dpia-screening
Use this at design time, before a processing activity starts or changes, one activity per screening. If the processing already runs, screen it now and record that it is late as a draft corrective action for the privacy lead. You get two files in a new folder, ./dpia-screening/: a short note per activity saying whether a full data protection impact assessment (DPIA) is needed and why (<activity>-screening.md), and a running list with one line per screening (screening-log.md). This skill drafts for a human to review and sign; this skill never marks a control effective. The controller decides whether a DPIA is carried out, after the data protection officer's advice where one is designated.
Inputs to gather
Read the feature specification or vendor proposal, the record of processing entry if one exists, the data model, and any prior DPIA on similar processing. Ask the reader, in one message: how many people the processing touches in a year and what share of the population that is, whether any decision about a person is made or shaped automatically, whether employees, children, patients or other vulnerable people are involved, and where the main EU establishment is.
Step 1: describe the processing in numbers
Write one paragraph a stranger could assess: purpose, people and data categories (flag special category and criminal offence data), sources, systems and vendors, recipients, transfers, retention, technology. Then quantify scale: people, records, duration, geographic reach; "large" without numbers cannot be reviewed. If the reader cannot give numbers, record a range and the assumption, and make "real volumes confirmed" a re-screen trigger.
Step 2: test against the cases the law names
Article 35(3) of the GDPR names three cases: systematic and extensive automated evaluation, including profiling, leading to decisions with legal or similarly significant effects; large-scale special category or criminal offence data; and large-scale systematic monitoring of a publicly accessible area. If one fits, the outcome is "required".
Step 3: check the supervisory authority's lists
Each supervisory authority lists processing types that need an assessment; some also list types that do not. Ask the reader to open, on the authority's own website, the list for the main establishment (and any country whose people the processing targets), and record matching and non-matching entries, quoting them. Where a list names the processing, it settles the question over the criteria below.