Data Protection Impact Assessment (DPIA) (AZ) - Arizona

DATA PROTECTION IMPACT ASSESSMENT (DPIA)

(State overlay: AZ)

1. Project Overview

• Project name/ID: [name]; owner: [business owner]; sponsor: [executive].
• Purpose and objectives: [describe].
• Timeline and launch date: [dates].

2. Scope of Processing

• Data subjects: [customers/employees/vendors/end users].
• Personal data categories: [contact, IDs, financial, location, biometric, health, minors].
• Sensitive data (state definition): [list per state law if applicable]; lawful basis/consent requirements: [insert].
• Volume and retention: [records/year], [retention schedule and deletion triggers].
• Processing activities: [collection, storage, analysis, sharing/sale/sharing status].

3. Arizona Authority Register — Counsel Must Complete

Do not infer that a duty or right is absent because this worksheet contains no citation. Arizona counsel must identify every law that applies to the organization, data, person, processing purpose, product, and incident.

4. Data Flow and Transfers

• Source systems: [list]; storage/hosting locations: [cloud region/data centers].
• Cross-border transfers: [EU/UK/other]; transfer tool: [SCCs/IDTA/CBPR if applicable].
• Recipients/vendors: [processors/subprocessors/controllers]; due diligence status and DPAs in place.
• Access controls: RBAC groups, least privilege, joiner/mover/leaver process.

5. Security and Controls

• Technical controls: encryption in transit/at rest [specify], key management, network segmentation, endpoint protections, logging/monitoring, DLP, backups, vulnerability management.
• Organizational controls: policies, training cadence, vendor due diligence, incident response playbook, change management.
• Authentication/authorization: [MFA/SAML/SSO]; session timeouts; privileged access reviews cadence.

6. Risks and Impact Assessment

• Risks/threats: [unauthorized access, data minimization failure, purpose creep, profiling risk, transfer risk, children/minors risk].
• Likelihood: [low/medium/high]; Impact: [low/medium/high]; Risk rating matrix: [insert].
• Employment, discrimination, accessibility, profiling, or automated-decision risk identified for counsel: [insert].

7. Mitigations and Residual Risk

• Planned mitigations: [controls, timelines, owners].
• Testing/validation: [pen test, DPIA/ROPA updates, privacy-by-design checklist].
• Residual risk after mitigations: [rating]; decision: [accept/mitigate further/block].

8. Incident Response and Breach Notification

• Incident ID and discovery date/time: [________________________________].
• Systems, data, people, locations, and custodians involved: [________________________________].
• Facts established / facts disputed / evidence preserved: [________________________________].
• Encryption, access, acquisition, misuse, restoration, and containment facts: [________________________________].
• Arizona counsel's current official source for each definition and trigger: [________________________________].
• Individual-notice decision, deadline calculation, content, method, and owner: [________________________________].
• Regulator or other recipient decision, threshold, deadline, content, method, and owner: [________________________________].
• Service-provider, customer, insurer, law-enforcement, contract, and multistate notifications: [________________________________].
• Required decision record and retention period, if any: [________________________________].
• Approval to notify / not notify, with signer and date: [________________________________].

9. Arizona Overlay Completion Checklist

• ☐ Current official Arizona sources were opened and quoted in Section 3 this session.
• ☐ Counsel checked enacted legislation that may outrun a consolidated source.
• ☐ Every threshold and deadline was calculated from documented facts, not copied from an old form.
• ☐ Sector, federal, tribal, contractual, licensing, insurance, and other-state overlays were identified.
• ☐ The absence of a listed right or duty was not treated as proof that none exists.
• ☐ Notices and decisions were approved under the organization's incident-response authority matrix.

10. Approvals and Accountability

• Privacy lead/DPO review: [name/date].
• Security review: [name/date].
• Legal review (state law overlay): [name/date].
• Business owner certification: [name/date].
• Executive approver: [name/title/date].

11. Attachments

• Data flow diagrams/architecture.
• Records of processing activities entry.
• Vendor list and DPAs/SCCs.
• Legitimate interests assessment or risk assessment (if applicable).
• Testing summaries and pen test reports (if applicable).
• State-specific notices/links and breach templates.