GDPR DPIA (Data Protection Impact Assessment)

A DPIA is a structured risk analysis required under GDPR Article 35 for "high-risk" processing. It's also the artifact every audit, customer security review, and ICO query asks for. This skill produces a defensible DPIA from your codebase reality — not a copy-pasted template.

When to use

• Starting a new product/feature processing EU personal data.
• Adding processing of "special category" data (health, biometrics, religion, politics, sexual orientation, etc.).
• Large-scale systematic monitoring (CCTV, behavioral analytics).
• Profiling or automated decision-making with legal/significant effect.
• Audit / customer security review demands the DPIA.
• Onboarding to a product that doesn't have one — retroactive DPIA is better than no DPIA.

When NOT to use

• Pure B2B with no consumer data and no employee monitoring — usually below DPIA threshold.
• Processing types explicitly listed by your DPA (Data Protection Authority) as low-risk.
• One-off, ad-hoc data use — usually doesn't trigger DPIA but document the assessment.