<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# DPIA Assessment — API Reference

## DPIA Trigger Assessment

```bash
# Assess WP29 trigger criteria
node scripts/agent.js --action triggers \
  --processing-description "DESCRIPTION"

# Example: employee monitoring
node scripts/agent.js --action triggers \
  --processing-description "Large-scale employee monitoring via keylogger with automated scoring"
```

## Risk Assessment

```bash
# Score threats against risk matrix
node scripts/agent.js --action risk \
  --threats '[{"name":"THREAT","likelihood":"remote|possible|probable","severity":"low|medium|high|very-high"}]'

# Example: multiple threats
node scripts/agent.js --action risk \
  --threats '[
    {"name":"re-identification","likelihood":"possible","severity":"very-high"},
    {"name":"unauthorized disclosure","likelihood":"probable","severity":"high"}
  ]' --output /tmp/risk_assessment.json
```

## DPIA Report Generation

```bash
# Generate structured DPIA template
node scripts/agent.js --action generate \
  --controller "CONTROLLER_NAME" \
  --activity "PROCESSING_ACTIVITY" \
  --output /tmp/dpia_report.json
```

## WP29 Trigger Criteria

| # | Criterion | Keyword Triggers |
|---|-----------|-----------------|
| 1 | Evaluation/scoring | profiling, scoring |
| 2 | Automated decisions | automated decision |
| 3 | Systematic monitoring | systematic monitoring, surveillance |
| 4 | Sensitive data | health, biometric, genetic, racial, political |
| 5 | Large scale | large-scale, large scale |
| 6 | Dataset combining | combining, matching |
| 7 | Vulnerable subjects | children, employee, patient, vulnerable |
| 8 | New technology | innovative, new technology |
| 9 | Cross-border transfer | cross-border, transfer |
| 10 | Rights prevention | prevent, restrict |

## Risk Matrix

| Likelihood \ Severity | Low | Medium | High | Very High |
|----------------------|-----|--------|------|-----------|
| Remote | LOW | LOW | MEDIUM | MEDIUM |
| Possible | LOW | MEDIUM | HIGH | HIGH |
| Probable | MEDIUM | HIGH | VERY HIGH | VERY HIGH |

## GDPR Article References

| Article | Topic |
|---------|-------|
| Art. 35(1) | DPIA requirement for high-risk processing |
| Art. 35(3) | Mandatory DPIA scenarios |
| Art. 35(7) | Minimum DPIA content |
| Art. 36 | Prior consultation with supervisory authority |
| Art. 35(11) | Review requirement on processing changes |
