Privacy Impact Assessment

---
name: privacy-impact-assessment
enabled: true
description: |
  Use when performing privacy impact assessment — template for conducting
  Privacy Impact Assessments (PIA) on new projects or system changes involving
  personal data. Covers data flow mapping, purpose limitation analysis, data
  minimization review, consent mechanisms, third-party sharing evaluation, and
  risk mitigation to ensure privacy by design.
required_connections:
  - prefix: jira
    label: "Jira (or project tracker)"
config_fields:
  - key: project_name
    label: "Project/Feature Name"
    required: true
    placeholder: "e.g., customer-analytics-v2"
  - key: data_subjects
    label: "Data Subjects"
    required: true
    placeholder: "e.g., customers, employees, partners"
  - key: regulation
    label: "Primary Regulation"
    required: true
    placeholder: "e.g., GDPR, CCPA, PIPEDA"
features:
  - COMPLIANCE
  - PRIVACY
---

# Privacy Impact Assessment Skill

Conduct PIA for **{{ project_name }}** processing data of **{{ data_subjects }}** under **{{ regulation }}**.

## Workflow

### Phase 1 — Project Description

```
PROJECT OVERVIEW
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Project: {{ project_name }}
[ ] Description: ___
[ ] Data subjects: {{ data_subjects }}
[ ] Primary regulation: {{ regulation }}
[ ] Project stage: [ ] Design  [ ] Development  [ ] Production
[ ] Business justification: ___
[ ] Project owner: ___
[ ] DPO consulted: [ ] YES  [ ] NO
```

### Phase 2 — Data Flow Mapping

```
DATA FLOWS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Personal data collected:
    Data Element         | Category    | Sensitivity | Source
    _____________________|_____________|_____________|________
                         |             |             |
                         |             |             |
                         |             |             |

[ ] Data flow:
    Collection -> Processing -> Storage -> Sharing -> Deletion
    __________ -> __________ -> _______ -> _______ -> ________

[ ] Data storage locations: ___
[ ] Cross-border transfers: [ ] YES — countries: ___
[ ] Third parties receiving data:
    - ___: purpose: ___
    - ___: purpose: ___
```

### Phase 3 — Legal Basis and Purpose

```
LEGAL BASIS ANALYSIS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Lawful basis for processing ({{ regulation }}):
    [ ] Consent (explicit, informed, withdrawable)
    [ ] Contractual necessity
    [ ] Legal obligation
    [ ] Vital interests
    [ ] Public interest
    [ ] Legitimate interests (balancing test required)

[ ] Purpose limitation:
    - Stated purposes:
      1. ___
      2. ___
    - Purpose is specific and explicit: [ ] YES
    - No secondary use without additional basis: [ ] CONFIRMED

[ ] Data minimization:
    - All collected data necessary for stated purpose: [ ] YES
    - Data that could be removed/anonymized: ___
    - Retention period justified: [ ] YES
```

### Phase 4 — Data Subject Rights

```
RIGHTS IMPLEMENTATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Right to access: [ ] IMPLEMENTED — mechanism: ___
[ ] Right to rectification: [ ] IMPLEMENTED — mechanism: ___
[ ] Right to erasure: [ ] IMPLEMENTED — mechanism: ___
[ ] Right to portability: [ ] IMPLEMENTED — format: ___
[ ] Right to object: [ ] IMPLEMENTED — mechanism: ___
[ ] Right to restrict processing: [ ] IMPLEMENTED — mechanism: ___
[ ] Automated decision-making:
    - Used: [ ] YES  [ ] NO
    - Right to human review: [ ] IMPLEMENTED
[ ] Response timeline: ___ days (regulatory max: ___ days)
```

### Phase 5 — Risk Assessment

```
PRIVACY RISKS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Risk                         | Likelihood | Impact  | Severity | Mitigation
_____________________________|____________|_________|__________|___________
Unauthorized access          |            |         |          |
Data breach                  |            |         |          |
Excessive data collection    |            |         |          |
Purpose creep                |            |         |          |
Insufficient consent         |            |         |          |
Cross-border transfer risk   |            |         |          |
Third-party misuse           |            |         |          |
Reidentification risk        |            |         |          |

Residual risk after mitigations: [ ] LOW  [ ] MEDIUM  [ ] HIGH
```

### Phase 6 — Approval

```
PIA DECISION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Mitigations implemented before launch
[ ] Privacy notice updated
[ ] Consent mechanisms deployed (if applicable)
[ ] DPO sign-off: [ ] APPROVED  [ ] CONDITIONAL  [ ] REJECTED
[ ] Conditions (if applicable):
    - ___
    - ___
[ ] Review date: ___
[ ] Reassessment trigger: material change in data processing
```

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format

Produce a Privacy Impact Assessment report with:
1. **Project summary** (description, data subjects, legal basis)
2. **Data flow map** (collection, processing, storage, sharing)
3. **Rights implementation** (status of each data subject right)
4. **Risk assessment** (identified risks with mitigations)
5. **Decision** (approval status, conditions, review schedule)