mcpField
G
gdpr-data-handling

gdpr-data-handling

github.com/sickn33Security48.7k233 installsUpdated 1d ago
Repository

About gdpr-data-handling

A practical guidance skill for GDPR-oriented data processing and privacy design. It is for teams handling EU personal data, consent, or data subject requests, and offers implementation direction rather than compliance certification.

Key features

  1. 01Plan personal data processing
  2. 02Design consent management
  3. 03Handle data subject requests
  4. 04Review privacy architecture and controls

Use cases

  1. 01Build systems that process EU personal data
  2. 02Implement consent workflows
  3. 03Respond to access or deletion requests
  4. 04Conduct GDPR-oriented compliance reviews

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/sickn33/agentic-awesome-skills --skill gdpr-data-handling

After installing, type/gdpr-data-handlingin Claude Code to confirm it loaded.

Bundled filesresources/implementation-playbook.md

Details

From the project README

GDPR Data Handling

Practical implementation guide for GDPR-oriented data-processing design, consent management, and privacy controls.

Use this skill when

  • Building systems that process EU personal data
  • Implementing consent management
  • Handling data subject requests (DSRs)
  • Conducting GDPR compliance reviews
  • Designing privacy-first architectures
  • Creating data processing agreements

Do not use this skill when

  • The task is unrelated to gdpr data handling
  • You need a different domain or tool outside this scope

Instructions

  • Clarify goals, constraints, and required inputs.
  • Apply relevant best practices and validate outcomes.
  • Provide actionable steps and verification.
  • If detailed examples are required, open resources/implementation-playbook.md.

Resources

  • resources/implementation-playbook.md for detailed patterns and examples.

Limitations

  • Use this skill only when the task clearly matches the scope described above.
  • Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
  • Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

The playbook is partial application scaffolding, not a compliance certification. Database/auth/event/notification helpers and calendar-month deadline computation must be implemented and tested before use; a request-supplied verified boolean is not identity proof. Authenticate/authorize the handler and subject ownership before any export/deletion, filter third-party data and report partial-source failures without marking complete. Portability has specific legal scope and is not identical to access. Retention periods and consent-log fields are illustrative, not universal legal minima; justify collection and apply legal holds/backups/restore handling. Pseudonymisation/removing IDs does not establish anonymity. Breach risk flags require a documented competent assessment, with the controller clock tied to actual awareness; high-risk subject notification is without undue delay and has legal exceptions. Do not dispatch notices or delete data outside the authorized incident/request procedure. See EDPB rights timing and EDPB breaches.

Comments

Markdown supported