Automates the Privacy Impact Assessment (PIA) workflow including data flow mapping, privacy risk scoring matrices, GDPR Article 35 DPIA and CCPA/CPRA alignment checks, data inventory cataloging, and remediation tracking. Implements the NIST Privacy Framework PRAM methodology and ICO DPIA guidance for systematic identification and mitigation of privacy risks across processing activities. Use when conducting privacy assessments for new systems, evaluating regulatory compliance posture, or building automated privacy governance programs.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Automates the Privacy Impact Assessment (PIA) workflow including data flow mapping, privacy risk scoring matrices, GDPR Article 35 DPIA and CCPA/CPRA alignment checks, data inventory cataloging, and remediation tracking. Implements the NIST Privacy Framework PRAM methodology and ICO DPIA guidance for systematic identification and mitigation of privacy risks across processing activities. Use when conducting privacy assessments for new systems, evaluating regulatory compliance posture, or building automated privacy governance programs.
When launching a new system, product, or processing activity that handles personal data
When conducting GDPR Article 35 Data Protection Impact Assessments (DPIAs)
When evaluating CCPA/CPRA compliance for data processing operations
When performing privacy risk assessments aligned to the NIST Privacy Framework
When mapping data flows across organizational boundaries and third-party processors
When building automated privacy governance and assessment pipelines
When preparing for regulatory audits or demonstrating accountability obligations
Coverage Gaps & Validation
PIAs/DPIAs most often understate risk because the data-flow map is incomplete
or the risk ratings are self-attested with no evidence behind them:
Missing data flows: the assessment captures the happy-path collection and
storage but omits backups, replicas, analytics exports, log pipelines, and
the sharing leg to third-party/sub-processors. Validate the flow map against
actual egress logs and the Art. 30 RoPA, not just the system diagram.
Third parties and sub-processor chains skipped: a processor is listed but
its own sub-processors (and their transfer destinations) are not. Confirm DPAs
and a current sub-processor list exist for every external recipient.
Cross-border transfers unsupported: transfers to non-adequate regions are
noted but the safeguard (SCCs + transfer impact assessment) is absent or
stale. Trace the real storage/processing region, not the contract.
Screening gaps (Art. 35 triggers): large-scale, systematic-monitoring, or
special-category processing slips through as "no DPIA required." Re-run the
ICO screening checklist against the actual data categories.
Self-attested risk scores: likelihood/impact ratings recorded without
evidence. Validate high-maturity claims with control test output or metrics,
and confirm remediation items have owners and dates before sign-off.
Prerequisites
Familiarity with GDPR, CCPA/CPRA, and NIST Privacy Framework concepts
Access to data processing inventories and system architecture documentation
Python 3.8+ with required dependencies installed
Appropriate authorization from the Data Protection Officer (DPO) or privacy team
Knowledge of organizational data flows and third-party processor relationships
Instructions
Phase 1: Data Inventory and Processing Activity Catalog
Build a complete inventory of personal data processing activities. Each record of
processing activity (ROPA) entry must capture the data categories, legal basis,
retention periods, and data subjects involved.
from agent import PrivacyImpactAssessmentEngine
engine = PrivacyImpactAssessmentEngine()
# Register a processing activity for assessment
activity = engine.register_processing_activity(
name="Customer Analytics Platform",
description="Collects browsing behavior and purchase history for personalization",
data_controller="Acme Corp",
data_processor="CloudAnalytics Inc",
data_categories=["browsing_history", "purchase_records", "ip_address", "device_id"],
data_subjects=["customers", "website_visitors"],
legal_basis="consent",
retention_period_days=730,
cross_border_transfer=True,
transfer_destinations=["US", "IN"],
automated_decision_making=True,
)
print(f"Registered activity: {activity['activity_id']}")
Phase 2: Data Flow Mapping
Map all data flows from collection to deletion, identifying every touchpoint,
transformation, and storage location. This reveals hidden privacy risks in data
movement across systems.
Phase 3: Privacy Risk Assessment with Scoring Matrix
Apply a structured risk scoring methodology evaluating likelihood and impact
across multiple privacy risk dimensions. The matrix aligns with both the
NIST PRAM and ICO DPIA risk assessment approaches.
Retention -- Storing data beyond necessity or legal requirement
Consent Management -- Invalid or ambiguous consent mechanisms
Breach Notification -- Inability to detect and notify within 72 hours (GDPR)
Phase 4: GDPR and CCPA/CPRA Alignment Checks
Run automated compliance checks against specific regulatory requirements.
The engine maps each processing activity against article-level GDPR obligations
and CCPA/CPRA consumer rights requirements.
# GDPR compliance check
gdpr_report = engine.check_gdpr_compliance(activity_id=activity["activity_id"])
print(f"GDPR Score: {gdpr_report['compliance_score']}/100")
for finding in gdpr_report["findings"]:
print(f" [{finding['status']}] Art.{finding['article']}: {finding['description']}")
# CCPA/CPRA compliance check
ccpa_report = engine.check_ccpa_compliance(activity_id=activity["activity_id"])
print(f"CCPA Score: {ccpa_report['compliance_score']}/100")
for finding in ccpa_report["findings"]:
print(f" [{finding['status']}] Sec.{finding['section']}: {finding['description']}")
Phase 5: Remediation Plan and Report Generation
Generate a prioritized remediation plan with specific action items, responsible
parties, deadlines, and generate the formal PIA/DPIA report document.
