Gdpr data protection
Skill BuilderCed/agent-skills/skills/compliance/gdpr-data-protection
31 cross-platform AI agent skills for regulated industries & underserved markets. EU compliance (AI Act, NIS2, DORA, GDPR), French professional (accounting, tax, notary, real estate), security audit, agent evaluation, Africa mobile money, offline-first.
npx -y skills add BuilderCed/agent-skills --skill gdpr-data-protectionAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Implement GDPR (Reg 2016/679) data protection — DPIA templates, Art.30 processing records, data subject rights, legal bases, and cross-border transfers.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
5.5 KB, as published. Nobody here has run it
GDPR Data Protection
DISCLAIMER: This skill provides guidance only. It does not constitute legal advice. Always verify with a Data Protection Officer or legal professional.
When to Use
- Designing systems that process personal data
- Conducting a Data Protection Impact Assessment (DPIA)
- Creating Article 30 processing records
- Implementing data subject rights (access, deletion, portability)
- Evaluating legal bases for data processing
- Planning cross-border data transfers
Step 1: Identify Legal Basis (Article 6)
Every processing activity needs exactly one legal basis:
| Legal Basis | When to Use | Example |
|---|---|---|
| Consent (6.1.a) | User actively opts in, can withdraw anytime | Newsletter signup |
| Contract (6.1.b) | Processing necessary to fulfill a contract | Delivering purchased goods |
| Legal obligation (6.1.c) | Required by law | Tax record retention |
| Vital interests (6.1.d) | Protecting someone's life | Emergency medical data |
| Public interest (6.1.e) | Official authority or public task | Government services |
| Legitimate interest (6.1.f) | Balanced against data subject's rights | Fraud prevention, security |
Consent requirements: freely given, specific, informed, unambiguous, easy to withdraw.
Step 2: Data Minimization Checklist
Before collecting any personal data:
- Is this data necessary for the stated purpose?
- Can the purpose be achieved with less data?
- Can the data be anonymized or pseudonymized?
- Is the retention period defined and minimal?
- Are access controls in place (who can see what)?
Step 3: Article 30 Processing Record
Every controller must maintain a record of processing activities:
Processing Activity: [Name]
Controller: [Organization name, contact]
DPO Contact: [If applicable]
Purpose: [Specific, explicit purpose]
Legal Basis: [From Step 1]
Data Categories: [e.g., name, email, IP address]
Data Subjects: [e.g., customers, employees]
Recipients: [Who receives the data, including processors]
Third Country Transfers: [If any, with safeguard mechanism]
Retention Period: [Specific duration or criteria]
Security Measures: [Encryption, access control, etc.]
Step 4: Data Subject Rights
Respond within 1 month (extendable to 3 months for complex requests):
| Right | Article | What to Implement |
|---|---|---|
| Access | 15 | Provide copy of all personal data held |
| Rectification | 16 | Correct inaccurate data |
| Erasure ("right to be forgotten") | 17 | Delete data when no longer needed |
| Restriction | 18 | Limit processing while disputes are resolved |
| Portability | 20 | Export data in machine-readable format |
| Object | 21 | Stop processing based on legitimate interest |
| Automated decisions | 22 | Human review of automated decisions with legal effects |
Step 5: DPIA (Data Protection Impact Assessment)
Required when processing is "likely to result in a high risk":
- Large-scale processing of special categories (health, biometrics)
- Systematic monitoring of public areas
- Automated decision-making with legal effects
- New technologies with unknown risks
DPIA Structure (CNIL template)
- Description: Processing, purposes, data flows, retention
- Necessity and proportionality: Legal basis, minimization, rights
- Risk assessment: Likelihood x severity for confidentiality, integrity, availability
- Measures: Technical and organizational measures to mitigate risks
Step 6: Cross-Border Transfers
Personal data leaving the EEA requires a transfer mechanism:
| Mechanism | When |
|---|---|
| Adequacy decision | Country deemed adequate by EC (e.g., UK, Japan, South Korea) |
| Standard Contractual Clauses (SCCs) | Contract-based, most common |
| Binding Corporate Rules | Intra-group transfers |
| Derogations (Art. 49) | Explicit consent, contract necessity (limited use) |
Post-Schrems II: SCCs must include a Transfer Impact Assessment (TIA) evaluating whether the recipient country's laws undermine the protections.
Penalties
| Violation Type | Max Fine |
|---|---|
| Administrative (Art. 83.4) | EUR 10M or 2% of global turnover |
| Core principles, rights, transfers (Art. 83.5) | EUR 20M or 4% of global turnover |
France-Specific (CNIL)
- Cookie consent: prior opt-in required (no cookie walls)
- Child consent: 15 years (not 16 as in GDPR default)
- DPIA tool: cnil.fr/fr/outil-pia (free, open source)
- DPO designation mandatory for: public bodies, large-scale systematic monitoring, large-scale special categories
What This Skill Does NOT Do
- Does not implement consent management UI
- Does not configure cookie banners
- Does not perform the DPIA risk assessment (guides structure)
- Does not replace a DPO or legal counsel