GDPR DPIA EN - Data Protection Impact Assessment (Art. 35-36)
Philosophy
A DPIA is not a checkbox - it is a process for managing risk to the rights and freedoms of natural
persons. This skill runs the process and produces a draft; the residual-risk acceptance and the
go/no-go decision belong to the controller.
Step 1 - Is a DPIA REQUIRED (Art. 35(1) threshold)
Mandatory where processing is likely to result in a high risk. Three routes:
- Supervisory authority's mandatory list (Art. 35(4)) - each EU SA publishes a list of
operations always requiring a DPIA. Check the relevant national list.
- EDPB's 9 criteria (WP248) - rule of thumb: >=2 criteria met => DPIA. Criteria:
evaluation/scoring, automated decisions with significant effect (Art. 22), systematic monitoring,
sensitive/highly personal data, large-scale data, matching/combining datasets, vulnerable data
subjects (children, employees), innovative technology (AI, IoT), preventing exercise of a right
or use of a service.
- Art. 35(3) - explicit cases: systematic and extensive evaluation (profiling), large-scale
special-category/criminal data, large-scale systematic monitoring of public areas.
Output: dpia_required: yes/no/recommended + per-criterion justification.
Step 2 - DPIA structure (Art. 35(7) minimum)
Four pillars:
- (a) Systematic description of the processing and its purposes (incl. legitimate interest if relied on).
- (b) Necessity and proportionality assessment against the purposes (minimisation, legal basis,
purpose limitation, retention, data-subject rights, transfers).
- (c) Risk assessment to rights and freedoms (risk sources, confidentiality/integrity/
availability scenarios; likelihood x severity).
- (d) Measures to address the risks and demonstrate compliance + residual risk.
Record the DPO's advice (Art. 35(2)) and any consultation with data subjects (Art. 35(9)).
Step 3 - Prior consultation (Art. 36)
If residual risk remains HIGH despite measures, the controller MUST consult the supervisory
authority BEFORE processing. The skill drafts the consultation request (scope per Art. 36(3)) - but
a human files it (governance boundary).
Tool - threshold screening (deterministic, offline)
Screen whether a DPIA is required with the script instead of judging by feel (zero dependencies, offline):
python scripts/dpia_screening.py --criteria evaluation,sensitive,largescale
python scripts/dpia_screening.py --mandatory public_monitoring
Returns a verdict (required / recommended / not_required) per the EDPB ">=2" rule and the Art. 35(3) cases. Screening only, not a clearance - the controller documents the decision.
Governance boundary
Skill: drafts the DPIA, classifies criteria, prepares the consultation request. Human: approves the
risk assessment, decides on deployment, signs and files. The outward act (filing with the SA) is
never automatic.
Companion
Records & processor contracts: [[gdpr-ropa-dpa-en]]. Polish parity: rodo-dpia-pl.
1---2name: gdpr-dpia-en3description: Data Protection Impact Assessment (DPIA) assistant grounded in GDPR Art. 35-36, the EDPB WP248 rev.01 guidelines, and national supervisory-authority blacklists. Walks through: (1) the threshold test - is a DPIA REQUIRED (EDPB's 9 criteria, the ">=2" rule of thumb, Art. 35(3) mandatory cases, the SA's mandatory list), (2) the DPIA structure mandated by Art. 35(7) (systematic description, necessity & proportionality, risk assessment, mitigating measures), (3) the Art. 36 prior-consultation decision. Drafts the DPIA and a decision log - it does NOT make the controller's risk decision or file with the authority (those are human acts). Adds no connectors and makes no outbound calls of its own; the system description you paste still goes to the model you have configured. Use when: "do I need a DPIA", "data protection impact assessment", "DPIA for profiling/CCTV/AI", "Art. 35 GDPR", "prior consultation", "high-risk processing".4license: Apache-2.05---67# GDPR DPIA EN - Data Protection Impact Assessment (Art. 35-36)89## Philosophy1011A DPIA is not a checkbox - it is a process for managing risk to the rights and freedoms of natural12persons. This skill runs the process and produces a **draft**; the residual-risk acceptance and the13go/no-go decision belong to the controller.1415## Step 1 - Is a DPIA REQUIRED (Art. 35(1) threshold)1617Mandatory where processing is **likely to result in a high risk**. Three routes:18191. **Supervisory authority's mandatory list** (Art. 35(4)) - each EU SA publishes a list of20 operations always requiring a DPIA. Check the relevant national list.212. **EDPB's 9 criteria (WP248)** - rule of thumb: **>=2 criteria met => DPIA**. Criteria:22 evaluation/scoring, automated decisions with significant effect (Art. 22), systematic monitoring,23 sensitive/highly personal data, large-scale data, matching/combining datasets, vulnerable data24 subjects (children, employees), innovative technology (AI, IoT), preventing exercise of a right25 or use of a service.263. **Art. 35(3)** - explicit cases: systematic and extensive evaluation (profiling), large-scale27 special-category/criminal data, large-scale systematic monitoring of public areas.2829Output: `dpia_required: yes/no/recommended` + per-criterion justification.3031## Step 2 - DPIA structure (Art. 35(7) minimum)3233Four pillars:34- **(a) Systematic description** of the processing and its purposes (incl. legitimate interest if relied on).35- **(b) Necessity and proportionality** assessment against the purposes (minimisation, legal basis,36 purpose limitation, retention, data-subject rights, transfers).37- **(c) Risk assessment** to rights and freedoms (risk sources, confidentiality/integrity/38 availability scenarios; likelihood x severity).39- **(d) Measures** to address the risks and demonstrate compliance + residual risk.4041Record the DPO's advice (Art. 35(2)) and any consultation with data subjects (Art. 35(9)).4243## Step 3 - Prior consultation (Art. 36)4445If **residual risk remains HIGH despite measures**, the controller MUST consult the supervisory46authority BEFORE processing. The skill drafts the consultation request (scope per Art. 36(3)) - but47a human files it (governance boundary).4849## Tool - threshold screening (deterministic, offline)5051Screen whether a DPIA is required with the script instead of judging by feel (zero dependencies, offline):5253```bash54python scripts/dpia_screening.py --criteria evaluation,sensitive,largescale55python scripts/dpia_screening.py --mandatory public_monitoring56```5758Returns a `verdict` (required / recommended / not_required) per the EDPB ">=2" rule and the Art. 35(3) cases. Screening only, not a clearance - the controller documents the decision.5960## Governance boundary6162Skill: drafts the DPIA, classifies criteria, prepares the consultation request. Human: approves the63risk assessment, decides on deployment, signs and files. The outward act (filing with the SA) is64never automatic.6566## Companion6768Records & processor contracts: [[gdpr-ropa-dpa-en]]. Polish parity: `rodo-dpia-pl`.
matematicsolutions