Use dpia

Draft a data protection impact assessment (DPIA) for one processing activity in the structure GDPR Article 35(7) requires

Draft a data protection impact assessment (DPIA) for one processing activity in the structure GDPR Article 35(7) requires — a systematic description of the processing and its purposes, necessity and proportionality, risks to the rights and freedoms of individuals, and the measures to address them — with a data inventory (categories, special category data, data subjects, sources, recipients, transfers outside the EEA, retention), the lawful basis per purpose, a likelihood × severity risk table scored for harm to people, residual risk, a view on prior consultation, and the open questions for the DPO.

Reach for it when the user needs a DPIA or PIA, is launching something that processes personal data in a new or risky way, or asks "do we need a DPIA", "write the DPIA for…", "privacy impact assessment".

Install it

npx skilldrop-cli install dpia                 # Claude Code, your user folder
npx skilldrop-cli install dpia --project       # Claude Code, this repo
npx skilldrop-cli install dpia --ide cursor    # or kiro, codex, antigravity, copilot

It is part of the Governance, risk and compliance pack: --pack grc installs it with its neighbours.

Ask for it

Say it the way you would to a colleague. Requests like these route to it:

• "Write a DPIA for our new employee location-tracking app"
• "Do we need a data protection impact assessment for using CCTV with face recognition in our stores?"
• "Draft the privacy impact assessment for the CRM migration, including the lawful basis and transfers to the US"
• "Our DPO wants a GDPR Article 35 assessment before we launch the loyalty scoring feature"

Requests like these belong to a different skill, so it shouldn't answer them:

• "Threat model the new patient portal architecture using STRIDE"
• "Write an acceptable-use policy for staff using ChatGPT and Copilot"
• "Assess the prompt-injection and tool-misuse risks of our customer support agent"

If another skill answers instead, ask for this one by name: "use dpia".

Check what you get

A good result:

• The four Article 35(7) parts are all present, in order: description and purposes, necessity and proportionality, risks to individuals, measures.
• Risks are harms to people, scored for likelihood and severity to them. No company-impact rows.
• Every purpose has its own lawful basis, and special category data has an Article 9(2) condition or an open question saying it lacks one.
• Transfers outside the EEA name the destination and the mechanism, or are marked [to confirm].
• Every unknown is visible: [to confirm] in the body and a numbered DPO question, never a guess written as fact.
• Residual risk counts only agreed measures, and the prior consultation view follows from it.
• Article numbers cited are ones the regulation actually contains for that point; when unsure, describe the requirement without a number.

See a worked example

• acme warehouse performance

Use something else when

• Security threats against a system design: use threat-model, and feed its findings into the measures section here
• Threats to an AI agent's tools and prompts: use agent-threat-model
• Rules for staff using AI tools: use ai-usage-policy
• Business risks to the company, scored for the company: use risk-register
• Mapping controls to SOC 2 audit evidence: use soc2-evidence-map

Where a loop runs it

• Stage assess of the comply loop

Next

• SKILL.md, the instructions the agent reads
• Its page on the site
• Related: agent-threat-model, ai-usage-policy, risk-register, soc2-evidence-map, threat-model

Edit this page on GitHub · View source