned about their data privacy and the risks of data breaches.

It’s often the case that customers don't fully understand how their data are being used in the ‘back end’ of a system.

Terms and conditions are almost always confusing. They don't tell people clearly how to give truly informed consent to an organisation's use of their data.

When you understand the impact of privacy loss for customers, you can design systems, policies and information to protect data better. Let us help with that.

Our approach

To assess the impact of privacy loss to your stakeholders, we do a privacy impact assessment using:

  • human-centred design research

  • our deep knowledge of data-driven systems and how they work

  • a cutting-edge understanding of Australia's privacy and security landscape.

We get to know the types of people who use your system/product then engage them. We directly engage your customers and explore how they’re affected by data breaches or inappropriate use of data.

You get a holistic privacy impact assessment with practical actions. Our service to you:

  • Identify any critical risks to your business around privacy loss through data breaches and inappropriate use of data.

  • Show you what users of a system value most about their data privacy and what they need to know to trust your organisation.

  • Recommend ways to solve privacy tensions and communicate well with users to get genuine, informed consent.

  • Work with your policy and legal or compliance teams to put approved recommendations in place.

Engagement

Human-centred privacy impact assessments usually take between 3 and 8 weeks. Our approach changes with your organisation, products and services.

Before we design the research and communicate the results, we’ll get to know you and your environment. We get to know the needs of your stakeholders and those in the wider sector.

This is what a typical partnership might look like when you ask us for a human-centred privacy impact assessment.

Initial briefing (one hour):

  • Meet with the core project team/product owner to set up our objectives and refine the project plan.

One week to work collaboratively:

  • Try the product or service out in its test state.

  • Interview the key product/service team and IT security teams to understand the product/service and its users.

  • Identify the key types of users and data, and how they impact all aspects of the product/service or wider organisation through creating a data value chain; and agreeing on any data privacy and security principles or policies that the organisation should or must have.

Two weeks of design and interview:

  • Prepare interview guides and recruit participants.

  • Interview the participants.

Two weeks to wrap up:

  • Look at all the information, work out what it means, and write a report for you.

  • Share what we learnt and give some ideas on what to do next.

  • Workshop with the decision-makers to finish and prioritise the recommendations.

  • Make a plan that includes all the best ideas, in priority order and based on the information from the interviews.

Cost

Our human-centred privacy impact assessments can cost between $5,000 - $50,000 (ex GST), depending on:

  • how big and complex your product or service is

  • the number of research participants and your current level of data governance.

Let’s chat about the best approach that fits in your budget and gives you and your team the most value.