Back to Guides

/gcloud-kit:dpia

Generate a Data Protection Impact Assessment following ICO guidelines for a G-Cloud service.

Overview

Creates a comprehensive DPIA that evaluates data protection risks for your cloud service. Performs the ICO 9-criteria screening test, maps data flows, assesses lawful basis, scores risks using a 5x5 matrix, and links mitigations to NCSC Cloud Security Principles. Essential for services processing personal data at scale or using innovative technologies.

Usage

/gcloud-kit:dpia My Cloud Platform

Arguments: Service name (must match an existing service directory).

Prerequisites

  • Supplier profile (services/supplier/supplier-profile.md) -- required
  • Service design (services/{name}/service-design.md) -- required
  • SDD (services/{name}/sdd.md) -- required
  • Security evidence (services/{name}/security.md) -- optional, enriches mitigation coverage

Output

services/{name}/dpia.md

Template used: plugin/templates/dpia-template.md

What it does

  1. Loads context from supplier profile, service design, SDD, and security evidence
  2. Reads the DPIA template and compliance frameworks reference
  3. Performs ICO 9-criteria screening test (2+ triggers = DPIA required)
  4. Documents processing description: data categories, subjects, purposes, retention
  5. Maps controller/processor roles using standard G-Cloud model (buyer=controller, supplier=processor)
  6. Assesses lawful basis for each processing activity (UK GDPR Article 6)
  7. Maps data flows and international transfers with transfer mechanisms
  8. Scores 10 risk categories using 5x5 likelihood/impact matrix
  9. Links mitigations to NCSC Cloud Security Principles from compliance-frameworks.md
  10. Builds sub-processor register from SDD third-party references
  11. Generates consultation log and sign-off table

Key sections

  • ICO Screening Test -- 9 criteria with Y/N and rationale
  • Processing Description -- data categories, subjects, purposes, retention
  • Controller/Processor Roles -- G-Cloud standard role matrix
  • Lawful Basis -- Article 6 and Article 9 assessment
  • Data Flows -- Mermaid diagram, international transfer mechanisms
  • Risk Assessment -- 5x5 matrix, 10 risk categories (Low/Medium/High/Critical)
  • Mitigations -- linked to NCSC principles, implementation status
  • Sub-Processor Register -- name, country, purpose, safeguards

Related commands