The ultimate goal of conducting a privacy impact analysis (PIA) is to identify gaps in data protection controls, as it involves assessing the privacy risks and impacts of collecting, using, storing, and disclosing personally identifiable information (PII), and determining the adequacy and effectiveness of the existing or proposed controls to mitigate those risks and impacts. Developing a customer notification plan, identifying PII, and determining gaps in data identification processes are possible steps or outcomes of conducting a PIA, but they are not the ultimate goal, as they do not address the root cause or solution of the privacy issues. References = CRISC Review Manual, 7th Edition, page 155.