Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →lawve-ai/dpia-sentinel-oliver-schmidt-prietz
GDPR Data Protection Impact Assessment (DPIA) guidance under Article 35 GDPR, EDPB Guidelines WP 248 rev.01, EDPB Opinion 28/2024 (AI), and national SA blacklists/whitelists. Triggers: "DPIA", "DSFA", "Datenschutz-Folgenabschätzung", "impact assessment", "Art. 35", "do I need a DPIA", descriptions of new high-risk processing (profiling, AI, biometrics, large-scale monitoring, special category data), Art. 36 prior consultation questions, national blacklist/whitelist queries.
Passed 19 of 22 test cases with the skill, and 15 of 22 without it.
and 4 more in the full report
4 fixed15 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are planning to launch an automated AI recruitment platform that evaluates candidate video interviews and CVs to score job applicants. Our main company hub is located in Germany, but we are interviewing candidates based in both Germany and France. Could you run an initial evaluation to tell us if we are legally obligated to perform a DPIA for this system? Please provide a formal threshold breakdown showing whether any absolute statutory triggers apply, an analysis against relevant European guidelines criteria, and local supervisory authority list checks, concluding with a clear mandatory/recommended/not required outcome.
| Checked | Without skill | With skill |
|---|---|---|
| Disclaims that the evaluation provides structured GDPR Article 35 guidance rather than formal legal advice. | Missed | Passed |
| Identifies the Article 35(3)(a) absolute statutory trigger for systematic and extensive automated evaluation of personal aspects. | Passed | Passed |
| Evaluates threshold requirements against supervisory authority lists for both Germany and France. | Passed | Passed |
The instructions your model reads when the skill loads.
Important: This skill provides structured GDPR Article 35 guidance based on EDPB Guidelines and national SA requirements. It is not legal advice. Involve your DPO (Art. 35(2)) and qualified counsel for final decisions.
Determine what the user needs and load references accordingly:
| User Need | Load These References | Action |
|---|---|---|
| "Do I need a DPIA?" / threshold question | references/edpb-criteria.md + relevant jurisdiction file(s) | Run threshold assessment |
| Full DPIA | edpb-criteria.md + jurisdiction(s) + references/risk-catalog.md + scoring.md | Walk through assessment phases |
| Document generation (.docx) — custom format | references/dpia-custom-population.md + references/templates.md + docx skill | Populate custom template .docx (unpack → fill tables → repack) |
| Document generation (.docx) — EDPB 2026 format | references/edpb-2026-population.md + references/edpb-2026-template.md + docx skill | Populate official EDPB template .docx (unpack → fill tables → repack) |
| Specific legal question | Load relevant reference only | Answer directly |
Jurisdiction selection: Ask two questions: (1) Where is the controller's main establishment? (2) Where are the data subjects located? Load all jurisdiction files that are relevant — this may be multiple files for multi-jurisdictional processing. See references/edpb-criteria.md → "Multi-Jurisdictional DPIA Analysis" for the full decision framework.
Available jurisdiction files:
references/jurisdictions/de-dsk.md — Germanyreferences/jurisdictions/fr-cnil.md — Francereferences/jurisdictions/ie-dpc.md — Irelandreferences/jurisdictions/be-apd.md — Belgiumreferences/jurisdictions/nl-ap.md — Netherlandsreferences/jurisdictions/it-garante.md — Italyreferences/jurisdictions/pl-uodo.md — Polandreferences/jurisdictions/whitelists.md — France, Czech Republic, Spain, AustriaFor jurisdictions not covered by a dedicated file, rely on the EDPB nine-criteria analysis in references/edpb-criteria.md and note that the user should check their national SA's Art. 35(4) list directly.
Threshold → Description → Asset Inventory → Necessity → Proportionality → Inherent Risks (Track A+B) → Mitigations → Residual Risk → Art. 36 Check → Documentation
This is the logical sequence, not a rigid script. Adapt to the user: if they provide rich context upfront, skip intake questions. If they're experienced, move faster. If they're new to DPIAs, explain more.
Asset Inventory (per EDPB Template 2026, Section 1.3): Collect risk-relevant assets — hardware, software, APIs/models, personnel, sites/premises, organisational assets. Group by logical module or technical layer. Include only assets whose compromise would plausibly impact data subjects' rights and freedoms.
test cases passed, vs 15 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.