Dpia Assessment

⚠️ EXPERIMENTAL — This skill is provided for educational and informational purposes only. It does NOT constitute legal advice. All responsibility for usage rests with the user. Consult qualified legal professionals before acting on any output.

DPIA Assessment

GDPR Article 35 Data Protection Impact Assessment tooling. Evaluates whether a DPIA is required, manages risk registers with mitigation tracking, and generates documentation meeting supervisory authority expectations.

Table of Contents

• Tools
  • DPIA Threshold Checker
  • DPIA Risk Register
• Reference Guides
• Workflows
• Legal Precision Points
• Output Formats
• Troubleshooting
• Success Criteria
• Scope & Limitations
• Anti-Patterns
• Tool Reference

Clarify First

Before the assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Processing activity description — purpose, data types, automation level, scale — drives the Art. 35(3) trigger matches and EDPB criteria scoring (the whole verdict)
• Special-category data + scale — determines the Art. 35(3)(b) trigger, the Art. 9 cumulative-basis requirement, and the large-scale four-factor test
• Jurisdiction(s) — which national blacklists apply (DE/FR/IE/BE/NL/IT/PL); the most restrictive governs
• Whether an AI system is involved — triggers dual-phase (training/inference) analysis per EDPB Opinion 28/2024 and the separate FRIA distinction

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the assessment.

Tools

DPIA Threshold Checker

Evaluates whether a DPIA is required based on processing activity description. Checks Art. 35(3) mandatory triggers and 9 EDPB criteria.

# Check a processing activity (interactive prompts)
python scripts/dpia_threshold_checker.py --activity "AI-based credit scoring using financial and behavioral data of retail banking customers across EU"

# Check from JSON description
python scripts/dpia_threshold_checker.py --input processing.json

# JSON output
python scripts/dpia_threshold_checker.py --activity "Employee monitoring via CCTV in workplace" --json

# Generate blank input template
python scripts/dpia_threshold_checker.py --template > processing.json

Checks performed:

• Art. 35(3)(a): Automated decision-making with legal/significant effect
• Art. 35(3)(b): Large-scale processing of special category data (Art. 9) or criminal data (Art. 10)
• Art. 35(3)(c): Systematic monitoring of publicly accessible area on large scale
• 9 EDPB criteria from WP 248 rev.01 with two-criterion presumption rule

Output:

• Verdict: Required / Recommended / Not Required
• Art. 35(3) trigger matches
• EDPB criteria scores with reasoning
• Two-criterion presumption analysis

DPIA Risk Register

Manages a DPIA risk register in JSON format. Add risks, apply mitigations, and calculate residual risk.

# Initialize a new risk register
python scripts/dpia_risk_register.py init --output dpia_risks.json

# Add a risk
python scripts/dpia_risk_register.py add --register dpia_risks.json \
  --description "Unauthorized access to profiling data" \
  --rights-category "right-to-privacy" \
  --likelihood 4 --severity 3

# Add mitigation to a risk
python scripts/dpia_risk_register.py mitigate --register dpia_risks.json \
  --risk-id 1 --measure "Implement role-based access control" \
  --likelihood-reduction 2 --severity-reduction 1

# View risk register table
python scripts/dpia_risk_register.py view --register dpia_risks.json

# Generate residual risk summary
python scripts/dpia_risk_register.py summary --register dpia_risks.json --json

# Check Art. 36 consultation threshold
python scripts/dpia_risk_register.py art36-check --register dpia_risks.json

Rights categories: right-to-privacy, non-discrimination, freedom-of-expression, right-to-information, right-to-not-be-subject-to-automated-decisions, right-to-physical-safety

Reference Guides

EDPB Criteria

references/edpb_criteria.md

Complete EDPB 9-criteria assessment framework:

• Each criterion with description, indicators, and scoring guidance
• Art. 35(3) mandatory triggers
• Two-criterion presumption rule (WP 248 rev.01)
• Multi-jurisdictional DPIA analysis
• National blacklist/whitelist overview (DE, FR, IE, BE, NL, IT, PL)

Risk Scoring Methodology

references/risk_scoring_methodology.md

DPIA risk scoring from the data subject perspective:

• Likelihood and severity scales (1-5)
• Rights categories per Recital 75
• Risk level thresholds (Low/Medium/High/Very High)
• Mitigation effectiveness scoring
• Residual risk calculation
• Art. 36 consultation triggers
• Risk catalog: 20+ common DPIA risks

Workflows

Workflow 1: Full DPIA Assessment

Step 1: Threshold check — determine if DPIA required
        → python scripts/dpia_threshold_checker.py --activity "description"

Step 2: If Required or Recommended, describe the processing
        → Document purpose, legal basis, data categories, recipients, retention

Step 3: Assess necessity and proportionality
        → Confirm lawful basis (Art. 6, cumulative with Art. 9 if special categories)
        → Verify purpose limitation, data minimization, storage limitation

Step 4: Identify risks from data subject perspective
        → python scripts/dpia_risk_register.py init --output dpia_risks.json
        → Add risks using references/risk_scoring_methodology.md catalog

Step 5: Apply mitigations and calculate residual risk
        → python scripts/dpia_risk_register.py mitigate --register dpia_risks.json ...

