Add Comprehensive Ethyca DPIA (EDPIA) assessment template

[thabofletcher]

Summary

Adds a Comprehensive Ethyca DPIA (EDPIA) assessment template that consolidates requirements from multiple privacy frameworks into a single, de-duplicated privacy impact assessment.

Frameworks covered:

• GDPR DPIA (Article 35, EDPB WP248 rev.01)
• UK GDPR DPIA (ICO guidance, Age Appropriate Design Code/Children's Code)
• California CPRA Risk Assessment (CPPA Section 7150-7153)
• Colorado CPA DPA (C.R.S. § 6-1-1309, 4 CCR 904-3 Rules 8.04-8.09)
• Virginia VCDPA DPA (Va. Code Ann. § 59.1-580)
• Connecticut DPA and other US state privacy laws
• Best Practice PIA (ISO 29134, CNIL, NIST)

Template details:

• 57 de-duplicated questions across 15 thematic groups
• Each question's guidance references all applicable regulatory sources
• Fides source mappings for automated pre-population where applicable
• Single document satisfies compliance across all covered jurisdictions

Question groups:

1. Processing Overview (5 questions)
2. Data Inventory (4 questions)
3. Legal Basis and Compliance (4 questions)
4. Data Flows and Recipients (5 questions)
5. Data Retention (3 questions)
6. Automated Decision-Making and Profiling (4 questions)
7. Risk Assessment (5 questions)
8. Risk Mitigation Measures (5 questions)
9. Benefits vs. Risks Analysis (4 questions)
10. Transparency and Individual Rights (3 questions)
11. Children and Vulnerable Groups (3 questions)
12. Contractual Safeguards (2 questions)
13. Consultation (5 questions)
14. Approval and Governance (3 questions)
15. Review and Change Management (3 questions)

Test plan

• Migration applies successfully: alembic upgrade head
• Migration downgrades successfully: alembic downgrade -1
• Template is created with key ethyca_comprehensive_dpia
• 57 questions are seeded with correct group assignments
• Questions have appropriate fides_sources mappings

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Ignored	Preview	Feb 12, 2026 11:17pm
fides-privacy-center	Ignored		Feb 12, 2026 11:17pm

[greptile-apps]

Greptile Overview

Greptile Summary

This PR adds a comprehensive Ethyca DPIA (EDPIA) assessment template that consolidates privacy impact assessment requirements from multiple frameworks (GDPR, UK GDPR, CPRA, Colorado CPA, Virginia VCDPA, and best practices) into a single de-duplicated template.

Key changes:

• Creates a new assessment template with key ethyca_comprehensive_dpia
• Seeds 58 questions (note: PR description mentions 57, but there are actually 58) organized into 15 thematic groups
• Each question includes guidance referencing applicable regulatory sources and Fides source mappings for automated pre-population
• Migration follows established patterns with proper idempotency checks (verifies template doesn't exist before inserting)
• Both upgrade and downgrade paths are implemented correctly
• Follows the same structure as the previous privacy assessment migration (xx_2026_02_05_1500_b2c3d4e5f6g7_add_privacy_assessment_schema.py)

Minor discrepancy:
The PR description states 57 questions, but the migration contains 58 questions. This appears to be a documentation inconsistency rather than a code issue.

Confidence Score: 4/5

• This PR is safe to merge with minimal risk, pending minor documentation fix.
• The migration follows established patterns from the existing privacy assessment schema migration, includes proper idempotency checks to prevent duplicate insertions, and handles both upgrade and downgrade paths correctly. The data structure is well-organized with comprehensive documentation. The only issue is a minor discrepancy between the PR description (57 questions) and actual implementation (58 questions), plus a version string that uses 2024 instead of 2026.
• No files require special attention - the implementation is straightforward and follows existing patterns.

Important Files Changed

Filename	Overview
src/fides/api/alembic/migrations/versions/xx_2026_02_12_1600_f6g7h8i9j0k1_add_comprehensive_edpia.py	Adds comprehensive EDPIA assessment template with 58 questions across 15 groups. Migration follows established patterns, includes proper idempotency checks, and handles both upgrade and downgrade paths correctly.

_{Last reviewed commit: 18e35d8}

[greptile-apps]

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Version uses "2024" but migration is dated 2026. Consider updating to EDPIA-2026-01 to match the migration year.