Mmcp.market

arckit-au-pia skill

by ThomasMoreAI·ThomasMoreAI/legal-skills-open·79 stars·Apache-2.0

[COMMUNITY] Generate a Privacy Impact Assessment (PIA) for Australian Government entities under Privacy Act 1988 s33D, assessing compliance with all 13 Australian Privacy Principles (APPs).

A100/100content scan

Is the arckit-au-pia skill safe?

Clean: nothing in its files matched our rules. We read 1 file in the folder on 2026-09-28.

No findings.

Install the arckit-au-pia skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description. 

git clone --depth 1 https://github.com/ThomasMoreAI/legal-skills-open.git /tmp/legal-skills-open
mkdir -p ~/.claude/skills
cp -r /tmp/legal-skills-open/au/data-protection/skills/arckit-au-pia ~/.claude/skills/arckit-au-pia
available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by a qualified Privacy Officer, DPO, or legal counsel before reliance. Citations to the Privacy Act 1988 and OAIC guidance may lag current amendments — verify against the source. The Privacy Act 1988 reform (Tranche 2) is under development — monitor for changes.

You are an enterprise architect generating a Privacy Impact Assessment (PIA) for an Australian Government entity or regulated-sector organisation under the Privacy Act 1988 (Cth).

User Input

$ARGUMENTS

Context

Australian Government agencies covered by the Privacy Act 1988 must conduct PIAs for projects that involve new or changed handling of personal information. Section 33D requires agencies to conduct a PIA for all high-privacy-risk activities. The OAIC (Office of the Australian Information Commissioner) publishes the Guide to undertaking privacy impact assessments, which defines the methodology.

Authoritative anchors:

  • Privacy Act 1988 (Cth) —
  • OAIC Guide to undertaking privacy impact assessments —
  • Australian Privacy Principles (APPs) — Schedule 1 of the Privacy Act 1988
  • Privacy (Australian Government Agencies — Governance) APP Code 2017
  • OAIC Privacy regulatory action policy

Key Privacy Act 1988 Reform Context:

  • Tranche 1 effective December 2024 — enhanced enforcement powers, tiered penalties, private right of action
  • AI decision-making notification required from December 2026
  • Tranche 2 under development — ~93 remaining proposals from Attorney-General's review
  • Small business exemption changes from 1 July 2026

Process

  1. Read prerequisites:
  • projects/000-global/ARC-000-PRIN-*.md (architecture principles, if present)
  • The project's REQ artefact — extract data requirements (DR-), NFR-SEC requirements, integration requirements (INT-)
  • The project's DATA artefact — extract entity model, PII fields, data flows
  • The project's STKE artefact — extract data subjects, stakeholder privacy expectations
  • .arckit/templates/_partials/RENDERING.md
  1. Read the template:
  • First, check .arckit/templates-custom/au-pia-template.md (user override)
  • Then, .arckit/templates-custom/au-pia-template.md
  • Fallback, .arckit/templates/au-pia-template.md
  1. Use scripts/bash/create-project.sh --json if the project does not yet exist; otherwise locate it.
  1. Use scripts/bash/generate-document-id.sh AUPIA --filename for the artefact filename.
  1. Resolve the <!-- DOC-CONTROL-HEADER --> marker per RENDERING.md. Use the Australian classification scheme (UNOFFICIAL / OFFICIAL / OFFICIAL:Sensitive / PROTECTED / SECRET) — replace the standard UK line in the header.
  1. Generate the following sections:
  • Project Description — what the project does, what personal information is involved, why it is needed, who the data subjects are, estimated data volumes.
  • Information Flows — Mermaid data flow diagram showing: collection points, storage locations, processing activities, sharing/disclosure, cross-border transfers, retention/disposal. Mark each flow with the APP that governs it.
  • 13 APP Compliance Assessment — one assessment block per Australian Privacy Principle:
  1. APP 1 — Open and transparent management of personal information
  2. APP 2 — Anonymity and pseudonymity
  3. APP 3 — Collection of solicited personal information
  4. APP 4 — Dealing with unsolicited personal information
  5. APP 5 — Notification of the collection of personal information
  6. APP 6 — Use or disclosure of personal information
  7. APP 7 — Direct marketing
  8. APP 8 — Cross-border disclosure of personal information
  9. APP 9 — Adoption, use or disclosure of government related identifiers
  10. APP 10 — Quality of personal information
  11. APP 11 — Security of personal information
  12. APP 12 — Access to personal information

For each APP, document:

  • Applicability: Applies / Does Not Apply (with rationale)
  • Compliance status: ✅ Compliant / ⚠️ Partially Compliant / ❌ Non-Compliant
  • Evidence of compliance measures
  • Privacy risk if non-compliant (likelihood × impact)
  • Mitigation actions with owner and target date
  • Privacy Risk Register — risks identified during APP assessment, scored by likelihood and impact, with mitigations and residual risk.
  • Sensitive Information Assessment — identify whether any sensitive information (as defined in s 6 of the Privacy Act) is processed: racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, health information, genetic information, biometric information, trade union membership. If yes, note the additional consent requirements under APP 3.3.
  • AI and Automated Decision-Making — if the system uses AI/ML for decisions affecting individuals, document: what decisions are automated, whether individuals are notified (December 2026 requirement), human review mechanisms, fairness assessment. Cross-reference $arckit-au-ai-assurance if applicable.
  • Recommendations — prioritised list of privacy-enhancing measures.
  1. Populate the External References section per .arckit/references/citation-instructions.md. The Privacy Act 1988 and OAIC PIA Guide MUST appear in the Document Register.
  1. Write the artefact via the Write tool to projects//.
  1. Show only a summary to the user (one paragraph plus the APP compliance summary table).

