使い方
- インストールコマンドをコピーし、自分の環境へ導入する前にソースを確認します。
- 必要なツール、認証情報、対応環境を原文で確認します。
- 入力と成果物を指定し、出力を資料と照合します。
npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill dpia-mitigation-plan開始前の確認
- 導入にはモデル契約、API枠、ファイルへのアクセス許可は含まれません。
- スター数や導入数は活動の指標であり、独立した品質・安全性試験ではありません。
リポジトリの原文
見出し、例、コード、表、リンク、参照画像を含む原文を表示しています。
DPIA Mitigation Planning
Overview
Article 35(7)(d) GDPR requires a DPIA to include "the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation." This skill provides a structured mitigation planning framework.
Mitigation Strategy Categories
Technical Measures
| Category | Examples | GDPR Reference |
|---|---|---|
| Encryption | At-rest, in-transit, end-to-end | Art. 32(1)(a) |
| Pseudonymisation | Tokenisation, hashing, key-coded | Art. 25(1), Art. 32(1)(a) |
| Access controls | RBAC, MFA, privileged access management | Art. 32(1)(b) |
| Data minimisation | Field-level reduction, aggregation, sampling | Art. 5(1)(c), Art. 25(1) |
| Anonymisation | k-anonymity, differential privacy, generalisation | Recital 26 |
| Monitoring | SIEM, DLP, anomaly detection | Art. 32(1)(d) |
Organisational Measures
| Category | Examples | GDPR Reference |
|---|---|---|
| Policies | Data protection policy, acceptable use | Art. 24(2) |
| Training | Privacy awareness, role-specific training | Art. 39(1)(b) |
| Contracts | DPAs, joint controller arrangements, NDAs | Art. 28, Art. 26 |
| Audits | Internal audits, processor audits, certification | Art. 28(3)(h) |
| Governance | DPO oversight, privacy committee, RACI | Art. 37-39 |
| Incident response | Breach procedures, notification protocols | Art. 33-34 |
Mitigation Plan Structure
For each identified risk:
- Risk reference -- Link to DPIA risk register entry
- Inherent risk level -- Before mitigation
- Proposed measures -- Specific technical and organisational controls
- Implementation owner -- Accountable person
- Implementation deadline -- Target completion date
- Verification method -- How effectiveness will be confirmed
- Residual risk level -- After planned mitigation
- Acceptance decision -- Within appetite / escalation required / prior consultation
Residual Risk Decision Framework
Residual Risk LOW → Accept; document; routine monitoring
Residual Risk MEDIUM → Accept with enhanced monitoring; annual review
Residual Risk HIGH → Escalate to senior management; consider additional measures
Residual Risk VERY HIGH → Art. 36 prior consultation required before processingImplementation Tracking
Each mitigation measure progresses through:
- Proposed -- Identified but not yet approved
- Approved -- Budget and resources allocated
- In Progress -- Implementation underway
- Implemented -- Deployed and operational
- Verified -- Effectiveness confirmed through testing
