Dpia Assessment

Tools

DPIA Threshold Checker

Evaluates whether a DPIA is required based on processing activity description. Checks Art. 35(3) mandatory triggers and 9 EDPB criteria.

# Check a processing activity (interactive prompts)
python scripts/dpia_threshold_checker.py --activity "AI-based credit scoring using financial and behavioral data of retail banking customers across EU"

# Check from JSON description
python scripts/dpia_threshold_checker.py --input processing.json

# JSON output
python scripts/dpia_threshold_checker.py --activity "Employee monitoring via CCTV in workplace" --json

# Generate blank input template
python scripts/dpia_threshold_checker.py --template > processing.json

Checks performed:

• Art. 35(3)(a): Automated decision-making with legal/significant effect
• Art. 35(3)(b): Large-scale processing of special category data (Art. 9) or criminal data (Art. 10)
• Art. 35(3)(c): Systematic monitoring of publicly accessible area on large scale
• 9 EDPB criteria from WP 248 rev.01 with two-criterion presumption rule

Output:

• Verdict: Required / Recommended / Not Required
• Art. 35(3) trigger matches
• EDPB criteria scores with reasoning
• Two-criterion presumption analysis

DPIA Risk Register

Manages a DPIA risk register in JSON format. Add risks, apply mitigations, and calculate residual risk.

# Initialize a new risk register
python scripts/dpia_risk_register.py init --output dpia_risks.json

# Add a risk
python scripts/dpia_risk_register.py add --register dpia_risks.json \
  --description "Unauthorized access to profiling data" \
  --rights-category "right-to-privacy" \
  --likelihood 4 --severity 3

# Add mitigation to a risk
python scripts/dpia_risk_register.py mitigate --register dpia_risks.json \
  --risk-id 1 --measure "Implement role-based access control" \
  --likelihood-reduction 2 --severity-reduction 1

# View risk register table
python scripts/dpia_risk_register.py view --register dpia_risks.json

# Generate residual risk summary
python scripts/dpia_risk_register.py summary --register dpia_risks.json --json

# Check Art. 36 consultation threshold
python scripts/dpia_risk_register.py art36-check --register dpia_risks.json

Rights categories: right-to-privacy, non-discrimination, freedom-of-expression, right-to-information, right-to-not-be-subject-to-automated-decisions, right-to-physical-safety

Reference Guides

EDPB Criteria

references/edpb_criteria.md

Complete EDPB 9-criteria assessment framework:

• Each criterion with description, indicators, and scoring guidance
• Art. 35(3) mandatory triggers
• Two-criterion presumption rule (WP 248 rev.01)
• Multi-jurisdictional DPIA analysis
• National blacklist/whitelist overview (DE, FR, IE, BE, NL, IT, PL)

Risk Scoring Methodology

references/risk_scoring_methodology.md

DPIA risk scoring from the data subject perspective:

• Likelihood and severity scales (1-5)
• Rights categories per Recital 75
• Risk level thresholds (Low/Medium/High/Very High)
• Mitigation effectiveness scoring
• Residual risk calculation
• Art. 36 consultation triggers
• Risk catalog: 20+ common DPIA risks

Workflows

Workflow 1: Full DPIA Assessment

Step 1: Threshold check — determine if DPIA required
        → python scripts/dpia_threshold_checker.py --activity "description"

Step 2: If Required or Recommended, describe the processing
        → Document purpose, legal basis, data categories, recipients, retention

Step 3: Assess necessity and proportionality
        → Confirm lawful basis (Art. 6, cumulative with Art. 9 if special categories)
        → Verify purpose limitation, data minimization, storage limitation

Step 4: Identify risks from data subject perspective
        → python scripts/dpia_risk_register.py init --output dpia_risks.json
        → Add risks using references/risk_scoring_methodology.md catalog

Step 5: Apply mitigations and calculate residual risk
        → python scripts/dpia_risk_register.py mitigate --register dpia_risks.json ...

