Manages organizational DPIA register for GDPR compliance: tracks assessments, lifecycle states, status, Art. 35(11) reviews, links to RoPA, risks, mitigations.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeThis skill uses the workspace's default tool permissions.
Article 35(11) GDPR requires controllers to carry out reviews of DPIAs "at least when there is a change in the risk represented by processing operations." Effective DPIA register management ensures that all assessments are tracked, reviewed on schedule, and updated when processing changes. The register serves as the central accountability record demonstrating that the controller has systematica...
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
Article 35(11) GDPR requires controllers to carry out reviews of DPIAs "at least when there is a change in the risk represented by processing operations." Effective DPIA register management ensures that all assessments are tracked, reviewed on schedule, and updated when processing changes. The register serves as the central accountability record demonstrating that the controller has systematically identified and assessed high-risk processing across the organisation.
| Field | Description | GDPR Reference |
|---|---|---|
| DPIA Reference | Unique identifier (format: DPIA-[DEPT]-[YEAR]-[SEQ]) | Art. 5(2) Accountability |
| Processing Activity | Name and description of the processing operation assessed | Art. 35(7)(a) |
| RoPA Reference | Link to Records of Processing Activities entry | Art. 30 |
| Controller / Joint Controller | Responsible data controller(s) | Art. 35(1) |
| DPO Consulted | Confirmation DPO was consulted per Art. 35(2) | Art. 35(2) |
| Assessment Date | Date DPIA was completed | Art. 5(2) |
| DPIA Lead | Person who conducted the assessment | Accountability |
| Status | Draft, In Review, Approved, Requires Update, Archived | Art. 35(11) |
| Overall Risk Level | Residual risk level after mitigation (Low/Medium/High/Very High) | Art. 35(7)(c)-(d) |
| Prior Consultation | Whether Art. 36 prior consultation was required and outcome | Art. 36 |
| Review Date | Next scheduled review date | Art. 35(11) |
| Review Trigger | Event that will trigger early reassessment | Art. 35(11) |
| Linked Mitigation Plan | Reference to the mitigation plan document | Art. 35(7)(d) |
| Approval Authority | Senior management or board member who approved | Art. 24 |
[Screening] ──► [Draft] ──► [DPO Review] ──► [Approved]
│
┌─────────────┤
│ │
[Requires Update] [Active Monitoring]
│ │
└─► [Revised] ─► [Re-approved]
│
[Archived]
Screening: Processing activity identified as potentially requiring DPIA; threshold assessment conducted.
Draft: DPIA being prepared; processing description, necessity assessment, and risk assessment in progress.
DPO Review: Complete draft submitted to DPO for Art. 35(2) advice.
Approved: DPIA reviewed, DPO advice incorporated, residual risk accepted, processing may commence.
Active Monitoring: Approved DPIA with ongoing mitigation tracking and periodic review.
Requires Update: Triggered by processing change, incident, or scheduled review.
Revised: Updated DPIA addressing changes or new risks.
Re-approved: Revised DPIA reviewed and approved.
Archived: Processing ceased; DPIA retained for accountability records per retention policy.
The GDPR does not specify a fixed review frequency. The EDPB recommends that DPIAs be reviewed "at least when there is a change in the risk represented by processing operations." Organisational best practice establishes:
| Risk Level | Review Frequency | Rationale |
|---|---|---|
| Very High (with Art. 36 consultation) | Every 6 months | Highest risk requires most frequent reassessment |
| High | Annually | Significant risk warrants annual review |
| Medium | Every 18 months | Moderate risk with standard review cycle |
| Low | Every 24 months | Lower risk allows extended review cycle |
Regardless of scheduled review, a DPIA must be reassessed when:
The DPIA register must be available for inspection by the supervisory authority upon request. Key reporting elements:
For DPIAs that triggered prior consultation, the register tracks:
| Field | Description |
|---|---|
| Submission Date | When the DPIA was submitted to the supervisory authority |
| SA Reference | Supervisory authority's case reference number |
| Response Date | When the SA responded |
| SA Outcome | Approved, approved with conditions, objected |
| Conditions | Any conditions imposed by the SA |
| Compliance Status | Whether conditions have been met |