The subsequent report6 introduced a mandatory requirement for Privacy Impact Assessments
(PIAs) to be carried out by all government departments when developing new policies or initiatives, or amending existing work streams that involve the handling of personal data.