Agent skill · research science · borghei
dpia-assessment
GDPR Art. 35 Data Protection Impact Assessment with threshold checking, risk registers, and EDPB criteria scoring. Use for DPIA evaluations.
Why this skill is useful
Provides specific tools and scripts for conducting GDPR-compliant Data Protection Impact Assessments that the AI wouldn't reliably generate on its own.
What it needs
Requires python installed locally. About 9k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
⚠️ EXPERIMENTAL — This skill is provided for educational and informational purposes only. It does NOT constitute legal advice. All responsibility for usage rests with the user. Consult qualified legal professionals before acting on any output. DPIA Assessment GDPR Article 35 Data Protection Impact Assessment tooling. Evaluates whether a DPIA is required, manages risk registers with mitigation tracking, and generates documentation meeting supervisory authority expectations. --- Table of Contents Tools DPIA Threshold Checker DPIA Risk Register Reference Guides Workflows Legal Precision Points Output Formats Troubleshooting Success Criteria Scope & Limitations Anti-Patterns Tool Reference --- Clarify First Before the assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume: [ ] Processing activity description — purpose, data types, automation level, scale — drives the Art. 35(3) trigger matches and EDPB criteria scoring (the whole verdict) [ ] Special-category data + scale — determines the Art. 35(3)(b) trigger, the Art. 9 cumulative-basis requirement, and the large-scale four-factor test [ ] Jurisdiction(s) — which national blacklists apply (DE/FR/IE/BE/NL/IT/PL); the most restrictive governs [ ] Whether an AI system is involved — triggers dual-phase (training/inference) analysis per EDPB Opinion 28/2024 and the separate FRIA distinction Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the assessment. Tools DPIA Threshold Checker Evaluates whether a DPIA is required based on processing activity description. Checks Art. 35(3) mandatory triggers and 9 EDPB criteria. Checks performed: Art. 35(3)(a): Automated decision-making with legal/significant effect Art. 35(3)(b): Large-scale processing of special category data (Art. 9) or criminal data (Art. 10) Art. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/dpia-assessment