alexe-ev Run Privacy Impact Assessment
Purpose
Help teams conduct a structured privacy impact assessment that identifies personal data flows, evaluates privacy risks, and defines mitigations — before launching a feature, not after.
Skill type
Conceptual skill
Use this skill when
- A new feature collects, processes, or uses personal data
- A data-sharing or third-party integration is being introduced
- Regulatory requirements (GDPR, CCPA, HIPAA) require a formal PIA
- A privacy risk needs to be evaluated before stakeholder approval
Do not use this skill when
- The goal is general security risk assessment (use assess-privacy-security-regulatory)
- The goal is AI-specific governance (use govern-responsible-ai)
Required inputs
- Feature or initiative description
- Types of personal data involved (or potentially involved)
- Target market / geography
Optional inputs
- Data flow diagram
- Applicable regulations
- Vendor or third-party data sharing
- Legal team requirements
Upstream context
Works best when:
- Feature is defined
- Privacy regulations applicable to the product are known
Downstream handoff
Output can feed:
- plan-risk-mitigation (privacy risks → mitigation plan)
- write-requirements-prd (privacy requirements → product requirements)
- govern-responsible-ai (PIA intersects with AI governance for AI features)
Instructions
- Identify all personal data collected or processed by the feature.
- Map the data flow: collection → processing → storage → sharing → deletion.
- Identify applicable regulations and their requirements.
- Assess privacy risks at each stage of the data flow.
- Evaluate risk severity: likelihood × impact on individuals.
- Define mitigations for each identified risk.
- Define residual risk and whether it is acceptable.
Output
Provide:
- Personal data inventory (type, sensitivity, volume)
- Data flow map
- Applicable regulations and requirements
- Privacy risks by data flow stage
- Risk severity assessment
- Mitigations per risk
- Residual risk assessment
- Recommendation: proceed / proceed with conditions / don't proceed
Risks / caveats
- PIAs done after launch are retroactive fixes — run them before, not after
- Regulatory requirements vary by geography — identify applicable laws early
- Legal review should validate the PIA for high-risk features