Run privacy impact assessment

Skill alexe-ev/product-plugins/risk-compliance/skills/run-privacy-impact-assessment

Run a privacy impact assessment (PIA) for a product feature or initiative that collects, processes, or uses personal data. Use this skill when a new feature has privacy implications that need to be evaluated before launch.From its SKILL.md

Install

npx -y skills add alexe-ev/product-plugins --skill run-privacy-impact-assessment

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.6 KB, 488 tokens by cl100k_base, as published. Nobody here has run it

Run Privacy Impact Assessment

Purpose

Help teams conduct a structured privacy impact assessment that identifies personal data flows, evaluates privacy risks, and defines mitigations — before launching a feature, not after.

Skill type

Conceptual skill

Use this skill when

A new feature collects, processes, or uses personal data
A data-sharing or third-party integration is being introduced
Regulatory requirements (GDPR, CCPA, HIPAA) require a formal PIA
A privacy risk needs to be evaluated before stakeholder approval

Do not use this skill when

The goal is general security risk assessment (use assess-privacy-security-regulatory)
The goal is AI-specific governance (use govern-responsible-ai)

Required inputs

Feature or initiative description
Types of personal data involved (or potentially involved)
Target market / geography

Optional inputs

Data flow diagram
Applicable regulations
Vendor or third-party data sharing
Legal team requirements

Upstream context

Works best when:

Feature is defined
Privacy regulations applicable to the product are known

Downstream handoff

Output can feed:

plan-risk-mitigation (privacy risks → mitigation plan)
write-requirements-prd (privacy requirements → product requirements)
govern-responsible-ai (PIA intersects with AI governance for AI features)

Instructions

Identify all personal data collected or processed by the feature.
Map the data flow: collection → processing → storage → sharing → deletion.
Identify applicable regulations and their requirements.
Assess privacy risks at each stage of the data flow.
Evaluate risk severity: likelihood × impact on individuals.
Define mitigations for each identified risk.
Define residual risk and whether it is acceptable.

Output

Provide:

Personal data inventory (type, sensitivity, volume)
Data flow map
Applicable regulations and requirements
Privacy risks by data flow stage
Risk severity assessment
Mitigations per risk
Residual risk assessment
Recommendation: proceed / proceed with conditions / don't proceed