Conduct Privacy Impact Assessments

This skill conducts systematic Privacy Impact Assessments (PIAs) aligned with GDPR, CCPA, PIPEDA, and other privacy frameworks. The core framework covers six components: data flow analysis (mapping the full lifecycle from collection to disposal), legal basis evaluation, a quantified risk assessment matrix, stakeholder impact analysis, mitigation strategy development, and compliance gap analysis. PIA triggering criteria flag when an assessment is required - high-risk automated decision-making or profiling, large-scale special-category data processing, systematic public monitoring, novel technologies, third-country transfers, or processing affecting vulnerable populations.

Risk scoring multiplies a 1-5 likelihood scale (from "very unlikely" under 10% to "very likely" over 80%) by a 1-5 impact scale (from minimal inconvenience to catastrophic widespread harm) to produce a risk level. Data is classified into five sensitivity tiers from Public through Special Category (genetic data, political opinions, sexual orientation), each with a numeric sensitivity level.

Risk Level = Likelihood x Impact
Likelihood: 1 (Very Unlikely <10%) to 5 (Very Likely >80%)
Impact: 1 (Minimal) to 5 (Catastrophic)

GDPR-specific assessment follows Article 35 DPIA requirements - systematic processing description, necessity/proportionality assessment, risk identification against data subject rights, mitigation measures, DPO consultation, and data subject consultation. A lawful-basis evaluation function maps GDPR Article 6 bases (consent, contract, legal obligation, legitimate interests) to their specific requirements, revocability, and typical use cases. Technical privacy controls are assessed against a structured checklist covering data minimization, anonymization techniques (k-anonymity, differential privacy, pseudonymization), access controls, and encryption at rest/in transit. Documentation follows an executive-summary template capturing risk rating, key findings, processing overview, legal basis, retention, and third-party sharing. Stakeholder consultation covers methods (surveys, focus groups, public consultations, advocacy group input) with a structured record format capturing participant counts, key concerns raised, and how feedback was incorporated into the final design. Ongoing monitoring defines a review cadence (annual, change-triggered, post-incident, regulatory-update-triggered, technology-change-triggered) and KPIs tracking PIA completion rate, review timeliness, risk reduction, compliance gaps, and stakeholder satisfaction. Best practices emphasize early integration during system design, cross-functional teams, living documentation, executive support, and embedded tooling, while flagging pitfalls like late-stage PIAs, underestimated impact severity, incomplete processing inventories, and treating PIA as a one-time exercise.

Use this skill when a new system, feature, or data processing activity triggers privacy risk - conducting a structured PIA/DPIA, scoring privacy risks, evaluating lawful basis for processing, assessing technical privacy controls, or documenting stakeholder consultation for compliance.

It is not the right fit for processing activities with no elevated privacy risk (routine, low-sensitivity data handling already covered by existing assessments), or for general security risk assessment unrelated to personal data processing, which needs a broader security framework rather than a privacy-specific PIA.

Input: the system or processing activity's data flows, the personal data categories involved, and the applicable regulatory framework (GDPR, CCPA, etc.). Output: a completed PIA/DPIA with data flow mapping, a scored risk assessment, lawful basis determination, a technical controls checklist, an executive summary document, stakeholder consultation records, and an ongoing review schedule with tracked KPIs.

References GDPR Article 6/35 as the primary regulatory anchor, with technical control implementation covering encryption standards (AES-256, TLS 1.3) and anonymization techniques, designed to integrate into development workflows for early-stage privacy-by-design assessment.

Privacy, legal, and compliance teams conducting Privacy Impact Assessments for new systems or data processing activities - particularly those needing GDPR Article 35-compliant DPIAs, quantified risk scoring, and documented stakeholder consultation.