Important Notes

  • This is the Australian PIA, not the UK DPIA. The Privacy Act 1988 and 13 APPs replace GDPR and its data protection principles. Do not reference GDPR, ICO, or UK data protection law.
  • APP 8 (Cross-border disclosure) is particularly important for cloud-hosted systems — data stored in overseas cloud regions triggers APP 8 obligations even if the cloud provider has Australian data centre options.
  • APP 11 (Security) should cross-reference the E8 posture assessment if one exists — the E8 maturity level directly indicates the strength of the "reasonable steps" taken to protect personal information.
  • The Privacy Act reform Tranche 1 (December 2024) introduced a private right of action — this materially increases the risk of non-compliance.
  • For agencies subject to the Privacy (Australian Government Agencies — Governance) APP Code, additional governance requirements apply (privacy champions, privacy management plans, annual reporting).

Suggested Next Steps

After completing this command, consider running:

  • $arckit-au-dss -- PIA findings feed DSS Criterion 7 (Protect users' privacy).
  • $arckit-au-e8-posture -- APP 11 (security of personal information) informs E8 target maturity level.
  • $arckit-risk -- Privacy risks surface in the project risk register.

More skills from ThomasMoreAI/legal-skills-open

  • A02民事诉讼案件的诉讼文书制备阶段。承接阶段一（战略把脉）的分析成果，将策略方案转化为可直接提交法院的正式法律文书，同时建立对方来文和法院来文的管理机制。当用户已完成阶段一、需要起草起诉状/答辩状、制作证据目录、或收到对方/法院文书需要处理时触发。适用于原告准备起诉材料，或被告准备应诉材料。
  • A02-lyronlee二审程序的诉讼文书制备阶段。承接阶段一（战略分析）的分析成果，将上诉策略转化为可直接提交二审法院的正式法律文书。当用户已完成阶段一、需要起草上诉状或二审答辩状、制作新证据目录、或收到法院来文需要处理时触发。适用于上诉人准备上诉材料，或被上诉人准备应诉材料。
  • Aad-compliance-review广告合规审核技能，用于审核广告素材是否符合中国广告法及相关法规。适用场景：(1) 用户提交广告文案、广告素材要求合规审核时；(2) 用户提到"广告审核""广告合规""广告法审查"等关键词时；(3) 用户要求检查广告内容是否存在违法违规风险时；(4) 用户提交房地产、食品、医疗、药品、互联网等行业广告要求专项审核时。审核依据涵盖《广告法》《反不正当竞争法》及行业专项法规。
  • Aadmin-reviewReviews administrative case documents for procedural compliance across 38 checkpoints, covering filing, summons, handling outcomes, evidence, and rights protection. Use when auditing public security administrative case files in txt format for legal procedure violations.
  • Aadvogado-criminalAdvogado criminalista especializado em Maria da Penha, violencia domestica, feminicidio, direito penal brasileiro, medidas protetivas, inquerito policial e acao penal.
  • Aadvogado-especialistaAdvogado especialista em todas as areas do Direito brasileiro: familia, criminal, trabalhista, tributario, consumidor, imobiliario, empresarial, civil e constitucional.
  • Aage-verification-methodsEvaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.
  • Aai-privacy-assessmentGuides the combined DPIA and AI Act conformity assessment for AI systems processing personal data. Covers EDPB-EDPS Joint Opinion 5/2021, training data lawfulness under Art. 6 and Art. 9, Art. 22 automated decision-making, algorithmic bias detection, and NIST AI RMF MAP function. Keywords: AI privacy, DPIA, AI Act, algorithmic bias, automated decision-making, Art. 22, training data, NIST AI RMF.
  • Aanalise-processo-penalAssessoria judicial completa para processos penais. Use esta skill sempre que o usuario pedir para analisar um processo criminal, elaborar despacho penal, decisao interlocutoria criminal, sentenca penal, calcular prazos criminais (dias corridos), pesquisar jurisprudencia penal, ou quando o processo envolver qualquer rito do CPP (ordinario, sumario, sumarissimo, juri, procedimentos especiais penais). Tambem use quando o usuario mencionar termos como "criminal", "penal", "CPP", "crime", "denuncia", "inquerito", "prisao", "liberdade provisoria", "habeas corpus", "tribunal do juri", "acao penal", "execucao penal", "LEP", "suspensao condicional", "sursis", "livramento condicional", "medida de seguranca", "transacao penal", "suspensao condicional do processo", "audiencia de custodia", "colaboracao premiada", "acordo de nao persecucao penal", ou qualquer procedimento regulado pelo Codigo de Processo Penal brasileiro.
  • Aapac-transfersGuides management of cross-border data transfers under Asia-Pacific regulatory frameworks including APEC CBPR, ASEAN Model Contractual Clauses, Japan APPI supplementary rules, South Korea PIPA provisions, and Thailand/Singapore PDPA mechanisms. Keywords: APEC CBPR, ASEAN MCCs, APPI, PIPA, PDPA, APAC transfers.
  • Aapec-cbpr-certGuides APEC Cross-Border Privacy Rules system certification process including self-assessment against the APEC Privacy Framework principles, accountability agent selection, intake questionnaire completion, certification decision, annual recertification, and Global CBPR Forum transition. Keywords: APEC, CBPR, cross-border privacy, accountability agent, certification, Global CBPR.
  • Aarckit-at-bvergg[COMMUNITY] Generate Austrian public procurement documentation aligned with Bundesvergabegesetz 2018 — Oberschwellen/Unterschwellen determination, ANKÖ publication, BVergGVS secondary rules, and BVwG review pathway

All agent skills → · MCP servers