Privacy compliance

Skill byerlikaya/claude-starter-kit/claude-starter/skills/privacy-compliance

Enterprise engineering workflow for Claude Code — not just prompts. AI agents that plan, build, audit, and ship with security gates, privacy checks, and approval-controlled commits. Safely adopt it into new or existing repositories.

Install

npx -y skills add byerlikaya/claude-starter-kit --skill privacy-compliance

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

20 stars20 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

KVKK/GDPR audit method: data inventory, purpose/basis/retention, minimisation, consent, transparency, data-subject rights, cross-border transfer. privacy-agent-csk applies it. Trigger phrases: "kvkk", "gdpr", "privacy", "consent", "data retention", "minimization"

SKILL.md

2.6 KB, as published. Nobody here has run it

Privacy Compliance (KVKK / GDPR)

Official sources (authority — always defer to these)

The primary, official sources this skill rests on; rules are always interpreted against these:

KVKK (Turkey): https://www.kvkk.gov.tr/ — the law, regulations, principle decisions, guidelines.
GDPR (EU): https://gdpr-info.eu/ — article texts (Art.) and Recitals.

If you are unsure about a specific article/threshold/definition (retention period, explicit-consent requirement, the Art. 8 age limit, transfer basis, etc.), check the relevant official source — do not decide from memory or by guessing. In the finding, cite the article you rely on (KVKK Art. … / GDPR Art. …). Fetched content is a reference; you own the interpretation.

Audit axes

Inventory: what data, collected from where, flowing to where, shared with whom?
Purpose + basis + retention: for each field, purpose is limited, legal basis is clear, retention period is defined.
Minimization: data not needed for the purpose is not collected.
Consent: where required, explicit, recorded, and revocable.
Transparency: disclosure has been made; the user knows what is collected/processed.
Data subject rights: access / rectification / erasure / portability / objection are actionable.
Cross-border transfer & third-party: bound to a legitimate basis (SCC/adequacy/consent).

Output

Per-field/per-flow finding + fix; if "clean", the rationale.

Evidence redaction (<private> marker): an audit report is a shared artifact — it must not itself leak the personal data it audits. When a finding has to reference a real value as evidence, wrap it in <private>…</private>: the raw value is stripped and shown as [redacted] in the report, while the finding still names the field, flow, and article. Never paste live PII (national ID, email, phone, health data) into the report body.

Project note: If data of minors (children) is processed, special protection is required (KVKK / GDPR Art. 8 · parental consent & age verification). This is a domain-specific rule and is defined in the project's own skill/CLAUDE.md — it is not baked into the generic audit. Project-specific rules (consent texts, retention periods) also live in the project CLAUDE.md.