mcpField
P
privacy-impact-assessment-review

privacy-impact-assessment-review

github.com/sylphxaiSecurity138 installsUpdated today
Repository

About privacy-impact-assessment-review

A privacy impact assessment skill for structuring reviews of data processing, legal basis, vendors, retention, and mitigations. It produces a PIA plan with risk classifications, ownership, launch gates, and decision records, while accounting for changes to data flows and purposes.

Key features

  1. 01Processing risk classification
  2. 02Data mapping and minimization
  3. 03Notice, consent, and access controls
  4. 04Retention, deletion, and DSAR planning
  5. 05Risk mitigations and launch gates

Use cases

  1. 01Reviewing privacy risks before a feature launch
  2. 02Assessing vendor, AI, or cross-border data processing
  3. 03Defining retention, deletion, and user request workflows

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sylphxai/skills --skill privacy-impact-assessment-review

After installing, type/privacy-impact-assessment-reviewin Claude Code to confirm it loaded.

Bundled filesagents/openai.yamlreferences/privacy-impact-assessment-patterns.md

Details

From the project README

Privacy Impact Assessment Review

Use this skill to convert privacy impact assessment, data processing, minimization, legal basis, vendor, retention, and mitigation questions into a concrete artifact with owners, gates, metrics, and recovery paths.

Workflow

  1. Identify feature scope, user groups, data collected, purpose, legal basis, vendors, AI/analytics use, retention, sharing, region, sensitive data, and user controls.
  2. Read references/privacy-impact-assessment-patterns.md.
  3. Classify processing as low-risk routine, consent-sensitive, vendor/subprocessor, AI/profiling, cross-border transfer, sensitive data, child/regulated, or high-risk DPIA-needed.
  4. Define data map, minimization, notice/consent, access controls, retention/deletion, DSAR path, risk mitigations, launch gate, and record of decision.
  5. Produce PIA report, state machine, decision table, event schema, risk checklist, and mitigation plan.

When not to use

  • Do not use for generic advice the base model already handles without this skill's specific artifact contract.

Guardrails

  • Do not collect personal data because it is convenient; tie each field to purpose, retention, and user value.
  • Do not rely on consent, legitimate interest, or contract language without jurisdiction and context review.
  • Do not ship AI/profiling, sensitive-data, or child/regulated-user processing without elevated review.
  • Do not treat privacy review as a one-time launch checkbox when data flows, vendors, or purposes change.

Output format

PIA context:
Audience / source of truth / risk boundary:

Privacy assessment plan:
| Area | Decision | Evidence | Risk | Owner |
| --- | --- | --- | --- | --- |

Risks, mitigations, and launch gates:
- <trigger> -> <policy, metric, edge case, support note>

Comments

Markdown supported