Data Protection Impact Assessment (DPIA) (AK) - Alaska

DATA PROTECTION IMPACT ASSESSMENT — ALASKA OVERLAY

USE AND LEGAL-DUTY GATE

This is a voluntary governance worksheet. AS 45.48 supplies specific Alaska duties for security-breach notification and disposal of records; it is not a complete privacy or information-security code and does not by itself make this assessment mandatory.

Do not label data “personal information,” “sensitive data,” or “consumer data” without identifying the particular law and definition being applied. AS 45.48 uses different definitions for breach notification and record disposal.

1. PROJECT AND DECISION MAP

2. DATA INVENTORY AND FLOW

Document:

• collection method and notice shown;
• purpose and each later use;
• storage location and access roles;
• disclosures, sales, licenses, and service-provider access;
• interstate or international transfers;
• derived, inferred, scored, or model-generated information; and
• backups, logs, test data, and deletion dependencies.

3. APPLICABLE-LAW AND CONTRACT REGISTER

4. PURPOSE, NECESSITY, AND INDIVIDUAL EFFECTS

5. SECURITY AND VENDOR CONTROLS

Assess controls against the project’s actual risks and each independently applicable source. Do not cite AS 45.48 as a general “reasonable security” mandate. Its express reasonable-measures requirement in this context concerns disposal of records under AS 45.48.500.

6. ALASKA BREACH-NOTIFICATION OVERLAY

A. Coverage and roles

AS 45.48.010 applies when a covered person owns or licenses personal information on an Alaska resident and a breach of the information system occurs. Under AS 45.48.090, a covered person is a person doing business, a governmental agency other than a judicial-branch agency, or a person with more than 10 employees.

An information recipient that maintains covered information but does not own it or have the right to license it must notify the information distributor immediately after discovery and cooperate as AS 45.48.070 specifies. The information distributor then performs the resident-notice duties.

B. Breach-definition data map

For AS 45.48.010-.090, personal information generally requires an Alaska resident’s first name or first initial plus last name combined with one or more listed elements, where the information is not encrypted or redacted, or the encryption key has been accessed or acquired.

Do not import biometric, medical, general login-credential, or broad “sensitive data” categories into this breach definition unless another identified law or contract supplies them.

A breach is unauthorized acquisition, or a reasonable belief of unauthorized acquisition, that compromises the security, confidentiality, or integrity of the covered personal information. Good-faith acquisition by an employee or agent for a legitimate purpose is excluded only if the information is not used for an unrelated purpose and is not further disclosed without authorization.

C. Notification decision

Required resident notice must be made in the most expeditious time possible and without unreasonable delay, subject to the statutory investigation/system-integrity work and a qualifying law-enforcement determination. After the agency informs the information collector in writing that disclosure will no longer interfere with the investigation, disclosure must proceed in the most expeditious time possible and without unreasonable delay.

Alaska does not require blanket Attorney General notice for every breach in AS 45.48.010-.090. Written notification to the Attorney General is a condition of the no-reasonable-likelihood-of-harm exception in AS 45.48.010(c). A no-notice determination must follow an appropriate investigation, be documented in writing, and be retained for five years.

7. ALASKA RECORD-DISPOSAL OVERLAY

AS 45.48.500-.590 uses its own definitions. A business or governmental agency disposing of covered records must take all reasonable measures necessary to protect against unauthorized access or use. The statute requires written disposal policies and procedures and supplies diligence and written-contract measures for a third-party destruction vendor.

8. RISK REGISTER AND DECISION

Decision: ☐ Approve ☐ Approve with conditions ☐ Remediate and reassess ☐ Do not proceed

Conditions, owners, and deadlines:

[________________________________]

[________________________________]

9. REVIEW AND APPROVAL RECORD

Reassessment triggers: material new data, purpose, recipient, model, decision effect, security architecture, incident, law, contract, or risk level.

OFFICIAL SOURCES VERIFIED

• AS 45.48.010-.090, Security-Breach Notification — https://www.akleg.gov/basis/statutes.asp?title=45&media=print&secStart=45.48.010&secEnd=45.48.090
• AS 45.48.500-.590, Disposal of Records — https://www.akleg.gov/basis/statutes.asp?title=45&media=print&secStart=45.48.500&secEnd=45.48.590

Retain the completed assessment, source versions, data-flow evidence, approvals, and remediation records according to the organization’s verified legal and records schedules.