사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill pia-threshold-screening시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 Skill 문서
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
PIA Threshold Screening
Overview
Article 35(1) GDPR requires a DPIA when processing is "likely to result in a high risk to the rights and freedoms of natural persons." This skill provides a structured screening methodology to make that determination before committing to a full DPIA.
Screening Criteria
EDPB Nine-Criteria Test (WP248rev.01)
Processing that meets two or more of the following criteria generally requires a DPIA:
| # | Criterion | GDPR Reference |
|---|---|---|
| 1 | Evaluation or scoring | Art. 35(3)(a) |
| 2 | Automated decision-making with legal/similar effect | Art. 35(3)(a) |
| 3 | Systematic monitoring | Art. 35(3)(c) |
| 4 | Sensitive data or data of highly personal nature | Art. 9, Art. 10 |
| 5 | Data processed on a large scale | Recital 91 |
| 6 | Matching or combining datasets | WP248 |
| 7 | Data concerning vulnerable data subjects | WP248 |
| 8 | Innovative use or applying new technological solutions | WP248 |
| 9 | Processing that prevents data subjects from exercising a right | Art. 22, Art. 35(3)(b) |
Mandatory DPIA Triggers (Art. 35(3))
A DPIA is always required for:
- (a) Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, producing legal effects or similarly significant effects
- (b) Large-scale processing of special categories of data (Art. 9(1)) or criminal conviction data (Art. 10)
- (c) Systematic monitoring of a publicly accessible area on a large scale
National Supervisory Authority Blacklists (Art. 35(4))
Each EU/EEA supervisory authority publishes a list of processing operations requiring a DPIA. The screening must check the relevant national blacklist based on the controller establishment.
Screening Process
- Identify processing activity -- Describe the proposed or changed processing
- Check mandatory triggers -- Evaluate against Art. 35(3)(a)-(c)
- Check national blacklist -- Consult the relevant SA published list
- Apply nine-criteria test -- Score each WP248 criterion as met/not met
- Document rationale -- Record the screening decision with justification
- Escalate or close -- Route to full DPIA or document exemption
Decision Logic
IF any Art. 35(3) mandatory trigger is met → DPIA REQUIRED
ELSE IF processing appears on national SA blacklist → DPIA REQUIRED
ELSE IF 2+ WP248 criteria are met → DPIA REQUIRED
ELSE IF 1 WP248 criterion is met → DPIA RECOMMENDED (risk-based decision)
ELSE → DPIA NOT REQUIRED (document exemption)Integration Points
- RoPA linkage: Screening results attach to the corresponding RoPA entry
- Change management: New processing or material changes trigger re-screening
- DPIA register: Positive screening decisions feed the DPIA pipeline
