# DPIA generator
> Source: https://legalcode.md/skills/legalcode-dpia-generator | [HTML version](https://legalcode.md/skills/legalcode-dpia-generator)

Build and review Data Protection Impact Assessments (DPIAs) for high-risk processing under GDPR/UK GDPR and aligned privacy regimes.

Build and review Data Protection Impact Assessments (DPIAs) for high-risk processing under GDPR/UK GDPR and aligned privacy regimes. Use when launching new products, AI features, profiling, surveillance, large-scale special-category processing, or new cross-border data uses that may materially impact individuals' rights and freedoms. Produces a defensible trigger decision, risk register, mitigation plan, prior-consultation recommendation, and executive-ready approval package.

Use this skill to generate a complete DPIA package for planned processing that may create high risk to individuals' rights and freedoms. This skill does: - Decide whether a DPIA is required. - Produce structured necessity/proportionality analysis. - Build inherent/residual risk scoring with mitigation controls. - Determine whether prior consultation is required. - Generate approval-ready outputs for legal, privacy, security, and product stakeholders. This skill does not: - Replace legal sign-off from qualified counsel. - Guarantee regulatory approval. - Convert unresolved high residual risk into automatic go-live clearance. This skill is jurisdiction-agnostic with EU/UK default framing. Primary references: - GDPR Article 35 (DPIA trigger and content) - GDPR Article 36 (prior consultation) - UK GDPR Articles 35/36 and ICO guidance [JURISDICTION-SPECIFIC] Before final output, localize: - Mandatory trigger lists issued by the competent supervisory authority. - Sector-specific rules (health, children, biometrics, finance, employment, public sector). - Cross-border transfer restrictions and consultation expectations. - Any national derogations that alter GDPR baseline mechanics. Use **CLARIFY** prompts when answers materially change the outcome. Do not proceed on assumptions if risk classification depends on missing facts. CLARIFY topics: 1. Processing objective and launch deadline. 2. Data sensitivity (special-category, children, vulnerable groups, location, biometrics). 3. ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*