mirrors / tractorjuice--arckit-gemini

项目文件夹

文件

T

wehub-resource-sync 4050a9af7b chore: import upstream snapshot with attribution

2026-07-13 12:35:03 +08:00

2.5 KiB

原始文件 永久链接 Blame 文件历史

Data Protection Impact Assessment (DPIA) Guide

Guide Origin: Official | ArcKit Version: [VERSION]

/arckit:dpia delivers a GDPR-compliant DPIA whenever processing could present high risk to individuals.

Minimum Inputs

Artefact	Purpose
`ARC-<id>-DATA-v1.0.md`	Supplies PII inventory, lawful basis, retention
Stakeholder analysis	Highlights vulnerable groups, consultation needs
Risk register	Seeds privacy risk scoring and mitigations

Trigger Checklist

Tick any that apply (two or more = DPIA mandatory per ICO):

Evaluation or scoring (profiling, ranking, credit risk)
Automated decisions with legal/significant effect
Systematic monitoring or surveillance
Special category or criminal offence data
Large scale processing (volume, geography, duration)
Dataset matching/combining
Vulnerable data subjects (children, patients, benefit claimants, etc.)
Innovative technology (AI/ML, biometrics, IoT)
Restricts ability to exercise data rights

ArcKit screens these automatically; use the list to confirm completeness.

Command

/arckit:dpia Generate DPIA for <project>

Output: projects/<id>/ARC-<id>-DPIA-v1.0.md

Auto-versioning: Re-running this command when a document already exists automatically increments the version (minor for refreshed content, major for changed scope) instead of overwriting.

Action Flow

1. Confirm prerequisites (data model + stakeholders + risks)
2. Run /arckit:dpia
3. Review:
   - Screening result and justification
   - Risk table and residual scores
   - Mitigation action plan and owners
4. Log actions in backlog/assurance tracker
5. Re-run after mitigations; seek ICO consultation if residual risk remains “High”

Sections to Validate

Section	Focus	Reviewer
Screening	Criteria flagged for Article 35	Data Protection Officer
Processing Description	Purposes, categories, data flows	Service Owner / Product
Risk & Impact	Harm scenarios, likelihood, severity	Security, Legal
Mitigations & Controls	Technical/organisational measures	Engineering & Operations
Sign-off	DPO, SIRO/SRO, Project Lead	Governance board

Linkages

Feed mitigation actions into /arckit:risk and /arckit:servicenow.
Reference DPIA outcomes in /arckit:ai-playbook and /arckit:secure.
Store signed versions with review cadence (minimum annual refresh or when processing changes).

2.5 KiB 原始文件 永久链接 Blame 文件历史