dpia-generator

name	dpia-generator
description	Use when producing or reviewing a Data Protection Impact Assessment (DPIA) for a new feature or for Uganda DPPA-regulated, large-scale, sensitive, monitored, or high-risk personal-data processing.
metadata	{"compatibility_notes":"Uganda-based systems requiring DPPA 2019 compliance","portable":true,"compatible_with":["claude-code","codex"]}

Skill: DPIA Generator (Uganda DPPA 2019)

Acknowledgement: Shared by Peter Bamuhigire, techguypeter.com, [phone].

Use When

• Generate Uganda DPPA 2019-compliant DPIA documents. Use when uganda-dppa-compliance flags [DPIA-REQUIRED] or when processing large-scale personal data.

Evidence Produced

Category	Artifact	Format	Example
Data safety	Data Protection Impact Assessment	Markdown doc covering lawful basis, data flows, risks, and mitigations	docs/compliance/dpia-customer-onboarding.md
Data safety	PII / retention register	Markdown doc mapping personal data fields to basis and retention window	docs/compliance/pii-retention-register.md

References

• Use the links and companion skills already referenced in this file when deeper context is needed.

Purpose

Generate a Uganda Data Protection and Privacy Act 2019 — compliant Data Protection Impact Assessment (DPIA) document for a specific processing operation that has been flagged with [DPIA-REQUIRED]. Implements Regulation 12 of the Data Protection and Privacy Regulations 2021.

Use this skill when:

• The uganda-dppa-compliance skill has flagged [DPIA-REQUIRED: <reason>] for a processing operation
• The consultant is preparing for Phase 3 go-live involving farmer personal data
• Any new processing feature involves large-scale, systematic, or special personal data collection
• A PDPO auditor requests a DPIA on file

---

Inputs Required

Before invoking this skill, read:

• _context/vision.md — system scope
• _context/features.md — the specific processing operation being assessed
• _context/personas.md — data subjects affected
• _context/gap-analysis.md — open privacy gaps
• The specific [DPIA-REQUIRED] flag text and its context in the originating document
• domains/uganda/references/dppa-pii-classification.md — PII classification matrix

Ask the consultant to identify: Which processing operation is being assessed? (e.g., "bulk collection of farmer NIN, GPS, photo, and mobile money number during cooperative registration")

---

DPIA Structure (Regulation 12)

Section 1 — Processing Operation Description

1.1 Operation name and purpose Name the specific processing operation. State its purpose. Cite the module and FR identifiers.

1.2 Data controller and DPO Name the data controller (organisation), designated DPO, and PDPO registration number.

1.3 Categories of data subjects Describe who is affected: number of individuals, demographics, vulnerability factors (e.g., rural smallholder farmers with limited digital literacy).

1.4 Data categories collected List every field. Classify each as S (special personal data), P (personal data), or N (non-personal). For S-tier fields, cite the Section 9 category.

Field	Tier	Section 9 Category	Volume
Mobile money number	S	Financial information	6,440+
NIN	P	Identification number	6,440+
GPS farm coordinates	P	Location/identity	6,440+
Photograph	P	Identity data	6,440+

1.5 Processing activities Describe what happens to the data: collection, storage, use, disclosure, retention, destruction.

1.6 Lawful basis For each data category, cite the applicable Section 7 lawful basis.

1.7 Data processors involved List any third parties processing data (MTN MoMo, Airtel, NIRA, etc.) and confirm written contracts exist per Section 21.

1.8 Cross-border transfer State whether data is processed or stored outside Uganda. If yes, document adequacy or consent.

---

Section 2 — Necessity and Proportionality Assessment

2.1 Necessity Is the data collection necessary for the stated purpose? Could the purpose be achieved with less data or less intrusive means?

2.2 Proportionality Is the scope of collection proportionate to the legitimate purpose?

2.3 Data minimisation Confirm that only the minimum necessary data is collected. Flag any field that is not strictly necessary.

2.4 Purpose limitation Confirm data will not be used for purposes incompatible with the original purpose (Section 17). State research/statistical exceptions if applicable (must not reveal identity).

2.5 Storage limitation State the retention period and destruction method at expiry.

---

Section 3 — Risk Assessment

Identify and rate each risk using the matrix below.

Risk Rating Matrix:

Likelihood	Low Impact	Medium Impact	High Impact
Unlikely	Low	Low	Medium
Possible	Low	Medium	High
Likely	Medium	High	Critical

Risk categories to assess:

#	Risk	Description	Likelihood	Impact	Rating
R-1	Unauthorised access to S-tier financial data	Mobile money numbers accessed by unauthorised staff
R-2	GPS data misuse	Farm location data enables physical targeting of farmers
R-3	NIN data breach	Mass NIN exposure creates identity fraud risk
R-4	Consent not obtained	Data collected without valid consent; PDPO enforcement risk
R-5	Data shared with unauthorised third parties	Farmer data disclosed outside permitted recipients
R-6	Breach not notified immediately	PDPO notification delayed; criminal liability for DPO
R-7	Data retained beyond retention period	Historical data not destroyed; creates ongoing liability
R-8	Children's data collected without guardian consent	Farmers under 18 registered without parental consent
R-9	Cross-border storage	Cloud backup transfers data outside Uganda without adequacy or consent
R-10	Data subject rights not fulfilled	Requests not responded to within 30 days

Add system-specific risks based on the processing operation being assessed.

