<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-privacy-governance-assessment
description: >-
  Conduct comprehensive privacy governance assessments including Data Protection Impact Assessments (DPIAs), Records of Processing Activities (RoPA), data flow mapping, lawful basis evaluation, and cross-border transfer mechanism analysis. Covers GDPR, CCPA/CPRA, HIPAA, and emerging global privacy regulations.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - privacy-governance
  - DPIA
  - RoPA
  - GDPR
  - CCPA
  - data-protection
  - cross-border-transfers
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "ID.GV-3"
  - "PR.DS-1"
  - "PR.DS-2"
  - "PR.IP-6"
  - "PR.PT-2"
  frameworks:
  - "GDPR"
  - "CCPA/CPRA"
  - "HIPAA"
  - "NIST Privacy Framework"
  - "ISO 27701"
  mitre-attack: []
---

# Performing Privacy Governance Assessment

## Overview

Privacy governance assessment systematically evaluates an organization's data
protection posture against regulatory requirements. It maps data flows, identifies
processing activities, evaluates lawful bases, assesses cross-border transfer
mechanisms, and produces DPIAs for high-risk processing operations.

## Workflow

1. **Data Inventory** — Catalog all personal data processing activities with data categories and subjects
2. **Data Flow Mapping** — Trace personal data from collection through processing, storage, sharing, and deletion
3. **Lawful Basis Evaluation** — Assess legal basis for each processing activity (consent, contract, legitimate interest, etc.)
4. **DPIA Execution** — Conduct Data Protection Impact Assessments for high-risk processing activities
5. **RoPA Generation** — Compile Records of Processing Activities per GDPR Article 30 requirements
6. **Cross-Border Analysis** — Evaluate international transfer mechanisms (SCCs, adequacy, BCRs)
7. **Rights Fulfillment Audit** — Verify data subject rights processes (access, deletion, portability, objection)
8. **Gap Remediation** — Prioritize findings and track remediation with regulatory deadline alignment

## Key Concepts

### GDPR Lawful Bases (Article 6)

| Basis | Description | Documentation Required |
|-------|-------------|----------------------|
| Consent (6.1.a) | Freely given, specific, informed, unambiguous | Consent records, withdrawal mechanism |
| Contract (6.1.b) | Necessary for contract performance | Contract reference, necessity analysis |
| Legal Obligation (6.1.c) | Required by law | Legal citation, regulatory mandate |
| Vital Interests (6.1.d) | Protect life of data subject | Emergency documentation |
| Public Task (6.1.e) | Official authority or public interest | Authority mandate documentation |
| Legitimate Interest (6.1.f) | Balancing test required | LIA documentation, opt-out mechanism |

### DPIA Threshold Criteria (Article 35)

| Criterion | Example | DPIA Required |
|-----------|---------|---------------|
| Systematic monitoring | Employee surveillance, CCTV | Yes |
| Large-scale special category | Health records processing | Yes |
| Automated decision-making | Credit scoring, profiling | Yes |
| New technologies | Biometric identification | Yes |
| Cross-border processing | EU-US data transfers | Likely |
| Vulnerable subjects | Children, patients, employees | Likely |

### Cross-Border Transfer Mechanisms

| Mechanism | GDPR Article | Status |
|-----------|-------------|--------|
| Adequacy Decision | Art. 45 | Country-specific |
| Standard Contractual Clauses | Art. 46.2.c | Updated June 2021 |
| Binding Corporate Rules | Art. 47 | DPA approval required |
| Derogations | Art. 49 | Limited use only |
| EU-US Data Privacy Framework | Art. 45 | Adopted July 2023 |

## Detection Opportunities

### Privacy Governance Red Flags

- **Undocumented processing**: personal data processed without RoPA entry or lawful basis
- **Consent dark patterns**: pre-checked boxes, bundled consent, no withdrawal mechanism
- **Stale DPIAs**: high-risk processing without current impact assessment
- **Transfer mechanism gaps**: cross-border flows without valid legal mechanism
- **MITRE mapping**: T1530 (Data from Cloud Storage), T1567 (Exfiltration Over Web Service), T1213 (Data from Information Repositories)


