What it does. 'Automates the Privacy Impact Assessment (PIA) workflow including data Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-privacy-impact-assessment/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-privacy-impact-assessment, or copy the skill folder into ~/.claude/skills/performing-privacy-impact-assessment/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-privacy-impact-assessment/SKILL.md

SKILL.md (verbatim)

name: performing-privacy-impact-assessment
description: 'Automates the Privacy Impact Assessment (PIA) workflow including data
  flow mapping, privacy risk scoring matrices, GDPR Article 35 DPIA and CCPA/CPRA
  alignment checks, data inventory cataloging, and remediation tracking. Implements
  the NIST Privacy Framework PRAM methodology and ICO DPIA guidance for systematic
  identification and mitigation of privacy risks across processing activities. Use
  when conducting privacy assessments for new systems, evaluating regulatory compliance
  posture, or building automated privacy governance programs.

  '
domain: cybersecurity
subdomain: privacy-compliance
tags:
- privacy
- impact-assessment
- GDPR
- CCPA
- NIST
- DPIA
- data-flow-mapping
- risk-scoring
version: '1.0'
author: mukul975
license: Apache-2.0
nist_csf:
- GV.PO-01
- PR.DS-01
- GV.OC-05
mitre_attack:
- T1078
- T1190
- T1059

Performing Privacy Impact Assessment

When to Use

• When launching a new system, product, or processing activity that handles personal data
• When conducting GDPR Article 35 Data Protection Impact Assessments (DPIAs)
• When evaluating CCPA/CPRA compliance for data processing operations
• When performing privacy risk assessments aligned to the NIST Privacy Framework
• When mapping data flows across organizational boundaries and third-party processors
• When building automated privacy governance and assessment pipelines
• When preparing for regulatory audits or demonstrating accountability obligations

Prerequisites

• Familiarity with GDPR, CCPA/CPRA, and NIST Privacy Framework concepts
• Access to data processing inventories and system architecture documentation
• Python 3.8+ with required dependencies installed
• Appropriate authorization from the Data Protection Officer (DPO) or privacy team
• Knowledge of organizational data flows and third-party processor relationships

Instructions

Phase 1: Data Inventory and Processing Activity Catalog

Build a complete inventory of personal data processing activities. Each record of processing activity (ROPA) entry must capture the data categories, legal basis, retention periods, and data subjects involved.

from agent import PrivacyImpactAssessmentEngine

engine = PrivacyImpactAssessmentEngine()

# Register a processing activity for assessment
activity = engine.register_processing_activity(
    name="Customer Analytics Platform",
    description="Collects browsing behavior and purchase history for personalization",
    data_controller="Acme Corp",
    data_processor="CloudAnalytics Inc",
    data_categories=["browsing_history", "purchase_records", "ip_address", "device_id"],
    data_subjects=["customers", "website_visitors"],
    legal_basis="consent",
    retention_period_days=730,
    cross_border_transfer=True,
    transfer_destinations=["US", "IN"],
    automated_decision_making=True,
)
print(f"Registered activity: {activity['activity_id']}")

Phase 2: Data Flow Mapping

Map all data flows from collection to deletion, identifying every touchpoint, transformation, and storage location. This reveals hidden privacy risks in data movement across systems.

# Build the data flow map
flow_map = engine.map_data_flows(
    activity_id=activity["activity_id"],
    flows=[
        {
            "stage": "collection",
            "source": "Web browser cookie + form submission",
            "destination": "CDN edge server",
            "data_elements": ["ip_address", "device_id", "browsing_history"],
            "encryption_in_transit": True,
            "protocol": "TLS 1.3",
        },
        {
            "stage": "processing",
            "source": "CDN edge server",
            "destination": "Analytics data warehouse (US-East)",
            "data_elements": ["browsing_history", "purchase_records", "device_id"],
            "encryption_in_transit": True,
            "encryption_at_rest": True,
            "protocol": "mTLS",
        },
        {
            "stage": "storage",
            "source": "Analytics data warehouse",
            "destination": "S3 encrypted bucket",
            "data_elements": ["browsing_history", "purchase_records"],
            "encryption_at_rest": True,
            "retention_days": 730,
            "access_controls": "IAM role-based, MFA required",
        },
        {
            "stage": "sharing",
            "source": "Analytics data warehouse",
            "destination": "Third-party ML provider (IN)",
            "data_elements": ["browsing_history", "purchase_records"],
            "encryption_in_transit": True,
            "data_processing_agreement": True,
            "cross_border": True,
        },
        {
            "stage": "deletion",
            "source": "S3 bucket + data warehouse",
            "destination": "Secure erasure",
            "method": "Cryptographic erasure + lifecycle policy",
            "verification": "Automated deletion audit log",
        },
    ],
)
engine.render_data_flow_diagram(flow_map)

