GDPR DPIA screening and risk summary
gdpr_dpia_screeningRead-onlyIdempotent
Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is required or how risky it is. Applies GDPR Art. 35(3), national lists and the nine WP248 rev.01 criteria, scores necessity and mitigation, and gives an indicative residual risk. Call without input to get the questions; every input is optional.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "gdpr_dpia_screening"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| c1 | No | Does the processing evaluate or score people (profiling or predicting their performance, finances, health, preferences, reliability, behaviour or location)? | |
| c2 | No | Does it involve automated decisions with legal or similarly significant effects (for example access to credit, a job or a service)? | |
| c3 | No | Does it involve systematic monitoring of people (for example online tracking, employee monitoring or CCTV)? | |
| c4 | No | Does it involve sensitive or highly personal data (special category or criminal data, financial data, location data or private communications)? | |
| c5 | No | Is the processing large-scale (many people, a large volume or range of data, a long duration or a wide geographic area)? | |
| c6 | No | Does it combine or match datasets from different sources in ways people would not expect? | |
| c7 | No | Does it concern vulnerable people (children, employees, patients, the elderly, or others in an unequal relationship with you)? | |
| c8 | No | Does it use innovative technology or a new way of using existing technology (for example AI, biometrics or IoT)? | |
| c9 | No | Could the processing itself prevent people from exercising a right or using a service or contract (for example credit screening that decides whether to offer a loan)? | |
| m1 | No | Encryption of personal data at rest and in transit | |
| m2 | No | Pseudonymization or anonymization where possible | |
| m3 | No | Access controls limiting who can view/modify the data | |
| m4 | No | Regular security testing (vulnerability scans, penetration tests) | |
| m5 | No | Staff training on data protection for those handling the data | |
| m6 | No | Data minimization — collecting only what is strictly necessary | |
| m7 | No | Automated deletion at end of retention period | |
| m8 | No | Incident response plan covering this processing activity | |
| m9 | No | Regular audits or reviews of the processing activity | |
| r1 | No | Risk of unauthorized access to personal data (data breach) | |
| r2 | No | Risk of data being used for purposes beyond what was communicated | |
| r3 | No | Risk of inaccurate data leading to wrong decisions about individuals | |
| r4 | No | Risk of excessive data collection beyond what is needed | |
| r5 | No | Risk of insufficient transparency — individuals unaware of processing | |
| r6 | No | Risk of discrimination or unfair treatment based on the processing | |
| r7 | No | Risk of financial loss or economic disadvantage to individuals | |
| r8 | No | Risk of reputational damage or social disadvantage to individuals | |
| r9 | No | Risk of physical harm or safety concerns | |
| t1 | No | Will you systematically and extensively evaluate people by automated means (including profiling), and base decisions on it that have legal or similarly significant effects on them? | |
| t2 | No | Will you process special category data (health, biometric, genetic, racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation) or criminal conviction data on a large scale? | |
| t3 | No | Will you systematically monitor a publicly accessible area on a large scale (for example CCTV in shops, stations or streets)? | |
| t4 | No | Is this type of processing on your supervisory authority's published list of operations that require a DPIA? | |
| x1 | No | Will personal data be transferred outside the EU/EEA (including remote access from outside the EEA)? | |
| m10 | No | Data Processing Agreements with all third-party processors | |
| m11 | No | Privacy by design principles applied in system architecture | |
| m12 | No | Mechanism for data subjects to exercise their rights easily | |
| r10 | No | Risk of loss of confidentiality (e.g. medical or legal privilege) | |
| nec1 | No | Is the processing necessary to achieve the stated purpose, or could the purpose be achieved with less data? | |
| nec2 | No | Is the amount of data collected proportionate to the purpose? | |
| nec3 | No | Is the retention period limited to what is necessary? | |
| nec4 | No | Are data subjects adequately informed about the processing (transparency)? | |
| nec5 | No | Can data subjects exercise their rights (access, rectification, erasure, portability)? | |
| nec6 | No | If relying on consent, is it freely given, specific, informed, and withdrawable? | |
| nec7 | No | If relying on legitimate interest, has a balancing test been conducted? | |
| proj_data | No | Categories of personal data | |
| proj_legal | No | Legal basis for processing | |
| proj_subjects | No | Categories of data subjects |