How to use
- Copy the installation command and review the source package before installing it in your own agent environment.
- Check the source document for required tools, credentials and supported hosts.
- Describe your input and desired deliverable; review the output against the source material.
npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill pia-threshold-screeningBefore you start
- Installation does not include a model subscription, API allowance or permission to access your files.
- Repository stars and installation counts describe activity, not an independent quality or security test.
Original skill document
Rendered from the source repository. Headings, examples, code, tables, links, and referenced images are preserved.
PIA Threshold Screening
Overview
Article 35(1) GDPR requires a DPIA when processing is "likely to result in a high risk to the rights and freedoms of natural persons." This skill provides a structured screening methodology to make that determination before committing to a full DPIA.
Screening Criteria
EDPB Nine-Criteria Test (WP248rev.01)
Processing that meets two or more of the following criteria generally requires a DPIA:
| # | Criterion | GDPR Reference |
|---|---|---|
| 1 | Evaluation or scoring | Art. 35(3)(a) |
| 2 | Automated decision-making with legal/similar effect | Art. 35(3)(a) |
| 3 | Systematic monitoring | Art. 35(3)(c) |
| 4 | Sensitive data or data of highly personal nature | Art. 9, Art. 10 |
| 5 | Data processed on a large scale | Recital 91 |
| 6 | Matching or combining datasets | WP248 |
| 7 | Data concerning vulnerable data subjects | WP248 |
| 8 | Innovative use or applying new technological solutions | WP248 |
| 9 | Processing that prevents data subjects from exercising a right | Art. 22, Art. 35(3)(b) |
Mandatory DPIA Triggers (Art. 35(3))
A DPIA is always required for:
- (a) Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, producing legal effects or similarly significant effects
- (b) Large-scale processing of special categories of data (Art. 9(1)) or criminal conviction data (Art. 10)
- (c) Systematic monitoring of a publicly accessible area on a large scale
National Supervisory Authority Blacklists (Art. 35(4))
Each EU/EEA supervisory authority publishes a list of processing operations requiring a DPIA. The screening must check the relevant national blacklist based on the controller establishment.
Screening Process
- Identify processing activity -- Describe the proposed or changed processing
- Check mandatory triggers -- Evaluate against Art. 35(3)(a)-(c)
- Check national blacklist -- Consult the relevant SA published list
- Apply nine-criteria test -- Score each WP248 criterion as met/not met
- Document rationale -- Record the screening decision with justification
- Escalate or close -- Route to full DPIA or document exemption
Decision Logic
IF any Art. 35(3) mandatory trigger is met → DPIA REQUIRED
ELSE IF processing appears on national SA blacklist → DPIA REQUIRED
ELSE IF 2+ WP248 criteria are met → DPIA REQUIRED
ELSE IF 1 WP248 criterion is met → DPIA RECOMMENDED (risk-based decision)
ELSE → DPIA NOT REQUIRED (document exemption)Integration Points
- RoPA linkage: Screening results attach to the corresponding RoPA entry
- Change management: New processing or material changes trigger re-screening
- DPIA register: Positive screening decisions feed the DPIA pipeline
