<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-data-privacy-impact-analysis
description: >-
  Perform Data Protection Impact Assessments (DPIAs) as required by GDPR Article 35
  to evaluate high-risk processing activities, identify privacy risks, and document
  mitigation measures before processing begins.
domain: cybersecurity
subdomain: data-security
tags:
  - dpia
  - gdpr-article-35
  - privacy-impact
  - risk-assessment
  - data-protection
  - privacy-by-design
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Data Privacy Impact Analysis

## Overview

Perform Data Protection Impact Assessments (DPIAs) as required by GDPR Article 35
to evaluate high-risk processing activities, identify privacy risks, and document
mitigation measures before processing begins.

Mode: `[MODE: PRIVACY]` — Performing Data Privacy Impact Analysis.

## Prerequisites

| Requirement | Details |
|---|---|
| Refer to technique-specific requirements in the workflow section | Required |
| Data classification taxonomy with sensitivity levels | Required |
| Appropriate platform access for target environment | Required |
| Log aggregation and SIEM integration | Required |
| Change management process for policy deployment | Required |

## Key Concepts

Refer to the CLI commands and workflow sections for detailed implementation guidance.

### CLI Commands

```bash
node scripts/agent.js --action threshold --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action assess --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action risk-matrix --input /tmp/input.json \
  --output /tmp/output.json
```

## Workflow

### Step 1: Prepare Input Data

Gather and format input data for the target action.

### Step 2: Execute Analysis

```bash
node scripts/agent.js --action threshold --input /tmp/input.json \
  --output /tmp/output.json
```

### Step 3: Review Findings

Analyze output for gaps, violations, or anomalies.

### Step 4: Remediate

Address identified issues according to severity.

### Step 5: Monitor

Deploy continuous monitoring for ongoing compliance.

## Verification

- [ ] All target assets inventoried and analyzed
- [ ] Policy violations identified and documented
- [ ] Remediation actions tracked to completion
- [ ] Continuous monitoring alerts configured
- [ ] Compliance evidence archived for audit
- [ ] Periodic review schedule established
- [ ] Findings reported to stakeholders

## References

- [NIST SP 800-53 — Security and Privacy Controls](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Controls](https://www.cisecurity.org/controls)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [GDPR](https://gdpr-info.eu/)
