<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-data-protection-impact-assessment
description: >-
  Conduct Data Protection Impact Assessments (DPIAs) per GDPR Article 35 to identify
  and mitigate privacy risks in data processing activities before deployment.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - dpia
  - gdpr
  - risk-assessment
  - privacy-by-design
  - data-protection
  - article-35
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Conducting Data Protection Impact Assessment

## Overview

A Data Protection Impact Assessment (DPIA) is a systematic process required under
GDPR Article 35 when processing is likely to result in high risk to individuals'
rights and freedoms. This skill covers identifying DPIA triggers, conducting the
assessment, documenting risks, and implementing mitigations with structured output
suitable for supervisory authority review.

Mode: `[MODE: PRIVACY]` — Regulatory compliance and risk assessment.

## Prerequisites

| Requirement | Details |
|---|---|
| Understanding of GDPR Articles 35–36 and WP29 Guidelines | Required |
| Data flow diagrams for the processing activity | Required |
| Identified lawful basis under Article 6 (and Article 9 for special categories) | Required |
| Python 3.10+ for automated DPIA tooling | Required |
| Access to data processing records (ROPA) | Required |

## Key Concepts

### DPIA Trigger Assessment

Processing that **requires** a DPIA (Article 35(3)):

```text
1. Systematic and extensive profiling with significant effects
2. Large-scale processing of special category data (Art. 9) or criminal data (Art. 10)
3. Systematic monitoring of publicly accessible areas at large scale
```

WP29 criteria — DPIA required when **two or more** apply:

```text
[ ] Evaluation or scoring (profiling, predicting)
[ ] Automated decision-making with legal/significant effect
[ ] Systematic monitoring (observation, tracking)
[ ] Sensitive data or data of highly personal nature
[ ] Data processed on a large scale
[ ] Matching or combining datasets
[ ] Data concerning vulnerable subjects (children, employees, patients)
[ ] Innovative use of new technology
[ ] Cross-border transfer outside EEA
[ ] Processing that prevents data subjects from exercising rights
```

### DPIA Structure Template

```text
Section 1: Processing Description
  - Nature, scope, context, and purpose of processing
  - Data categories and data subjects
  - Recipients and retention periods
  - Data flows (diagram required)

Section 2: Necessity and Proportionality
  - Lawful basis (Art. 6, and Art. 9 if applicable)
  - Purpose limitation compliance
  - Data minimization assessment
  - Storage limitation review

Section 3: Risk Assessment
  - Threats to confidentiality, integrity, availability
  - Likelihood (remote/possible/probable)
  - Severity (low/medium/high/very-high)
  - Risk level = likelihood × severity

Section 4: Mitigations
  - Technical measures (encryption, pseudonymization, access controls)
  - Organizational measures (policies, training, DPO oversight)
  - Residual risk after mitigations

Section 5: Consultation
  - DPO opinion
  - Data subject views (where practicable)
  - Prior consultation with supervisory authority if residual risk remains high
```

### Risk Matrix

```python
RISK_MATRIX = {
    ("remote", "low"): "LOW",
    ("remote", "medium"): "LOW",
    ("remote", "high"): "MEDIUM",
    ("remote", "very-high"): "MEDIUM",
    ("possible", "low"): "LOW",
    ("possible", "medium"): "MEDIUM",
    ("possible", "high"): "HIGH",
    ("possible", "very-high"): "HIGH",
    ("probable", "low"): "MEDIUM",
    ("probable", "medium"): "HIGH",
    ("probable", "high"): "VERY HIGH",
    ("probable", "very-high"): "VERY HIGH",
}
```

### CLI Commands

```bash
# Assess DPIA triggers for a processing activity
node scripts/agent.js --action triggers \
  --processing-description "Employee monitoring via keylogger software"

# Generate a DPIA report template
node scripts/agent.js --action generate \
  --controller "Acme Corp" --activity "Customer profiling" \
  --output /tmp/dpia_report.json

# Evaluate risk for identified threats
node scripts/agent.js --action risk \
  --threats '[{"name":"unauthorized access","likelihood":"possible","severity":"high"}]' \
  --output /tmp/risk_assessment.json
```

## Workflow

### Step 1: Identify DPIA Triggers

```bash
node scripts/agent.js --action triggers \
  --processing-description "Large-scale health data analytics for insurance pricing"
```

### Step 2: Map Data Flows

Document all data flows including sources, processors, recipients, and cross-border transfers.
Produce a data flow diagram with trust boundaries.

### Step 3: Assess Necessity and Proportionality

Verify lawful basis, purpose limitation, data minimization, and storage limitation.

### Step 4: Identify and Score Risks

```bash
node scripts/agent.js --action risk \
  --threats '[
    {"name":"re-identification","likelihood":"possible","severity":"very-high"},
    {"name":"unauthorized disclosure","likelihood":"probable","severity":"high"},
    {"name":"function creep","likelihood":"possible","severity":"medium"}
  ]' --output /tmp/risk_assessment.json
```

### Step 5: Define Mitigations and Residual Risk

```bash
node scripts/agent.js --action generate \
  --controller "Health Analytics Inc" \
  --activity "Insurance risk scoring from health records" \
  --output /tmp/dpia_full.json
```

### Step 6: Obtain DPO Sign-Off and Document

## Verification

- [ ] All WP29 trigger criteria evaluated
- [ ] Data flow diagram produced with trust boundaries
- [ ] Lawful basis identified and documented (Art. 6/9)
- [ ] Risk assessment covers CIA threats with likelihood × severity
- [ ] Mitigations proportionate to identified risks
- [ ] Residual risk documented — prior consultation if still high (Art. 36)
- [ ] DPO opinion recorded
- [ ] DPIA reviewed before processing begins and on material change

## References

- [GDPR Article 35 — Data Protection Impact Assessment](https://gdpr-info.eu/art-35-gdpr/)
- [GDPR Article 36 — Prior Consultation](https://gdpr-info.eu/art-36-gdpr/)
- [WP29 Guidelines on DPIAs (wp248rev.01)](https://ec.europa.eu/newsroom/article29/items/611236)
- [ICO DPIA Guidance](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/data-protection-impact-assessments-dpias/)
- [CNIL PIA Tool](https://www.cnil.fr/en/open-source-pia-software-helps-carry-out-data-protection-impact-assessment)
