Help us improve
Share bugs, ideas, or general feedback.
From privacy-impact-assessment-skills
Conducts Privacy Threshold Analysis screening with WP248rev.01 questionnaire and criteria to determine if full DPIA required for new processing activities, system changes, or procurement.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-impact-assessment-skillsHow this skill is triggered — by the user, by Claude, or both
Slash command
/privacy-impact-assessment-skills:privacy-threshold-analysisThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
A Privacy Threshold Analysis (PTA) is a lightweight screening tool used to determine whether a processing activity requires a full DPIA under Art. 35. The PTA functions as a triage mechanism: it applies the WP248rev.01 nine criteria, Art. 35(3) mandatory triggers, and national supervisory authority DPIA lists to quickly classify processing activities into three categories: DPIA required, DPIA r...
Conducts Privacy Threshold Analysis screening with WP248rev.01 questionnaire and criteria to determine if full DPIA required for new processing activities, system changes, or procurement.
Triages data processing activities to determine if a PIA or mandatory GDPR DPIA is needed, surfaces privacy policy conflicts, and routes to next steps.
Conduct Privacy Impact Assessments (PIA) to evaluate privacy risks and compliance for data processing activities.
Share bugs, ideas, or general feedback.
A Privacy Threshold Analysis (PTA) is a lightweight screening tool used to determine whether a processing activity requires a full DPIA under Art. 35. The PTA functions as a triage mechanism: it applies the WP248rev.01 nine criteria, Art. 35(3) mandatory triggers, and national supervisory authority DPIA lists to quickly classify processing activities into three categories: DPIA required, DPIA recommended, or DPIA not required. Every new processing activity, system change, or procurement of data-processing services should pass through the PTA before implementation.
| Question | Yes/No | If Yes |
|---|---|---|
| A1. Does the processing involve systematic and extensive evaluation of personal aspects based on automated processing (including profiling) on which decisions are based that produce legal effects or similarly significantly affect individuals? | DPIA mandatory — Art. 35(3)(a) | |
| A2. Does the processing involve large-scale processing of special categories of data (Art. 9(1): health, biometric, genetic, racial/ethnic, political, religious, trade union, sexual orientation) or criminal conviction data (Art. 10)? | DPIA mandatory — Art. 35(3)(b) | |
| A3. Does the processing involve systematic monitoring of a publicly accessible area on a large scale (e.g., CCTV in public spaces, Wi-Fi tracking)? | DPIA mandatory — Art. 35(3)(c) | |
| A4. Does the processing appear on the national supervisory authority's DPIA required list (Art. 35(4))? | DPIA mandatory |
If any question in Section A is answered Yes: DPIA is mandatory. Stop. Proceed to full DPIA.
| Question | Criterion | Yes/No |
|---|---|---|
| B1. Does the processing involve evaluation or scoring of individuals (profiling, prediction, credit scoring, behavioural analysis)? | C1 | |
| B2. Does the processing involve automated decision-making that produces legal effects or similarly significant effects on individuals? | C2 | |
| B3. Does the processing involve systematic monitoring of individuals (observation, tracking, surveillance)? | C3 | |
| B4. Does the processing involve sensitive data (Art. 9 special categories) or highly personal data (financial, location, communications)? | C4 | |
| B5. Is the processing carried out on a large scale (number of subjects, volume, geographic scope, duration)? | C5 | |
| B6. Does the processing involve matching or combining datasets from different sources beyond data subject expectations? | C6 | |
| B7. Does the processing involve data concerning vulnerable individuals (children, employees, patients, elderly, disabled, asylum seekers)? | C7 | |
| B8. Does the processing involve innovative use of technology or application of existing technology in a new way? | C8 | |
| B9. Does the processing prevent individuals from exercising a right or using a service or contract? | C9 |
Scoring:
| Question | Yes/No | Impact |
|---|---|---|
| C1. Does the processing involve international transfers to countries without an adequacy decision? | Additional risk factor — TIA required alongside DPIA if applicable | |
| C2. Is this a new processing activity not previously assessed? | New processing should be assessed more conservatively | |
| C3. Has similar processing been subject to enforcement action by any supervisory authority? | Elevated scrutiny — DPIA recommended regardless of criteria count | |
| C4. Does the processing involve real-time data processing or urgent decision-making? | Reduced opportunity for human review — elevated risk |
| Section A Triggers | Section B Criteria | Section C Factors | Determination |
|---|---|---|---|
| Any trigger met | N/A | N/A | DPIA mandatory |
| No trigger met | 2+ criteria | Any | DPIA strongly recommended |
| No trigger met | 1 criterion | 1+ factors | DPIA recommended |
| No trigger met | 1 criterion | 0 factors | DPO consultation recommended |
| No trigger met | 0 criteria | 1+ factors | Document screening; monitor |
| No trigger met | 0 criteria | 0 factors | DPIA not required |
Regardless of the outcome, every PTA must be documented and retained. The documentation must include:
| Field | Content |
|---|---|
| PTA Reference | Unique identifier (PTA-[ORG]-[YEAR]-[SEQ]) |
| Processing Activity Name | Descriptive name of the processing activity |
| Processing Owner | Name and role of the person responsible |
| Date of PTA | Date the screening was completed |
| Section A Responses | Yes/No for each Art. 35(3) question |
| Section B Responses | Yes/No for each WP248 criterion with justification |
| Section C Responses | Yes/No for each additional factor |
| Determination | DPIA mandatory/recommended/not required |
| DPO Sign-Off | DPO name, date, and whether they agree with the determination |
| Next Steps | Full DPIA initiated / Processing approved without DPIA / Deferred pending further information |
When a PTA determines that a DPIA is required:
When a PTA determines that a DPIA is recommended but not mandatory: