Skip to content
cccskills
FreePublished on GitHub

dpia-mitigation-plan

Structures risk mitigation planning and residual risk tracking for Data Protection Impact Assessments under GDPR Article 35(7)(d). Covers mitigation measure identification, implementation tracking, residual risk acceptance, and Art. 36 prior consultation triggers. Keywords: DPIA mitigation, risk treatment, residual risk, Art. 35(7)(d), safeguards, mitigation tracking, prior consultation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills
See how to install

Files included (5)

  • SKILL.md3.3 KB
  • assets/template.md7.9 KB
  • references/standards.md3.3 KB
  • references/workflows.md3.1 KB
  • scripts/process.py12.2 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

DPIA Mitigation Planning

Overview

Article 35(7)(d) GDPR requires a DPIA to include "the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation." This skill provides a structured mitigation planning framework.

Mitigation Strategy Categories

Technical Measures

CategoryExamplesGDPR Reference
EncryptionAt-rest, in-transit, end-to-endArt. 32(1)(a)
PseudonymisationTokenisation, hashing, key-codedArt. 25(1), Art. 32(1)(a)
Access controlsRBAC, MFA, privileged access managementArt. 32(1)(b)
Data minimisationField-level reduction, aggregation, samplingArt. 5(1)(c), Art. 25(1)
Anonymisationk-anonymity, differential privacy, generalisationRecital 26
MonitoringSIEM, DLP, anomaly detectionArt. 32(1)(d)

Organisational Measures

CategoryExamplesGDPR Reference
PoliciesData protection policy, acceptable useArt. 24(2)
TrainingPrivacy awareness, role-specific trainingArt. 39(1)(b)
ContractsDPAs, joint controller arrangements, NDAsArt. 28, Art. 26
AuditsInternal audits, processor audits, certificationArt. 28(3)(h)
GovernanceDPO oversight, privacy committee, RACIArt. 37-39
Incident responseBreach procedures, notification protocolsArt. 33-34

Mitigation Plan Structure

For each identified risk:

  1. Risk reference -- Link to DPIA risk register entry
  2. Inherent risk level -- Before mitigation
  3. Proposed measures -- Specific technical and organisational controls
  4. Implementation owner -- Accountable person
  5. Implementation deadline -- Target completion date
  6. Verification method -- How effectiveness will be confirmed
  7. Residual risk level -- After planned mitigation
  8. Acceptance decision -- Within appetite / escalation required / prior consultation

Residual Risk Decision Framework

Residual Risk LOW → Accept; document; routine monitoring
Residual Risk MEDIUM → Accept with enhanced monitoring; annual review
Residual Risk HIGH → Escalate to senior management; consider additional measures
Residual Risk VERY HIGH → Art. 36 prior consultation required before processing

Implementation Tracking

Each mitigation measure progresses through:

  • Proposed -- Identified but not yet approved
  • Approved -- Budget and resources allocated
  • In Progress -- Implementation underway
  • Implemented -- Deployed and operational
  • Verified -- Effectiveness confirmed through testing

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

42-cfr-part-2

Free

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills316Updated Mar 17, 2026

adequacy-assessment

Free

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills316Updated Mar 17, 2026

age-gating-services

Free

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills316Updated Mar 17, 2026

age-verification-methods

Free

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills316Updated Mar 17, 2026

ai-act-high-risk-docs

Free

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills316Updated Mar 17, 2026

ai-automated-decisions

Free

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills316Updated Mar 17, 2026

See all skills by mukul975

Report a problem with this skill