---

Section 4 — Measures to Address Risks

For each risk rated Medium, High, or Critical, specify the control measure:

Risk #	Control Measure	FR/NFR Reference	Owner	Status
R-1	AES-256-GCM encryption + role-based access + access logging	NFR-DPPA-002	Dev Lead	Planned
R-2	GPS stored encrypted; access restricted to Procurement/Finance	NFR-FAR-001	Dev Lead	Planned
R-3	NIN encrypted + masked in display; NIRA validation only via API	NFR-DPPA-002	Dev Lead	Planned
R-4	Consent capture FR at farmer registration; consent record persisted	FR-FAR-xxx	Dev Lead	Planned
R-5	API-layer RBAC; data processor contracts signed	NFR-DPPA-005	Legal	Pending
R-6	Breach notification workflow; DPO dashboard alert; auto-generates PDPO notification form	NFR-DPPA-005	Dev Lead	Planned
R-7	Retention schedule enforced; DPO expiry alert; destruction audit log	NFR-DPPA-006	Dev Lead	Planned
R-8	Age verification step in registration; parent/guardian consent prompt for under-18	FR-FAR-xxx	Dev Lead	Planned
R-9	On-premise only; no cloud backup outside Uganda; server location documented	NFR-DPPA-010	BIRDC IT	Pending
R-10	Data subject rights log; 30-day DPO dashboard alert	NFR-DPPA-004	Dev Lead	Planned

---

Section 5 — Residual Risk Assessment

After controls: rate residual risk for each item. If any residual risk remains High or Critical, escalate to PDPO consultation (Regulation 12 — high residual risk requires PDPO prior consultation).

---

Section 6 — PDPO Consultation Determination

If any processing operation carries residual high risk that cannot be mitigated internally:

• Consult the PDPO before commencing processing
• Document the consultation outcome
• Obtain PDPO guidance in writing

---

Section 7 — Sign-off

Role	Name	Date	Signature
Data Protection Officer
Consultant / System Architect	Peter Bamuhigire
Client Authorising Officer

---

Output Format

Generate a .md file in projects/<ProjectName>/09-governance-compliance/dpia/DPIA_<OperationName>_<ProjectName>.md covering all 7 sections above.

Build to .docx using: bash scripts/build-doc.sh projects/<ProjectName>/09-governance-compliance/dpia DPIA_<OperationName>_<ProjectName>

---

Validation Checklist

Before marking this skill complete:

• Every S-tier field has an explicit control measure
• No residual risk is rated Critical without PDPO consultation recommendation
• Retention period is specified for every data category
• Children's data assessed
• Cross-border transfer status confirmed
• Sign-off table populated (roles at minimum; names/dates pending client)
• [CONTEXT-GAP: GAP-004] retained if legal review not yet complete

---

References

• Data Protection and Privacy Act 2019 (No. 9 of 2019) — Section 23 (breach), Section 9 (special data)
• Data Protection and Privacy Regulations 2021 — Regulation 12 (DPIA), Regulation 33 (breach notification)
• domains/uganda/references/regulations.md
• domains/uganda/references/dppa-pii-classification.md
• uganda-dppa-compliance/SKILL.md — prerequisite skill

Capability contract

Default to read-only access to requirements, data flows, vendors, controls, and policies. Network research is required only for current law or regulator guidance; implementation edits need separate authority.

Degraded mode

Fallback when data flows, retention, vendors, or controls are unknown: issue a draft marked incomplete and list the evidence required before approval.

Decision rules

Processing condition	DPIA decision	Action
Sensitive, systematic, large-scale, or high-impact processing	required	Complete assessment before launch
Material uncertainty about harm or lawful basis	required pending evidence	Escalate to privacy owner
Low-risk processing with documented controls	record rationale	Monitor for scope change

Domain anti-patterns

• Inventing a lawful basis. Fix: obtain the controller's documented basis.
• Listing controls that are only planned. Fix: distinguish implemented, planned, and absent.
• Omitting processors or cross-border transfers. Fix: map every recipient and location.
• Treating consent as the universal answer. Fix: assess the correct lawful basis.
• Approving with unknown retention. Fix: block until retention and deletion are defined.

Inputs

Artefact	Required?	Purpose
Processing purpose, data inventory, data subjects, systems, recipients, retention, and jurisdictions	yes	Establish the actual processing operation and applicable risk context
Existing controls, contracts, and incident history	conditional	Test residual risk and avoid crediting controls that are only planned

Outputs

Artefact	Consumer	Acceptance condition
DPIA with risk and action register	Data protection officer and accountable owner	Necessity, proportionality, data flows, rights impacts, control evidence, residual risks, owners, and consultation triggers are documented