Step 6: Check Art. 36 consultation requirement
        → python scripts/dpia_risk_register.py art36-check --register dpia_risks.json

Step 7: Document and review
        → python scripts/dpia_risk_register.py summary --register dpia_risks.json

Workflow 2: Quick Threshold Assessment

Step 1: Describe the processing activity
        → python scripts/dpia_threshold_checker.py --template > processing.json
        → Fill in processing details

Step 2: Run threshold check
        → python scripts/dpia_threshold_checker.py --input processing.json --json

Step 3: Review verdict and reasoning
        → Required: proceed to full DPIA (Workflow 1)
        → Recommended: proceed unless strong justification to skip (document)
        → Not Required: document the assessment and rationale

Workflow 3: AI System DPIA

Step 1: Classify AI system (EU AI Act risk level if applicable)
        → Map to DPIA triggers (automated decision-making, profiling, scoring)

Step 2: Run threshold check with AI-specific indicators
        → python scripts/dpia_threshold_checker.py --activity "AI system description"

Step 3: Dual-phase risk analysis (EDPB Opinion 28/2024)
        → Phase 1: Training data risks (collection, bias, consent)
        → Phase 2: Inference risks (decisions, profiling, transparency)

Step 4: Assess from data subject perspective
        → Add risks covering both training and inference phases
        → Include algorithmic bias, lack of transparency, unfair outcomes

Step 5: Apply mitigations specific to AI
        → Explainability measures, human oversight, bias testing
        → Document FRIA distinction per EU AI Act Art. 27 if applicable

Legal Precision Points

12 points of legal precision that distinguish expert-level DPIA work.

Output Formats

Threshold Verdict

VERDICT: DPIA REQUIRED
Reason: Art. 35(3)(a) trigger matched (automated decision-making with legal effect)
        + 4 of 9 EDPB criteria met (two-criterion presumption applies)
Matched triggers: automated_decision_making, evaluation_scoring, sensitive_data, large_scale

Risk Register Table

Residual Risk Overview

Total risks: 8
Mitigated: 6 (75%)
Residual risk distribution:
  Low:       3 (37.5%)
  Medium:    3 (37.5%)
  High:      2 (25.0%)
  Very High: 0 (0.0%)

Art. 36 consultation: NOT TRIGGERED (no Very High residual risks)

Troubleshooting

Success Criteria

• All high-risk processing activities assessed -- threshold check completed before processing begins, with documented verdict and reasoning
• Risk register complete with mitigations -- every identified risk has likelihood, severity, rights category, and at least one mitigation measure
• Residual risk acceptable or Art. 36 consultation initiated -- no unaddressed Very High residual risks
• Documentation meets SA expectations -- assessment follows Art. 35(7) requirements: systematic description, necessity/proportionality, risks, mitigations
• EDPB criteria properly applied -- two-criterion presumption correctly evaluated with documented reasoning

Scope & Limitations

In Scope:

• DPIA threshold assessment against Art. 35(3) triggers and EDPB criteria
• Risk register management with mitigation tracking and residual risk calculation
• Art. 36 prior consultation threshold assessment
• Multi-jurisdictional blacklist awareness (DE, FR, IE, BE, NL, IT, PL)
• AI system dual-phase DPIA analysis guidance
• Data subject perspective risk assessment per Recital 75

Out of Scope:

• Legal advice on lawful basis selection (Art. 6) or Art. 9(2) exception applicability
• Supervisory authority submission or interaction
• Technical implementation of mitigations (encryption, access control)
• DPO appointment or consultation logistics
• National blacklist exhaustive coverage beyond listed jurisdictions
• EU AI Act conformity assessment (see eu-ai-act-specialist)

Anti-Patterns

• Conducting DPIA after processing has started -- Art. 35(1) requires DPIA before processing begins; retroactive DPIAs do not satisfy the legal obligation and create enforcement exposure
• Assessing risk from the controller's perspective -- DPIA risks must be evaluated from the data subject's perspective per Recital 75; business impact is irrelevant to this analysis; a breach that is minor for the company may be catastrophic for affected individuals
• Treating pseudonymization as eliminating DPIA need -- pseudonymized data remains personal data under GDPR (Recital 26); pseudonymization is a mitigation that reduces risk scores, not a basis for skipping the DPIA entirely
• Skipping Art. 36 consultation when residual risk is high -- if residual risk remains Very High after mitigations, prior consultation with the supervisory authority is mandatory, not optional
• Conflating DPIA with FRIA -- the EU AI Act's Fundamental Rights Impact Assessment (Art. 27) is a separate obligation from GDPR DPIA; completing one does not satisfy the other; both may be required for AI systems processing personal data

Tool Reference

dpia_threshold_checker.py

Evaluates whether a DPIA is required based on Art. 35(3) triggers and EDPB criteria.

dpia_risk_register.py

Manages DPIA risk register with mitigation tracking and residual risk calculation.