dpia-generation

What problem does it solve?

This Skill generates a UK GDPR Article 35 Data Protection Impact Assessment (DPIA) for new features or processing activities, including a structured check of mandatory triggers, required DPO consultation, and whether prior ICO consultation (Article 36) may be needed due to residual high risk.

Core Features & Use Cases

• DPIA needed check (Art.35 + ICO guidance): Verifies whether a DPIA is required using Article 35(3) mandatory triggers and the ICO’s DPIA “always required” list, with citations and currency checks.
• DPO consultation and Art.36 flagging: Captures whether DPO consultation is required under Article 35(2) and flags an Article 36 prior consultation requirement when residual high risk remains.
• House-style DPIA output: Produces a DPIA in the team’s house format (sourced from practice-level configuration), including risks that are design-specific, a mitigations table with owners/due dates, and a clear sign-off and conditions section.
• Change-aware drafting: Looks for prior outputs (triage results, earlier DPIAs, and DPA/vendor review findings) to prevent contradictory conclusions for overlapping processing.

Quick Start

Use the dpia-generation skill to draft a DPIA for the Location sharing feature by running the command: /privacy-legal-uk:dpia-generation "Location sharing feature".