Skip to content
cccskills
FreePublished on GitHub

dpia-risk-scoring

Provides a structured risk scoring methodology for Data Protection Impact Assessments aligned with ENISA threat taxonomy and ISO 29134. Covers likelihood and severity assessment, risk matrix construction, inherent vs residual risk calculation, and risk appetite thresholds per EDPB WP248rev.01 guidance. Keywords: risk scoring, DPIA risk matrix, likelihood, severity, ENISA, ISO 29134, residual risk, risk appetite.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills

Run score Not tested

See how to install

Files included (5)

  • SKILL.md4.0 KB
  • assets/template.md8.0 KB
  • references/standards.md3.5 KB
  • references/workflows.md2.8 KB
  • scripts/process.py15.2 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

DPIA Risk Scoring Methodology

Overview

Art. 35(7)(c) GDPR requires a DPIA to include "an assessment of the risks to the rights and freedoms of data subjects." This skill provides a quantifiable risk scoring framework that converts qualitative privacy risks into comparable, prioritised scores supporting mitigation decisions.

Risk Scoring Framework

Severity Scale (Impact on Data Subject Rights)

LevelScoreDescriptionExamples
Negligible1Minor inconvenience, easily recoverableTemporary inability to access non-essential service
Limited2Significant inconvenience, recoverable with effortTargeted advertising based on inferred preferences
Significant3Serious consequences, difficult to recover fromFinancial loss, discrimination, reputational harm
Maximum4Irreversible or very difficult to recover fromIdentity theft, physical safety risk, loss of employment

Likelihood Scale

LevelScoreDescriptionIndicators
Negligible1Unlikely given current controlsStrong technical controls, limited access, encrypted at rest and in transit
Limited2Possible but requires specific conditionsSome access controls, partial encryption, known but unproven attack vectors
Significant3Probable given known threat landscapeWeak controls in specific areas, prior incidents in sector, active threat actors
Maximum4Near-certain or already occurringNo controls, known vulnerabilities, prior breach of similar system

Risk Matrix

Severity →    Negligible(1)  Limited(2)  Significant(3)  Maximum(4)
Likelihood ↓
Maximum(4)        4(M)         8(H)        12(VH)         16(VH)
Significant(3)    3(L)         6(M)         9(H)          12(VH)
Limited(2)        2(L)         4(M)         6(M)           8(H)
Negligible(1)     1(L)         2(L)         3(L)           4(M)

Risk Levels: L=Low(1-3), M=Medium(4-6), H=High(7-9), VH=Very High(10-16)

Risk Categories (ENISA-Aligned)

Rights and Freedoms Impacts

  1. Loss of confidentiality -- Unauthorised disclosure of personal data
  2. Loss of integrity -- Unauthorised modification of personal data
  3. Loss of availability -- Inability to access or use personal data
  4. Loss of purpose limitation -- Data used beyond original purpose
  5. Discrimination -- Unfair treatment based on processing outcomes
  6. Identity theft/fraud -- Misuse of personal data for impersonation
  7. Financial loss -- Direct or indirect monetary harm
  8. Reputational damage -- Social standing or professional harm
  9. Physical harm -- Safety or health impacts
  10. Loss of autonomy -- Chilling effects on behaviour or free expression

Inherent vs Residual Risk

  • Inherent risk: Risk level before applying any mitigation measures
  • Residual risk: Risk level after applying planned mitigation measures
  • Risk reduction: Difference between inherent and residual risk scores
  • Acceptable risk threshold: Organisation-defined tolerance level

Art. 36 Prior Consultation Trigger

When residual risk remains High or Very High after all feasible mitigation measures, the controller must consult the supervisory authority under Art. 36(1) before commencing processing.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

42-cfr-part-2

Free

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

adequacy-assessment

Free

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-gating-services

Free

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-verification-methods

Free

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-act-high-risk-docs

Free

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-automated-decisions

Free

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

See all skills by mukul975

Report a problem with this skill