agentleFS
Sign inStart free
kaandgnshkaandgnsh/Claude-Blue/skills/privacy-engineering/dpia/SKILL.md

dpia

Skill0 starsChanged 12 days agoMITView on GitHub

Conduct a Data Protection Impact Assessment (GDPR Art. 35) or privacy impact assessment — screening criteria, data flow description, necessity and proportionality, risks to individuals (LINDDUN), mitigations, DPO consultation and residual risk sign-off. Use when launching processing likely to be high risk (monitoring, large-scale sensitive data, profiling, new technology including AI), or when asked whether a DPIA is required.

3 other projects use a version of this.

Adopted by

Most recently taken up by

The file

Create a free account to mount
Files
SKILL.md

Data Protection Impact Assessment

Is a DPIA required? (screening)

GDPR Art. 35(3) mandatory cases: systematic and extensive profiling with significant effects; large-scale special-category or criminal data; systematic monitoring of public areas. EDPB (WP248) criteria — two or more usually means DPIA: evaluation/scoring, automated decisions with legal effect, systematic monitoring, sensitive data, large scale, matching/combining datasets, vulnerable data subjects (employees, children), innovative technology (e.g. AI, biometrics), preventing exercise of rights. Check your supervisory authority's published list.

Contents

  1. Description: purposes, data categories, data subjects, sources, recipients/processors, transfers outside EEA, retention, systems (data-flow diagram).
  2. Necessity & proportionality: lawful basis (Art. 6, Art. 9 condition), data minimization, accuracy, retention, transparency, rights handling, processor contracts (Art. 28), transfer safeguards.
  3. Risks to individuals (not the company): illegitimate access, unwanted modification, disappearance; plus privacy threats from LINDDUN — Linkability, Identifiability, Non-repudiation, Detectability, Disclosure, Unawareness, Non-compliance. Rate likelihood and severity.
  4. Measures: pseudonymization, encryption, access control, aggregation, purpose restriction controls, retention automation, user controls, transparency notices, human review of automated decisions.
  5. Residual risk & sign-off: DPO advice recorded; if high residual risk remains → prior consultation with the supervisory authority (Art. 36).
  6. Review trigger: change of purpose, new data, new technology, incidents.

Security team contribution

Threat model (threat-modeling), access and logging design, encryption/key management, retention enforcement, breach detection capability, vendor security assessment for processors.

Output

Risk | Source (LINDDUN/security) | Likelihood | Severity | Measure | Owner | Residual risk

Related skills

threat-modeling, telemetry-minimization, data-classification, vendor-security-assessment

References

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free