Provides combined DPIA and AI Act conformity assessment template with integrated risk scoring matrix for high-risk AI systems. Useful for GDPR Art. 35 and EU AI Act compliance.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeThis skill uses the workspace's default tool permissions.
High-risk AI systems under the EU AI Act must undergo both a GDPR Art. 35 DPIA and an AI Act conformity assessment. Rather than conducting these as separate exercises, this skill provides an integrated template that satisfies both frameworks simultaneously. The combined assessment ensures consistency between GDPR privacy risk analysis and AI Act safety and fundamental rights evaluation, reduces...
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
High-risk AI systems under the EU AI Act must undergo both a GDPR Art. 35 DPIA and an AI Act conformity assessment. Rather than conducting these as separate exercises, this skill provides an integrated template that satisfies both frameworks simultaneously. The combined assessment ensures consistency between GDPR privacy risk analysis and AI Act safety and fundamental rights evaluation, reduces duplication, and provides a single risk scoring matrix covering both regulatory dimensions. Art. 26(9) AI Act explicitly requires deployers to use DPIA results when fulfilling AI Act obligations.
| Dimension | Source | Weight |
|---|---|---|
| Privacy risk to data subjects | GDPR Art. 35(7)(c) | 30% |
| Fundamental rights impact | EU AI Act Art. 9(2)(a) | 25% |
| Accuracy and reliability risk | EU AI Act Art. 15 | 20% |
| Transparency and explainability gap | GDPR Art. 13(2)(f) + AI Act Art. 13 | 15% |
| Human oversight adequacy | GDPR Art. 22 + AI Act Art. 14 | 10% |
| Score | Level | Description |
|---|---|---|
| 1 | Minimal | Risk negligible; controls effective |
| 2 | Low | Minor risk; standard controls sufficient |
| 3 | Medium | Moderate risk; enhanced controls needed |
| 4 | High | Significant risk; intensive mitigation required |
| 5 | Critical | Severe risk; may require processing suspension |
| Weighted Score | Classification | Action Required |
|---|---|---|
| 1.0-1.5 | Low | Standard monitoring |
| 1.6-2.5 | Medium | Enhanced monitoring and periodic review |
| 2.6-3.5 | High | Active mitigation and DPO/Board oversight |
| 3.6-4.5 | Very High | Art. 36 prior consultation; deployment hold pending mitigation |
| 4.6-5.0 | Critical | Do not deploy; fundamental redesign required |
| Element | Reference | Combined Assessment Section |
|---|---|---|
| Systematic description of processing | Art. 35(7)(a) | Section 2: AI System Description |
| Necessity and proportionality | Art. 35(7)(b) | Section 3: Necessity Assessment |
| Risk assessment | Art. 35(7)(c) | Section 5: Combined Risk Register |
| Mitigation measures | Art. 35(7)(d) | Section 6: Mitigation Measures |
For high-risk AI systems (Annex III), the conformity assessment per Art. 43 requires:
| Element | Reference | Combined Assessment Section |
|---|---|---|
| Risk management system | Art. 9 | Section 5: Combined Risk Register |
| Data governance | Art. 10 | Section 2: Training Data Governance |
| Technical documentation | Art. 11 | Full combined assessment document |
| Record-keeping | Art. 12 | Section 7: Monitoring and Logging |
| Transparency | Art. 13 | Section 4: Transparency Assessment |
| Human oversight | Art. 14 | Section 4: Human Oversight |
| Accuracy, robustness, cybersecurity | Art. 15 | Section 5: Technical Risk Assessment |
| Quality management system | Art. 17 | Section 8: Quality Management |
| Measure | GDPR Relevance | AI Act Relevance | Priority |
|---|---|---|---|
| Differential privacy | Training data protection | Robustness (Art. 15) | High for sensitive data |
| Model output perturbation | Model inversion protection | Accuracy trade-off (Art. 15) | Medium |
| Fairness constraints | Non-discrimination (Art. 5(1)(a)) | Bias prevention (Art. 10) | High for high-risk |
| Explainability tools (SHAP/LIME) | Art. 13(2)(f) logic explanation | Interpretability (Art. 13) | High |
| Input/output PII filtering | Data minimisation (Art. 5(1)(c)) | Accuracy (Art. 15) | High for generative AI |
| Encryption (rest/transit) | Security (Art. 32) | Cybersecurity (Art. 15) | Standard |
| Access controls (RBAC) | Security (Art. 32) | Cybersecurity (Art. 15) | Standard |
| Anomaly detection | Breach detection (Art. 33) | Robustness (Art. 15) | Medium |
| Measure | GDPR Relevance | AI Act Relevance |
|---|---|---|
| AI ethics review board | Accountability (Art. 5(2)) | Quality management (Art. 17) |
| Model cards | Transparency (Art. 13-14) | Technical documentation (Art. 11) |
| Regular bias audits | Fairness (Art. 5(1)(a)) | Bias monitoring (Art. 10) |
| Incident response for AI | Breach notification (Art. 33-34) | Post-market monitoring (Art. 72) |
| Staff training on AI risks | Accountability | Human oversight (Art. 14) |
| Documentation and record-keeping | Accountability (Art. 5(2)) | Record-keeping (Art. 12) |