performing-privacy-impact-assessment

# Performing Privacy Impact Assessment ## When to Use - When launching a new system, product, or processing activity that handles personal data - When conducting GDPR Article 35 Data Protection Impact Assessments (DPIAs) - When evaluating CCPA/CPRA compliance for data processing operations - When performing privacy risk assessments aligned to the NIST Privacy Framework - When mapping data flows across organizational boundaries and third-party processors - When building automated privacy governance and assessment pipelines - When preparing for regulatory audits or demonstrating accountability obligations ## Prerequisites - Familiarity with GDPR, CCPA/CPRA, and NIST Privacy Framework concepts - Access to data processing inventories and system architecture documentation - Python 3.8+ with required dependencies installed - Appropriate authorization from the Data Protection Officer (DPO) or privacy team - Knowledge of organizational data flows and third-party processor relationships ## Instructions ### Phase 1: Data Inventory and Processing Activity Catalog Build a complete inventory of personal data processing activities. Each record of processing activity (ROPA) entry must capture the data categories, legal basis, retention periods, and data subjects involved. ```python from agent import PrivacyImpactAssessmentEngine engine = PrivacyImpactAssessmentEngine() # Register a processing activity for assessment activity = engine.register_processing_activity( name="Custome...