Skip to content
cccskills
FreePublished on GitHub

pia-threshold-screening

Conducts pre-DPIA threshold screening to determine whether a full Data Protection Impact Assessment is required under GDPR Article 35. Applies the EDPB WP248rev.01 nine-criteria test, national supervisory authority blacklists, and organisational risk appetite to produce a documented screening decision. Keywords: threshold screening, DPIA trigger, pre-DPIA, WP248, Article 35(1), blacklist, screening decision.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills

Run score Not tested

See how to install

Files included (5)

  • SKILL.md3.4 KB
  • assets/template.md6.4 KB
  • references/standards.md3.5 KB
  • references/workflows.md3.1 KB
  • scripts/process.py12.3 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

PIA Threshold Screening

Overview

Article 35(1) GDPR requires a DPIA when processing is "likely to result in a high risk to the rights and freedoms of natural persons." This skill provides a structured screening methodology to make that determination before committing to a full DPIA.

Screening Criteria

EDPB Nine-Criteria Test (WP248rev.01)

Processing that meets two or more of the following criteria generally requires a DPIA:

#CriterionGDPR Reference
1Evaluation or scoringArt. 35(3)(a)
2Automated decision-making with legal/similar effectArt. 35(3)(a)
3Systematic monitoringArt. 35(3)(c)
4Sensitive data or data of highly personal natureArt. 9, Art. 10
5Data processed on a large scaleRecital 91
6Matching or combining datasetsWP248
7Data concerning vulnerable data subjectsWP248
8Innovative use or applying new technological solutionsWP248
9Processing that prevents data subjects from exercising a rightArt. 22, Art. 35(3)(b)

Mandatory DPIA Triggers (Art. 35(3))

A DPIA is always required for:

  • (a) Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, producing legal effects or similarly significant effects
  • (b) Large-scale processing of special categories of data (Art. 9(1)) or criminal conviction data (Art. 10)
  • (c) Systematic monitoring of a publicly accessible area on a large scale

National Supervisory Authority Blacklists (Art. 35(4))

Each EU/EEA supervisory authority publishes a list of processing operations requiring a DPIA. The screening must check the relevant national blacklist based on the controller establishment.

Screening Process

  1. Identify processing activity -- Describe the proposed or changed processing
  2. Check mandatory triggers -- Evaluate against Art. 35(3)(a)-(c)
  3. Check national blacklist -- Consult the relevant SA published list
  4. Apply nine-criteria test -- Score each WP248 criterion as met/not met
  5. Document rationale -- Record the screening decision with justification
  6. Escalate or close -- Route to full DPIA or document exemption

Decision Logic

IF any Art. 35(3) mandatory trigger is met → DPIA REQUIRED
ELSE IF processing appears on national SA blacklist → DPIA REQUIRED
ELSE IF 2+ WP248 criteria are met → DPIA REQUIRED
ELSE IF 1 WP248 criterion is met → DPIA RECOMMENDED (risk-based decision)
ELSE → DPIA NOT REQUIRED (document exemption)

Integration Points

  • RoPA linkage: Screening results attach to the corresponding RoPA entry
  • Change management: New processing or material changes trigger re-screening
  • DPIA register: Positive screening decisions feed the DPIA pipeline

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

42-cfr-part-2

Free

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

adequacy-assessment

Free

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-gating-services

Free

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-verification-methods

Free

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-act-high-risk-docs

Free

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-automated-decisions

Free

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

See all skills by mukul975

Report a problem with this skill