<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-privacy-impact-assessment
description: >-
  Conduct Privacy Impact Assessments (PIAs) and Data Protection Impact
  Assessments (DPIAs) per GDPR Art. 35, identifying privacy risks in data
  processing activities and producing structured risk assessment reports
  with mitigation recommendations.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - pia
  - dpia
  - gdpr
  - risk-assessment
  - privacy-by-design
  - art-35
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Performing Privacy Impact Assessment

## Overview

Privacy Impact Assessments (PIAs) and DPIAs (GDPR Art. 35) are mandatory for
processing likely to result in high risk to individuals. A systematic PIA
identifies privacy risks before deployment, evaluates necessity and proportionality,
and documents mitigation measures. This skill automates PIA questionnaire scoring,
risk matrix generation, and DPIA report output.

Mode: `[MODE: PRIVACY]` — Risk assessment and compliance documentation.

## Prerequisites

- Python 3.10+ with `json` module
- Data processing inventory (ROPA — GDPR Art. 30)
- Processing activity descriptions with data flow diagrams
- Legal basis documentation for each processing activity
- Access to DPO or privacy counsel for threshold assessment

## Key Concepts

### DPIA Trigger Criteria (Art. 35(3))

| Trigger | Description | Mandatory |
|---------|-------------|-----------|
| Systematic profiling | Automated decisions with legal/significant effects | Yes |
| Large-scale special categories | Processing Art. 9 data at scale | Yes |
| Public area monitoring | Systematic monitoring of publicly accessible areas | Yes |
| New technologies | Processing using innovative technology | Yes (if high risk) |
| Cross-border transfers | Transfers to inadequate jurisdictions | Risk-based |
| Vulnerable subjects | Children, employees, patients | Risk-based |

### Risk Scoring Matrix

```python
LIKELIHOOD_SCORES = {
    "negligible": 1, "limited": 2, "significant": 3, "maximum": 4,
}
SEVERITY_SCORES = {
    "negligible": 1, "limited": 2, "significant": 3, "maximum": 4,
}
# Risk = Likelihood x Severity
# 1-4: Low | 5-8: Medium | 9-12: High | 13-16: Critical
```

### Scanning CLI

```bash
# Run DPIA threshold assessment
node scripts/agent.js --action threshold \
  --processing "automated credit scoring with profiling"

# Perform full risk assessment
node scripts/agent.js --action assess \
  --processing "employee health monitoring" \
  --data-subjects "employees" --data-types "health,biometric"

# Generate DPIA report
node scripts/agent.js --action report \
  --assessment /tmp/dpia_assessment.json
```

## Workflow

### Step 1: Threshold Assessment

```bash
node scripts/agent.js --action threshold \
  --processing "automated credit scoring with profiling"
```

### Step 2: Risk Identification

```bash
node scripts/agent.js --action assess \
  --processing "employee health monitoring" \
  --data-subjects "employees" --data-types "health,biometric"
```

### Step 3: Generate DPIA Report

```bash
node scripts/agent.js --action report --assessment /tmp/dpia_assessment.json
```

### Step 4: Review and Consultation

Submit DPIA to DPO for review. If residual risk remains high after
mitigations, consult supervisory authority per GDPR Art. 36.

## Verification

- [ ] DPIA threshold assessment completed for processing activity
- [ ] All processing purposes documented with legal basis
- [ ] Data flow diagram reviewed and accurate
- [ ] Risk matrix populated with likelihood and severity scores
- [ ] Mitigation measures documented for each identified risk
- [ ] DPO consultation completed and documented
- [ ] Residual risk assessed after mitigations applied
- [ ] DPIA report archived per Art. 5(2) accountability

## References

- [GDPR Article 35 — Data Protection Impact Assessment](https://gdpr-info.eu/art-35-gdpr/)
- [GDPR Article 36 — Prior Consultation](https://gdpr-info.eu/art-36-gdpr/)
- [EDPB Guidelines on DPIA (wp248rev.01)](https://ec.europa.eu/newsroom/article29/items/611236)
- [ICO DPIA Guidance](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/data-protection-impact-assessments-dpias/)
- [CNIL PIA Tool](https://www.cnil.fr/en/privacy-impact-assessment-pia)
