cloudthinker-ai Privacy Impact Assessment Skill
Conduct PIA for {{ project_name }} processing data of {{ data_subjects }} under {{ regulation }}.
Workflow
Phase 1 — Project Description
PROJECT OVERVIEW
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Project: {{ project_name }}
[ ] Description: ___
[ ] Data subjects: {{ data_subjects }}
[ ] Primary regulation: {{ regulation }}
[ ] Project stage: [ ] Design [ ] Development [ ] Production
[ ] Business justification: ___
[ ] Project owner: ___
[ ] DPO consulted: [ ] YES [ ] NO
Phase 2 — Data Flow Mapping
DATA FLOWS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Personal data collected:
Data Element | Category | Sensitivity | Source
_____________________|_____________|_____________|________
| | |
| | |
| | |
[ ] Data flow:
Collection -> Processing -> Storage -> Sharing -> Deletion
__________ -> __________ -> _______ -> _______ -> ________
[ ] Data storage locations: ___
[ ] Cross-border transfers: [ ] YES — countries: ___
[ ] Third parties receiving data:
- ___: purpose: ___
- ___: purpose: ___
Phase 3 — Legal Basis and Purpose
LEGAL BASIS ANALYSIS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Lawful basis for processing ({{ regulation }}):
[ ] Consent (explicit, informed, withdrawable)
[ ] Contractual necessity
[ ] Legal obligation
[ ] Vital interests
[ ] Public interest
[ ] Legitimate interests (balancing test required)
[ ] Purpose limitation:
- Stated purposes:
1. ___
2. ___
- Purpose is specific and explicit: [ ] YES
- No secondary use without additional basis: [ ] CONFIRMED
[ ] Data minimization:
- All collected data necessary for stated purpose: [ ] YES
- Data that could be removed/anonymized: ___
- Retention period justified: [ ] YES
Phase 4 — Data Subject Rights
RIGHTS IMPLEMENTATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Right to access: [ ] IMPLEMENTED — mechanism: ___
[ ] Right to rectification: [ ] IMPLEMENTED — mechanism: ___
[ ] Right to erasure: [ ] IMPLEMENTED — mechanism: ___
[ ] Right to portability: [ ] IMPLEMENTED — format: ___
[ ] Right to object: [ ] IMPLEMENTED — mechanism: ___
[ ] Right to restrict processing: [ ] IMPLEMENTED — mechanism: ___
[ ] Automated decision-making:
- Used: [ ] YES [ ] NO
- Right to human review: [ ] IMPLEMENTED
[ ] Response timeline: ___ days (regulatory max: ___ days)
Phase 5 — Risk Assessment
PRIVACY RISKS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Risk | Likelihood | Impact | Severity | Mitigation
_____________________________|____________|_________|__________|___________
Unauthorized access | | | |
Data breach | | | |
Excessive data collection | | | |
Purpose creep | | | |
Insufficient consent | | | |
Cross-border transfer risk | | | |
Third-party misuse | | | |
Reidentification risk | | | |
Residual risk after mitigations: [ ] LOW [ ] MEDIUM [ ] HIGH
Phase 6 — Approval
PIA DECISION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Mitigations implemented before launch
[ ] Privacy notice updated
[ ] Consent mechanisms deployed (if applicable)
[ ] DPO sign-off: [ ] APPROVED [ ] CONDITIONAL [ ] REJECTED
[ ] Conditions (if applicable):
- ___
- ___
[ ] Review date: ___
[ ] Reassessment trigger: material change in data processing
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |
Output Format
Produce a Privacy Impact Assessment report with:
- Project summary (description, data subjects, legal basis)
- Data flow map (collection, processing, storage, sharing)
- Rights implementation (status of each data subject right)
- Risk assessment (identified risks with mitigations)
- Decision (approval status, conditions, review schedule)