Privacy Impact Assessment Requirement¶
A Privacy Impact Assessment (PIA) informs the Authorizing Official (AO) about the personal information your application collects, uses, stores, and shares, and how you protect it. Complete DD Form 2930 and upload it to Game Warden for inclusion in your application's Body of Evidence (BoE) for the AO's review.
This article explains when you need a PIA, how to complete each section of DD Form 2930, and how to upload the completed form to Game Warden.
What is a PIA¶
A Privacy Impact Assessment (PIA) identifies and evaluates privacy risks associated with collecting, using, storing, sharing, and disposing of personal information in an electronic system. For the formal definition, see the NIST Glossary.
Personally Identifiable Information (PII) is information that can identify a specific person, either by itself or when you combine it with other data. Examples include names, Social Security numbers, birth dates, email addresses, and phone numbers.
The PIA helps the Authorizing Official (AO) understand how your application handles PII by answering four questions:
- What PII does the application collect, and from whom?
- Why does the application collect the PII, and with whom does it share the information?
- How long does the application retain the PII?
- How does the application protect the PII?
When do you need a PIA¶
Complete a Privacy Impact Assessment (PIA) if your application collects, maintains, uses, or shares Personally Identifiable Information (PII). Game Warden requests a PIA when the Privacy section of your IT Categorization and Selection Checklist (ITCSC) indicates that your application processes PII.
| Situation | What to do |
|---|---|
| Your application collects, maintains, uses, or shares PII | Complete all required sections of DD Form 2930. |
| Your application does not handle PII | You do not need a PIA unless your government sponsor requires one. If required, select Not Collected in Section 1 and proceed to Section 4. This documents your determination that the application does not collect PII. |
| Your application already has a PIA, but its PII handling has changed | Update the PIA and upload the revised form to Game Warden. |
| Your application already has a PIA, and its PII handling has not changed | You do not need to take any action. |
Before you begin¶
Gather the following before completing DD Form 2930:
| What you need | Details |
|---|---|
| Adobe Acrobat or Adobe Reader | Open the fillable PDF in Adobe Acrobat or Adobe Reader. The form may appear blank or display "Please wait..." in a web browser or another PDF viewer. |
| PII inventory | Identify the PII your application handles, where the information comes from, and where the application stores it. |
| Compliance details | Gather your system registration ID and authorization status, if available. |
| Government sponsor's privacy official | Work with your sponsor's privacy official to identify the PII your application handles, consistent with the Privacy section of your ITCSC and the Information Security section of your SSP. |
Complete the PIA¶
Download DD Form 2930 and open it in Adobe Acrobat or Adobe Reader. Complete the four sections below, then obtain the required signatures.
Section 1: PII description summary
Section 1 is public. Your DOW Component publishes Section 1 on its public website. Do not include sensitive information or details that could reveal security vulnerabilities.
Complete the following fields to describe your application, the PII it handles, and the applicable privacy requirements.
| Field | What to enter |
|---|---|
| 1–3: System information | Enter your system name, DOW Component, and PIA approval date. |
| 1a: Whose PII is collected | Select General Public, Federal Employees, both, or Not Collected. Contractors, military family members, and foreign nationals count as members of the general public. |
| 1b: System status | Select whether the system is New, Existing, or Significantly Modified. |
| 1c–1d: Purpose and use | Describe what your application does, which PII it collects, and why it collects or uses that information. Examples include identification, authentication, and administrative purposes. |
| 1e–1f: Objection and consent | Explain whether individuals can object to PII collection or consent to specific uses. Describe how they exercise these options or why they cannot. |
| 1g: Privacy notice | If you ask individuals to provide PII, select Privacy Act Statement or Privacy Advisory and enter the actual notice text. |
| 1h–1j: Sharing, sources, and collection methods | Identify who receives the PII, where the information originates, and how your application collects it. Examples include web forms and system-to-system transfers. |
| 1k: System of Records Notice (SORN) | If the SORN requirement applies, enter the SORN identifier, not the Federal Register citation. A SORN generally applies when an agency retrieves records about U.S. citizens or lawful permanent residents by name or another personal identifier. Contact your Component Privacy Office for guidance and the applicable identifier. |
| 1l: Records retention | Enter the National Archives and Records Administration (NARA) job number or General Records Schedule authority, along with the retention instructions. Contact your Component Records Officer for assistance. |
| 1m: Authority to collect | Cite the law or Executive Order that authorizes the collection of PII. |
| 1n: OMB Control Number | Select Yes, No, or Pending. You may need an OMB Control Number when you collect information from 10 or more members of the public during a 12-month period. Contact your Component Information Management Control Officer to confirm the requirement and obtain the number. |
Section 2: PII risk review
Assess the PII your application handles, its confidentiality impact, and the safeguards that protect it.
