Add privacyImpact / DPIA objects to link personal-data processing, DPIA outcomes, and mitigations

[github-actions]

Motivation

Automotive TARAs increasingly intersect with personal data (telematics, driver profiles, location, biometrics). Regulators and data-protection bodies (GDPR/EDPB, national DPAs) expect Data Protection Impact Assessments (DPIAs) where processing is high-risk. Embedding structured, machine-readable privacy/DPIA metadata in RDX improves traceability (which assets/processes handle personal data), supports compliance workflows, and helps tie privacy mitigations to controls and risk treatment decisions.

Related RDX requirements: RDX-012 (assets/CIA), RDX-015 (damageScenarios), RDX-051 (risk treatment decisions), RDX-004 (provenance & governance), and UC use cases around sharing risk info (RDX-067..069). Proposed new requirement: RDX-202 (privacyImpact / DPIA support). (new requirement)

Proposed change

Add an optional privacyImpact array at riskSet level. Each privacyImpact entry SHOULD include the following fields:

• id (string)
• title (string)
• description (string)
• relatedAssetIds (array[string]) — cross-reference to assets[].id that process personal data.
• processingActivities (array of objects) — each with { "id", "activity", "dataCategories": ["personal_data","location","biometric","identifiers","profiling"], "purpose" }.
• dataCategories (array[string]) — high-level data categories per EDPB / DPIA templates.
• legalBasis (string, optional) — controller legal basis (consent, contract, legalObligation, legitimateInterest, etc.).
• likelihood (number/string) and severity (number/string) — privacy risk assessment axes to support mapping into RDX riskLevels.
• dpiaRequired (boolean) — whether a DPIA is required under GDPR/EDPB criteria.
• dpiaOutcome (object) — { "completed": boolean, "date": date, "summary": string, "recommendations": [string], "authorityNotified": boolean }.
• mitigations (array[string]) — control ids that mitigate privacy risks (link to controls[].id).
• references (array[string]) — links to DPIA documents, legal opinions, or supervisory authority items.

Schema/encoding notes:

• Add privacyImpact to JSON Schema and XSD as optional.
• Provide examples/rdx-privacy-impact.json showing a connected-vehicle telematics asset with a privacyImpact entry that references controls (e.g., data minimization, encryption) and a DPIA outcome.

Interoperability notes:

• Map dataCategories to the EDPB DPIA template fields to ease automated report generation. When detailedDPIA documents exist externally, references may point to external PDFs or to CycloneDX evidence BOMs (BOM-Link).

References

• European Data Protection Board (EDPB) — DPIA template and guidance (2026). https://edpb.europa.eu/news/enhancing-compliance-and-consistency-edpb-adopts-dpia-template_ga and DPIA explainer PDF. (edpb.europa.eu)
• PeTARA — privacy‑enhanced TARA method for connected vehicles (recent research applying privacy-aware TARA). https://www.sciencedirect.com/science/article/pii/S2214212626000384. (sciencedirect.com)
• EDPS TechDispatch on Connected Vehicles — privacy considerations in vehicles. https://edps.europa.eu/data-protection/our-work/publications/techdispatch/techdispatch-3-connected-cars. (edps.europa.eu)

Acceptance criteria

1. Schema: add optional privacyImpact[] object to JSON Schema and XSD with fields listed above and include RDX-202 in REQUIREMENTS.md.
2. Examples: add examples/rdx-privacy-impact.json that links a telematics asset to a privacyImpact entry, demonstrates detailedDPIA reference via BOM-Link, and shows mitigations mapping to existing controls[].id entries.
3. Documentation: update methodology/UseCases.md (or create a short methodology/Privacy-Impact.md) that shows how to populate privacyImpact and how to generate a machine-readable DPIA export for Data Protection Officers or supervisory authorities.
4. CI/validation: add schema validation unit tests for privacyImpact and ensure all new examples validate.
5. Interop: provide mapping guidance in the doc showing how privacyImpact.dataCategories align with EDPB DPIA template fields so organizations can produce a DPIA report from RDX data.
6. Backwards compatibility: files without privacyImpact remain valid; consumers that don't handle privacy objects ignore them.

---

Generated by tools/ai_idea_scout.py via the AI Idea Scout workflow.
Review the proposal, refine the title/body/labels, and close if not desired.