When to use
Use this the moment a new processing activity, feature, integration, or vendor is proposed and someone needs a fast, defensible read on privacy exposure before work begins. It is the front door: it decides whether the activity is low-risk and can proceed, or must escalate to a PIA/DPIA (privl-pia-generation), a DPA review (privl-dpa-review), or an attorney.
Not for: completing the full impact assessment itself, answering a live data-subject request (privl-dsar-response), or drafting policy. If the activity is already scoped and lawful, do not re-triage.
Method
- Describe the activity in one line: what data, from whom, for what purpose, by which systems, shared with whom.
- Classify the data: ordinary personal data, special-category / sensitive (GDPR Art. 9 — health, biometrics, race, religion, sexuality, politics; CCPA "sensitive personal information"), children's data, or financial/government-ID.
- Name a candidate lawful basis (GDPR Art. 6: consent, contract, legal obligation, vital interests, public task, legitimate interests). If legitimate interests, note that a balancing test is owed.
- Scan high-risk signals: large-scale profiling, automated decisions with legal/significant effect, systematic monitoring, novel tech, combining datasets, vulnerable subjects, cross-border transfer.
- Decision point: any Art. 35(3) trigger or special-category-at-scale → require a DPIA and stop the fast track.
- Attorney-escalation gate: new automated decisioning, children's data, sensitive-data monetization, or a novel cross-border transfer → route to counsel before proceeding.
Example
Activity: New churn model scoring all users from support transcripts + usage logs.
Data: ordinary personal data, large scale; transcripts may contain incidental sensitive data.
Basis: legitimate interests — balancing test owed.
Risk signals: large-scale profiling + dataset combination → Art. 35 trigger.
Verdict: DPIA required (privl-pia-generation); attorney review not yet, revisit if scores drive automated account actions.
Pitfalls
- Defaulting to consent when contract or legitimate interests is the honest basis.
- Ignoring incidental sensitive data hiding in free-text fields.
- Treating "we already collect it" as authorization for a new purpose (purpose limitation).
- Skipping the balancing test when relying on legitimate interests.
Output format
Activity: <one line>
Data class: <ordinary | sensitive/Art.9 | children | financial/ID>
Lawful basis: <basis + balancing-test-owed?>
Risk signals: <list or none>
Verdict: <proceed | DPIA required | DPA review | attorney>
Escalate to counsel: <yes/no — why>
Reference
- GDPR Art. 6 lawful bases; Art. 9 special-category conditions; Art. 35(3) DPIA triggers.
- CCPA/CPRA "sensitive personal information" category and purpose-limitation duties.
- Attorney escalation is mandatory for automated decisioning with legal effect, children's data, and novel international transfers.
1---2name: privl-use-case-triage3description: Triage a proposed data-processing use case — classify the data, name a lawful basis, flag high-risk signals, and decide whether a full PIA or attorney review is required.4---56## When to use78Use this the moment a new processing activity, feature, integration, or vendor is proposed and someone needs a fast, defensible read on privacy exposure before work begins. It is the front door: it decides whether the activity is low-risk and can proceed, or must escalate to a PIA/DPIA (privl-pia-generation), a DPA review (privl-dpa-review), or an attorney.910**Not for:** completing the full impact assessment itself, answering a live data-subject request (privl-dsar-response), or drafting policy. If the activity is already scoped and lawful, do not re-triage.1112## Method13141. Describe the activity in one line: what data, from whom, for what purpose, by which systems, shared with whom.152. Classify the data: ordinary personal data, special-category / sensitive (GDPR Art. 9 — health, biometrics, race, religion, sexuality, politics; CCPA "sensitive personal information"), children's data, or financial/government-ID.163. Name a candidate lawful basis (GDPR Art. 6: consent, contract, legal obligation, vital interests, public task, legitimate interests). If legitimate interests, note that a balancing test is owed.174. Scan high-risk signals: large-scale profiling, automated decisions with legal/significant effect, systematic monitoring, novel tech, combining datasets, vulnerable subjects, cross-border transfer.185. **Decision point:** any Art. 35(3) trigger or special-category-at-scale → require a DPIA and stop the fast track.196. **Attorney-escalation gate:** new automated decisioning, children's data, sensitive-data monetization, or a novel cross-border transfer → route to counsel before proceeding.2021## Example2223> **Activity:** New churn model scoring all users from support transcripts + usage logs.24> **Data:** ordinary personal data, large scale; transcripts may contain incidental sensitive data.25> **Basis:** legitimate interests — balancing test owed.26> **Risk signals:** large-scale profiling + dataset combination → Art. 35 trigger.27> **Verdict:** DPIA required (privl-pia-generation); attorney review not yet, revisit if scores drive automated account actions.2829## Pitfalls3031- Defaulting to consent when contract or legitimate interests is the honest basis.32- Ignoring incidental sensitive data hiding in free-text fields.33- Treating "we already collect it" as authorization for a new purpose (purpose limitation).34- Skipping the balancing test when relying on legitimate interests.3536## Output format3738```39Activity: <one line>40Data class: <ordinary | sensitive/Art.9 | children | financial/ID>41Lawful basis: <basis + balancing-test-owed?>42Risk signals: <list or none>43Verdict: <proceed | DPIA required | DPA review | attorney>44Escalate to counsel: <yes/no — why>45```4647## Reference4849- **GDPR Art. 6** lawful bases; **Art. 9** special-category conditions; **Art. 35(3)** DPIA triggers.50- **CCPA/CPRA** "sensitive personal information" category and purpose-limitation duties.51- Attorney escalation is mandatory for automated decisioning with legal effect, children's data, and novel international transfers.
Matrixx0070