Phase 3: Privacy Risk Assessment with Scoring Matrix

Apply a structured risk scoring methodology evaluating likelihood and impact across multiple privacy risk dimensions. The matrix aligns with both the NIST PRAM and ICO DPIA risk assessment approaches.

# Run the risk assessment
risk_report = engine.assess_privacy_risks(
    activity_id=activity["activity_id"],
    assessment_type="full_dpia",
)

# Display risk matrix results
for risk in risk_report["risks"]:
    print(f"[{risk['severity']}] {risk['category']}: {risk['description']}")
    print(f"  Likelihood: {risk['likelihood']}/5 | Impact: {risk['impact']}/5 | Score: {risk['risk_score']}/25")
    print(f"  Mitigation: {risk['recommended_mitigation']}")

Risk categories evaluated include:

1. Data Minimization -- Excessive collection beyond stated purpose
2. Purpose Limitation -- Secondary use without legal basis
3. Cross-Border Transfer -- Transfers without adequate safeguards (SCCs, BCRs)
4. Automated Decision Making -- Profiling without human oversight or appeal
5. Data Subject Rights -- Inability to fulfill access/erasure/portability requests
6. Third-Party Risk -- Processor compliance gaps, subprocessor chains
7. Security Controls -- Encryption, access control, breach response gaps
8. Retention -- Storing data beyond necessity or legal requirement
9. Consent Management -- Invalid or ambiguous consent mechanisms
10. Breach Notification -- Inability to detect and notify within 72 hours (GDPR)

Phase 4: GDPR and CCPA/CPRA Alignment Checks

Run automated compliance checks against specific regulatory requirements. The engine maps each processing activity against article-level GDPR obligations and CCPA/CPRA consumer rights requirements.

# GDPR compliance check
gdpr_report = engine.check_gdpr_compliance(activity_id=activity["activity_id"])
print(f"GDPR Score: {gdpr_report['compliance_score']}/100")
for finding in gdpr_report["findings"]:
    print(f"  [{finding['status']}] Art.{finding['article']}: {finding['description']}")

# CCPA/CPRA compliance check
ccpa_report = engine.check_ccpa_compliance(activity_id=activity["activity_id"])
print(f"CCPA Score: {ccpa_report['compliance_score']}/100")
for finding in ccpa_report["findings"]:
    print(f"  [{finding['status']}] Sec.{finding['section']}: {finding['description']}")

Phase 5: Remediation Plan and Report Generation

Generate a prioritized remediation plan with specific action items, responsible parties, deadlines, and generate the formal PIA/DPIA report document.

# Generate remediation plan
remediation = engine.generate_remediation_plan(
    activity_id=activity["activity_id"],
    risk_report=risk_report,
    gdpr_report=gdpr_report,
    ccpa_report=ccpa_report,
)

for item in remediation["action_items"]:
    print(f"[{item['priority']}] {item['action']}")
    print(f"  Owner: {item['owner']} | Deadline: {item['deadline']}")
    print(f"  Addresses: {', '.join(item['addresses_risks'])}")

# Generate formal DPIA report
engine.generate_dpia_report(
    activity_id=activity["activity_id"],
    output_path="dpia_report_customer_analytics.json",
    format="json",
)
print("[+] DPIA report generated")

Examples

Quick Screening Assessment

Determine whether a full DPIA is required using the ICO screening checklist:

engine = PrivacyImpactAssessmentEngine()

screening = engine.run_screening_checklist(
    uses_special_category_data=False,
    large_scale_processing=True,
    systematic_monitoring=True,
    automated_decision_making=True,
    cross_border_transfer=True,
    vulnerable_data_subjects=False,
    innovative_technology=True,
    denial_of_service_or_rights=False,
)
print(f"DPIA Required: {screening['dpia_required']}")
print(f"Triggers: {screening['triggers']}")
# Output: DPIA Required: True
# Triggers: ['large_scale_processing', 'systematic_monitoring',
#            'automated_decision_making', 'cross_border_transfer',
#            'innovative_technology']