Step 6: Check Art. 36 consultation requirement
        → python scripts/dpia_risk_register.py art36-check --register dpia_risks.json

Step 7: Document and review
        → python scripts/dpia_risk_register.py summary --register dpia_risks.json

Workflow 2: Quick Threshold Assessment

Step 1: Describe the processing activity
        → python scripts/dpia_threshold_checker.py --template > processing.json
        → Fill in processing details

Step 2: Run threshold check
        → python scripts/dpia_threshold_checker.py --input processing.json --json

Step 3: Review verdict and reasoning
        → Required: proceed to full DPIA (Workflow 1)
        → Recommended: proceed unless strong justification to skip (document)
        → Not Required: document the assessment and rationale

Workflow 3: AI System DPIA

Step 1: Classify AI system (EU AI Act risk level if applicable)
        → Map to DPIA triggers (automated decision-making, profiling, scoring)

Step 2: Run threshold check with AI-specific indicators
        → python scripts/dpia_threshold_checker.py --activity "AI system description"

Step 3: Dual-phase risk analysis (EDPB Opinion 28/2024)
        → Phase 1: Training data risks (collection, bias, consent)
        → Phase 2: Inference risks (decisions, profiling, transparency)

Step 4: Assess from data subject perspective
        → Add risks covering both training and inference phases
        → Include algorithmic bias, lack of transparency, unfair outcomes

Step 5: Apply mitigations specific to AI
        → Explainability measures, human oversight, bias testing
        → Document FRIA distinction per EU AI Act Art. 27 if applicable

Legal Precision Points

12 points of legal precision that distinguish expert-level DPIA work.

Output Formats

Threshold Verdict

VERDICT: DPIA REQUIRED
Reason: Art. 35(3)(a) trigger matched (automated decision-making with legal effect)
        + 4 of 9 EDPB criteria met (two-criterion presumption applies)
Matched triggers: automated_decision_making, evaluation_scoring, sensitive_data, large_scale

Risk Register Table

Residual Risk Overview

Total risks: 8
Mitigated: 6 (75%)
Residual risk distribution:
  Low:       3 (37.5%)
  Medium:    3 (37.5%)
  High:      2 (25.0%)
  Very High: 0 (0.0%)

Art. 36 consultation: NOT TRIGGERED (no Very High residual risks)

Troubleshooting

Success Criteria

• All high-risk processing activities assessed -- threshold check completed before processing begins, with documented verdict and reasoning
• Risk register complete with mitigations -- every identified risk has likelihood, severity, rights category, and at least one mitigation measure
• Residual risk acceptable or Art. 36 consultation initiated -- no unaddressed Very High residual risks
• Documentation meets SA expectations -- assessment follows Art. 35(7) requirements: systematic description, necessity/proportionality, risks, mitigations
• EDPB criteria properly applied -- two-criterion presumption correctly evaluated with documented reasoning

Scope & Limitations

In Scope:

• DPIA threshold assessment against Art. 35(3) triggers and EDPB criteria
• Risk register management with mitigation tracking and residual risk calculation
• Art. 36 prior consultation threshold assessment
• Multi-jurisdictional blacklist awareness (DE, FR, IE, BE, NL, IT, PL)
• AI system dual-phase DPIA analysis guidance
• Data subject perspective risk assessment per Recital 75

Out of Scope:

• Legal advice on lawful basis selection (Art. 6) or Art. 9(2) exception applicability
• Supervisory authority submission or interaction
• Technical implementation of mitigations (encryption, access control)
• DPO appointment or consultation logistics
• National blacklist exhaustive coverage beyond listed jurisdictions
• EU AI Act conformity assessment (see eu-ai-act-specialist)

Anti-Patterns

• Conducting DPIA after processing has started -- Art. 35(1) requires DPIA before processing begins; retroactive DPIAs do not satisfy the legal obligation and create enforcement exposure
• Assessing risk from the controller's perspective -- DPIA risks must be evaluated from the data subject's perspective per Recital 75; business impact is irrelevant to this analysis; a breach that is minor for the company may be catastrophic for affected individuals
• Treating pseudonymization as eliminating DPIA need -- pseudonymized data remains personal data under GDPR (Recital 26); pseudonymization is a mitigation that reduces risk scores, not a basis for skipping the DPIA entirely
• Skipping Art. 36 consultation when residual risk is high -- if residual risk remains Very High after mitigations, prior consultation with the supervisory authority is mandatory, not optional
• Conflating DPIA with FRIA -- the EU AI Act's Fundamental Rights Impact Assessment (Art. 27) is a separate obligation from GDPR DPIA; completing one does not satisfy the other; both may be required for AI systems processing personal data

Tool Reference

dpia_threshold_checker.py

Evaluates whether a DPIA is required based on Art. 35(3) triggers and EDPB criteria.

dpia_risk_register.py

Manages DPIA risk register with mitigation tracking and residual risk calculation.