| Field | What to enter |
|---|---|
| 2a: PII collected | Select every applicable data element. If your application collects Social Security numbers (SSNs) in any form, complete the follow-up questions about your SSN Justification Memo, approved use, and mitigation plan. |
| 2b: Confidentiality impact level | Select Low, Moderate, or High. Work with your system owner and security team to determine the appropriate level using NIST SP 800-122. |
| 2c: PII safeguards | Select the physical, administrative, and technical controls that protect the PII. Examples include encryption at rest and in transit, role-based access control, and least privilege. |
| 2d: Additional safeguards | Describe any other measures your application uses to reduce privacy risks. |
Section 3: Related compliance information
Provide the system registration, authorization, and investment details that apply to your application.
| Field | What to enter |
|---|---|
| 3a: System registration | Indicate whether you registered your system in DITPR, the SIPRNET IT Registry, or an RMF tool. Enter the applicable registration ID. |
| 3b: Authorization status | Select the applicable assessment and authorization status: ATO, ATO with conditions, DATO, or IATT. Enter the authorization date. |
| 3c: Investment identifier | Enter your IT investment Unique Investment Identifier (UII), if available. |
Section 4: Review and approval signatures
The program manager coordinates the review and obtains the required signatures. Each required official must provide a signature, name, title, organization, contact details, and review date.
| Reviewing official | Required |
|---|---|
| Program Manager or designee | Yes |
| Component Privacy Officer (CPO) | Yes |
| Component Records Officer | Yes |
| Component Senior Information Security Officer or designee | Yes |
| Senior Component Official for Privacy (SCOP) or designee | Yes |
| Component CIO reviewing official | Yes |
| Other officials designated by the Component | Optional |
Save the completed PIA
Save the completed and signed DD Form 2930 as a PDF. Upload the PDF to Game Warden to include it in your application's Body of Evidence (BoE).
Upload your PIA to Game Warden¶
Upload the completed and signed PIA PDF to Game Warden so it becomes part of your application's BoE.
- Log in to Game Warden with an Admin account.
- In the left navigation bar, select Documents > New Document.
- Select the signed PIA PDF from your device.
- Enter a document name, such as
PIA - <application name>. You can optionally associate the document with an application. - Select the appropriate document category.
- Select Upload.
Your PIA appears on the Documents page. For more information, see Upload Documents to Game Warden.
What happens next¶
Game Warden includes your PIA in your application's BoE for the AO to review as part of the authorization decision. For details about the review process, see Deployment Passport Submission.
After approval
Your DOW Component submits the PIA to the DOW CIO and publishes Section 1 on its public website.
Troubleshooting¶
The form is blank or shows 'Please wait...'
The form is open in a web browser or a PDF viewer other than Adobe. Download it and open it in Adobe Acrobat or Adobe Reader.
I'm not sure whether my application handles PII.
Review the data elements listed in Section 2a of the form. If your application collects any of them, it handles PII. If you are still unsure, submit a support ticket or contact your Mission Success Manager.
I don't know which SORN, NARA schedule, or OMB Control Number applies.
Your government counterparts provide these values. Ask the Component Privacy Office for the SORN, the Component Records Officer for the NARA schedule, and the Component Information Management Control Officer for the OMB Control Number.
The PII my application handles changed after I uploaded the PIA.
Complete an updated PIA and upload it the same way. Contact your Mission Success Manager to confirm it replaces the earlier version in your BoE.
Feedback
Was this article helpful? Want to see something more?
Please reach out to us here with your feedback.