Batch Assessment of Multiple Processing Activities

engine = PrivacyImpactAssessmentEngine()

activities = [
    {"name": "Email Marketing", "data_categories": ["email", "name"],
     "legal_basis": "consent", "cross_border_transfer": False},
    {"name": "HR Analytics", "data_categories": ["employee_id", "performance_scores",
     "health_data"], "legal_basis": "legitimate_interest", "cross_border_transfer": True},
    {"name": "Fraud Detection", "data_categories": ["transaction_data", "ip_address",
     "device_fingerprint"], "legal_basis": "legitimate_interest",
     "automated_decision_making": True, "cross_border_transfer": False},
]

for act_def in activities:
    activity = engine.register_processing_activity(**act_def)
    risk = engine.assess_privacy_risks(activity_id=activity["activity_id"])
    print(f"{act_def['name']}: Overall Risk={risk['overall_risk_level']} "
          f"({risk['risk_count_by_severity']})")

NIST Privacy Framework Profile Mapping

engine = PrivacyImpactAssessmentEngine()

profile = engine.generate_nist_privacy_profile(
    activity_id=activity["activity_id"],
    target_tier="tier_3",  # Repeatable
)

for function_id, outcomes in profile["functions"].items():
    print(f"\n{function_id}:")
    for outcome in outcomes:
        status = "PASS" if outcome["implemented"] else "GAP"
        print(f"  [{status}] {outcome['subcategory']}: {outcome['description']}")

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

API Reference: Performing Privacy Impact Assessment

PrivacyImpactAssessmentEngine

Core engine for automated PIA/DPIA workflows.

Initialization

from agent import PrivacyImpactAssessmentEngine

engine = PrivacyImpactAssessmentEngine(
    organization_name="Acme Corp",
    dpo_email="dpo@acme.com",
)

register_processing_activity()

Register a processing activity for assessment.

activity = engine.register_processing_activity(
    name="Customer Analytics",                    # Required
    description="Behavioral analytics pipeline",  # Required
    data_controller="Acme Corp",                  # Controller name
    data_processor="CloudAnalytics Inc",          # Processor name
    data_categories=["email", "ip_address"],      # List of data types
    data_subjects=["customers"],                  # Affected individuals
    legal_basis="consent",                        # consent|contract|legal_obligation|
                                                  # vital_interests|public_task|legitimate_interest
    retention_period_days=365,                    # Days before deletion
    cross_border_transfer=True,                   # International transfer
    transfer_destinations=["US", "IN"],           # ISO country codes
    automated_decision_making=False,              # Profiling/auto-decisions
)
# Returns: dict with activity_id, sensitivity_profile, etc.

Supported data_categories:

Category	Sensitivity	Weight
health_data, biometric_data, genetic_data	special_category	5
ssn, financial_account, credit_card, login_credentials	high	4
email, phone_number, ip_address, geolocation	medium	3
name, job_title, browsing_history, device_id	low	2
cookie_id, public_profile	low	1

map_data_flows()

Map data flows through the processing lifecycle.

flow_map = engine.map_data_flows(
    activity_id="PA-XXXXXXXX",
    flows=[
        {
            "stage": "collection",       # collection|processing|storage|sharing|deletion
            "source": "Web form",
            "destination": "API server",
            "data_elements": ["email", "name"],
            "encryption_in_transit": True,
            "encryption_at_rest": False,
            "protocol": "TLS 1.3",
            "cross_border": False,
            "data_processing_agreement": False,
        },
    ],
)

assess_privacy_risks()

Run risk assessment with scoring matrix.

risk_report = engine.assess_privacy_risks(
    activity_id="PA-XXXXXXXX",
    assessment_type="full_dpia",  # full_dpia|screening|targeted
)

Risk Scoring Matrix:

Score	Severity
20-25	CRITICAL
15-19	HIGH
10-14	MEDIUM
5-9	LOW
1-4	INFORMATIONAL

Score = Likelihood (1-5) x Impact (1-5)

Risk Categories Evaluated:

ID	Category	Description
RISK-001	Data Minimization	Excessive collection beyond purpose
RISK-002	Purpose Limitation	Undefined or exceeded purposes
RISK-003	Cross-Border Transfer	Transfer without safeguards
RISK-004	Automated Decision Making	No human oversight
RISK-005	Data Subject Rights	Missing DSR mechanisms
RISK-006	Third-Party Risk	Processor compliance gaps
RISK-007	Security Controls	Encryption/access gaps
RISK-008	Retention	Over-retention or no policy
RISK-009	Consent Management	Ambiguous consent
RISK-010	Breach Notification	No 72-hour capability
RISK-011	Special Category Data	Missing Art. 9 basis
RISK-012	Transparency	Incomplete privacy notice
RISK-013	Vulnerable Data Subjects	Missing extra safeguards
RISK-014	Data Quality	No accuracy measures

run_screening_checklist()

ICO DPIA screening to determine if full DPIA is required.

result = engine.run_screening_checklist(
    uses_special_category_data=False,
    large_scale_processing=True,
    systematic_monitoring=True,
    automated_decision_making=False,
    cross_border_transfer=True,
    vulnerable_data_subjects=False,
    innovative_technology=False,
    denial_of_service_or_rights=False,
    evaluation_or_scoring=False,
    matching_or_combining_datasets=False,
)
# Returns: {"dpia_required": True, "triggers": [...], ...}

check_gdpr_compliance()

Article-level GDPR compliance checks.

gdpr_report = engine.check_gdpr_compliance(activity_id="PA-XXXXXXXX")
# Returns: compliance_score (0-100), findings per article

GDPR Articles Checked:

Article	Title
Art. 5	Principles (lawfulness, minimization, retention, etc.)
Art. 6	Lawfulness of processing
Art. 7	Conditions for consent
Art. 13	Information at collection
Art. 22	Automated decision-making
Art. 25	Data protection by design
Art. 28	Processor obligations
Art. 30	Records of processing
Art. 32	Security of processing
Art. 33	Breach notification
Art. 35	DPIA requirements
Art. 44	Transfer safeguards

check_ccpa_compliance()

CCPA/CPRA section-level compliance checks.

ccpa_report = engine.check_ccpa_compliance(activity_id="PA-XXXXXXXX")
# Returns: compliance_score (0-100), findings per section

CCPA Sections Checked:

Section	Title
1798.100	Right to know
1798.105	Right to delete
1798.106	Right to correct
1798.110	Right to specific PI
1798.115	Right to know about selling/sharing
1798.120	Right to opt-out
1798.121	Limit use of sensitive PI
1798.125	Non-discrimination
1798.130	Notice and request handling
1798.135	Do Not Sell link
1798.185	CPRA risk assessment

generate_nist_privacy_profile()

Map activity against NIST Privacy Framework functions.

profile = engine.generate_nist_privacy_profile(
    activity_id="PA-XXXXXXXX",
    target_tier="tier_3",  # tier_1|tier_2|tier_3|tier_4
)
# Returns: coverage per function (ID-P, GV-P, CT-P, CM-P, PR-P)

generate_remediation_plan()

Prioritized remediation action items.

plan = engine.generate_remediation_plan(
    activity_id="PA-XXXXXXXX",
    risk_report=risk_report,
    gdpr_report=gdpr_report,
    ccpa_report=ccpa_report,
)

Priority Levels:

Priority	Severity	Deadline
P1	CRITICAL	14 days
P2	HIGH	30 days
P3	MEDIUM	60 days
P4	LOW	90 days

generate_dpia_report()

Generate formal DPIA report document.

engine.generate_dpia_report(
    activity_id="PA-XXXXXXXX",
    output_path="dpia_report.json",
    format="json",
)

CLI Usage

# Run demonstration workflow
python agent.py --action demo --org "Acme Corp" --output report.json

# Run screening checklist
python agent.py --action screening

# Specify DPO email
python agent.py --action demo --dpo-email dpo@acme.com --output dpia.json

References

• ICO DPIA Guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/
• NIST Privacy Framework: https://www.nist.gov/privacy-framework
• NIST PRAM: https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/collaboration-space/privacy-risk-assessment
• GDPR Full Text: https://gdpr-info.eu/
• CCPA Full Text: https://oag.ca.gov/privacy/ccpa
• IAPP PIA Template: https://iapp.org/resources/article/private-sector-privacy-impact-assessment-template/

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.