使い方
- インストールコマンドをコピーし、自分の環境へ導入する前にソースを確認します。
- 必要なツール、認証情報、対応環境を原文で確認します。
- 入力と成果物を指定し、出力を資料と照合します。
npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill dpia-risk-scoring開始前の確認
- 導入にはモデル契約、API枠、ファイルへのアクセス許可は含まれません。
- スター数や導入数は活動の指標であり、独立した品質・安全性試験ではありません。
リポジトリの原文
見出し、例、コード、表、リンク、参照画像を含む原文を表示しています。
DPIA Risk Scoring Methodology
Overview
Art. 35(7)(c) GDPR requires a DPIA to include "an assessment of the risks to the rights and freedoms of data subjects." This skill provides a quantifiable risk scoring framework that converts qualitative privacy risks into comparable, prioritised scores supporting mitigation decisions.
Risk Scoring Framework
Severity Scale (Impact on Data Subject Rights)
| Level | Score | Description | Examples |
|---|---|---|---|
| Negligible | 1 | Minor inconvenience, easily recoverable | Temporary inability to access non-essential service |
| Limited | 2 | Significant inconvenience, recoverable with effort | Targeted advertising based on inferred preferences |
| Significant | 3 | Serious consequences, difficult to recover from | Financial loss, discrimination, reputational harm |
| Maximum | 4 | Irreversible or very difficult to recover from | Identity theft, physical safety risk, loss of employment |
Likelihood Scale
| Level | Score | Description | Indicators |
|---|---|---|---|
| Negligible | 1 | Unlikely given current controls | Strong technical controls, limited access, encrypted at rest and in transit |
| Limited | 2 | Possible but requires specific conditions | Some access controls, partial encryption, known but unproven attack vectors |
| Significant | 3 | Probable given known threat landscape | Weak controls in specific areas, prior incidents in sector, active threat actors |
| Maximum | 4 | Near-certain or already occurring | No controls, known vulnerabilities, prior breach of similar system |
Risk Matrix
Severity → Negligible(1) Limited(2) Significant(3) Maximum(4)
Likelihood ↓
Maximum(4) 4(M) 8(H) 12(VH) 16(VH)
Significant(3) 3(L) 6(M) 9(H) 12(VH)
Limited(2) 2(L) 4(M) 6(M) 8(H)
Negligible(1) 1(L) 2(L) 3(L) 4(M)
Risk Levels: L=Low(1-3), M=Medium(4-6), H=High(7-9), VH=Very High(10-16)Risk Categories (ENISA-Aligned)
Rights and Freedoms Impacts
- Loss of confidentiality -- Unauthorised disclosure of personal data
- Loss of integrity -- Unauthorised modification of personal data
- Loss of availability -- Inability to access or use personal data
- Loss of purpose limitation -- Data used beyond original purpose
- Discrimination -- Unfair treatment based on processing outcomes
- Identity theft/fraud -- Misuse of personal data for impersonation
- Financial loss -- Direct or indirect monetary harm
- Reputational damage -- Social standing or professional harm
- Physical harm -- Safety or health impacts
- Loss of autonomy -- Chilling effects on behaviour or free expression
Inherent vs Residual Risk
- Inherent risk: Risk level before applying any mitigation measures
- Residual risk: Risk level after applying planned mitigation measures
- Risk reduction: Difference between inherent and residual risk scores
- Acceptable risk threshold: Organisation-defined tolerance level
Art. 36 Prior Consultation Trigger
When residual risk remains High or Very High after all feasible mitigation measures, the controller must consult the supervisory authority under Art. 36(1) before commencing processing.
