Import Dpia Sentinel

Import: DPIA Sentinel

What it does

This import adapter migrates a DPIA (Data Protection Impact Assessment) sentinel skill into the mini-claude-for-legal standard format. A DPIA sentinel continuously monitors or screens processing activities to determine whether a formal DPIA is required, and if so, whether the assessment is adequate.

Under GDPR Article 35, certain categories of high-risk processing mandate a DPIA before processing begins. A sentinel skill automates this screening: given a description of a new or changed processing activity, it applies the Article 35(3) mandatory categories plus the supervisory authority's published criteria (the "blacklist") and flags whether a DPIA is triggered.

Import config

Dry-run preview

IMPORT PREVIEW — dpia-sentinel
Source shape  : DPIA screening config
Screening     : GDPR Art 35(3) + CNIL blacklist (FR default)
Risk levels   : HIGH / MEDIUM / LOW
Notification  : Supervisory authority notified at HIGH
Output        : structured_report (JSON + narrative)
DPA           : CNIL (FR), ICO (UK), EDPB (cross-border)

DPIA mandatory triggers (post-import logic)

The imported sentinel checks each new processing activity against:

GDPR Article 35(3) mandatory categories

1. Systematic and extensive profiling with automated decision-making producing legal/significant effects on persons
2. Large-scale processing of special-category data (Article 9) or criminal-offence data (Article 10)
3. Systematic monitoring of publicly accessible areas on a large scale

Supervisory-authority blacklists (examples)

• CNIL (France): biometric data processing; loyalty programmes; social media monitoring; employee tracking; IoT combined with profiling; AI recruitment tools
• ICO (UK): child data processing; matching/combining datasets from multiple sources; innovative technology use; denial of service decisions
• EDPB: any of the above at cross-border scale

Additional high-risk indicators

• Processing data of vulnerable subjects (minors, patients, employees)
• Data transfer to third countries without adequacy decision
• Novel processing technology not previously assessed
• Processing enabling re-identification of pseudonymised data

Output schema (post-import)

{
  "dpia_required": true | false,
  "triggers": ["Art 35(3)(a)", "CNIL blacklist item 3"],
  "risk_level": "HIGH",
  "recommended_action": "Conduct full DPIA before processing begins",
  "dpa_notification_required": false,
  "notes": "Consult DPO. DPIA must be completed before go-live."
}

Jurisdictional notes

Failure modes

Related skills

• [[import-gdpr-breach-sentinel]]
• [[import-gdpr-privacy-notice-eu]]
• [[review-dpia-eu]]
• [[kb-gdpr-data-protection]]
• [[draft-dpa-processor-agreement]]