mcpField
G
gdpr-data-mapping

gdpr-data-mapping

github.com/securityskillsSecurity0171 installsUpdated 9w ago
Repository

About gdpr-data-mapping

A GDPR data-mapping skill for teams responsible for compliance records and operational workflows. It covers processing inventories, data flows, rights requests, breach response, and produces a risk-prioritized gap list.

Key features

  1. 01Create processing activity records
  2. 02Map systems and data flows
  3. 03Prepare data subject rights workflows
  4. 04Plan breach response
  5. 05Track DPIAs and compliance gaps

Use cases

  1. 01Inventory personal data and purposes
  2. 02Trace backups, logs, and transfers
  3. 03Prepare access or erasure request workflows
  4. 04Build a breach notification decision tree

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill gdpr-data-mapping

After installing, type/gdpr-data-mappingin Claude Code to confirm it loaded.

Details

From the project README

GDPR Data Mapping

Create the records and workflows that demonstrate GDPR compliance.

1. Data Inventory (Article 30 Records of Processing)

For each processing activity capture:

  • Purpose and lawful basis (consent, contract, legal obligation, vital interests, public task, legitimate interests — with the LI balancing test documented)
  • Categories of data subjects and personal data (special categories flagged: health, biometrics, political, etc.)
  • Recipients including subprocessors and international transfers
  • Retention periods with the justification for each
  • Security measures (technical and organizational)

2. Data Flow Mapping

  • Systems inventory cross-referenced: which system holds which data fields, where backups and logs replicate them
  • Marketing/CRM/analytics flows separately — consent state travels with the data
  • Third-country transfers: identify mechanisms (adequacy decisions, SCCs, EU-US DPF) and conduct transfer impact assessments

3. Data Subject Rights Readiness (Articles 15–22)

  • Verify operational ability to: access, rectify, erase, restrict, port, and object — within one month
  • Identity verification without excessive data collection
  • Erasure reality check: backups, logs, analytics stores — document what "deletion" means per system
  • Consent capture proof: when, how, what was shown (for consent-based processing)

4. Breach Response (Articles 33–34)

  • 72-hour supervisory authority notification: template ready, decision tree for "risk to rights and freedoms"
  • Internal escalation path that reaches the DPO fast (detection → assessment → notify)
  • Documentation of every breach decision, including non-notified ones with reasoning

5. Accountability Extras

  • DPIA process for high-risk processing (Article 35): criteria, completed DPIAs, residual risk sign-off
  • Privacy notices match actual practice (Article 13/14)
  • Processor contracts include Article 28 clauses

Output

RoPA spreadsheet/registry, data-flow diagrams, rights-request runbook, breach decision tree, and a gap list prioritized by risk.

Comments

Markdown supported