gdpr-compliance
starsforks
How to install gdpr-compliance?
bagelhole/devops-security-agent-skills/gdpr-compliance
$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill gdpr-complianceImplement GDPR data protection requirements. Configure consent management, data subject rights, and privacy by design. Use when processing EU personal data.
SKILL.md
| 1 | # GDPR Compliance |
| 2 | |
| 3 | Implement General Data Protection Regulation requirements for organizations that process personal data of EU/EEA residents, covering lawful processing, data subject rights, and technical safeguards. |
| 4 | |
| 5 | ## When to Use |
| 6 | |
| 7 | - Processing personal data of EU/EEA residents in any capacity |
| 8 | - Building consent management and preference centers |
| 9 | - Implementing Data Subject Access Request (DSAR) workflows |
| 10 | - Conducting Data Protection Impact Assessments (DPIAs) |
| 11 | - Setting up data processing agreements with third-party processors |
| 12 | - Designing systems with privacy by design and by default principles |
| 13 | |
| 14 | ## Key Principles and Legal Bases |
| 15 | |
| 16 | ```yaml |
| 17 | gdpr_principles: |
| 18 | article_5: |
| 19 | lawfulness_fairness_transparency: |
| 20 | description: "Process data lawfully, fairly, and transparently" |
| 21 | implementation: |
| 22 | - Document legal basis for every processing activity |
| 23 | - Provide clear privacy notices |
| 24 | - No hidden or deceptive data collection |
| 25 | |
| 26 | purpose_limitation: |
| 27 | description: "Collect for specified, explicit, and legitimate purposes" |
| 28 | implementation: |
| 29 | - Define purpose before collection |
| 30 | - Do not repurpose data without new legal basis |
| 31 | - Document all processing purposes in ROPA |
| 32 | |
| 33 | data_minimization: |
| 34 | description: "Adequate, relevant, and limited to what is necessary" |
| 35 | implementation: |
| 36 | - Collect only required fields |
| 37 | - Review data models for unnecessary fields |
| 38 | - Remove optional fields that are not used |
| 39 | |
| 40 | accuracy: |
| 41 | description: "Accurate and kept up to date" |
| 42 | implementation: |
| 43 | - Provide self-service profile editing |
| 44 | - Implement data validation at point of entry |
| 45 | - Schedule regular data quality reviews |
| 46 | |
| 47 | storage_limitation: |
| 48 | description: "Kept no longer than necessary" |
| 49 | implementation: |
| 50 | - Define retention periods per data category |
| 51 | - Automate deletion when retention expires |
| 52 | - Document retention schedule |
| 53 | |
| 54 | integrity_and_confidentiality: |
| 55 | description: "Appropriate security measures" |
| 56 | implementation: |
| 57 | - Encryption at rest and in transit |
| 58 | - Access controls and audit logging |
| 59 | - Pseudonymization where appropriate |
| 60 | |
| 61 | accountability: |
| 62 | description: "Demonstrate compliance" |
| 63 | implementation: |
| 64 | - Maintain Records of Processing Activities |
| 65 | - Conduct DPIAs for high-risk processing |
| 66 | - Appoint DPO if required |
| 67 | |
| 68 | legal_bases: |
| 69 | article_6: |
| 70 | consent: "Freely given, specific, informed, unambiguous" |
| 71 | contract: "Necessary for performance of a contract" |
| 72 | legal_obligation: "Required by EU or member state law" |
| 73 | vital_interests: "Protect life of data subject or another person" |
| 74 | public_interest: "Task carried out in public interest" |
| 75 | legitimate_interest: "Legitimate interest not overridden by data subject rights" |
| 76 | ``` |
| 77 | |
| 78 | ## Data Mapping Template (Records of Processing Activities) |
| 79 | |
| 80 | ```yaml |
| 81 | # Record of Processing Activities (ROPA) - Article 30 |
| 82 | processing_activity: |
| 83 | name: "Customer Account Management" |
| 84 | controller: "Example Corp, 123 Main St, Dublin, Ireland" |
| 85 | dpo_contact: "dpo@example.com" |
| 86 | purpose: "Manage customer accounts, provide services, handle billing" |
| 87 | legal_basis: "Contract (Art. 6(1)(b))" |
| 88 | categories_of_data_subjects: |
| 89 | - Customers |
| 90 | - Prospective customers |
| 91 | categories_of_personal_data: |
| 92 | - Name, email, phone number |
| 93 | - Billing address |
| 94 | - Payment information (tokenized) |
| 95 | - Service usage data |
| 96 | - Support ticket history |
| 97 | special_categories: "None" |
| 98 | recipients: |
| 99 | - Payment processor (Stripe) - processor |
| 100 | - Email service (SendGrid) - processor |
| 101 | - Cloud hosting (AWS) - processor |
| 102 | international_transfers: |
| 103 | - Destination: United States |
| 104 | Safeguard: "Standard Contractual Clauses (SCCs)" |
| 105 | TIA_completed: true |
| 106 | retention_period: "Account data retained for duration of contract + 7 years for legal obligations" |
| 107 | security_measures: |
| 108 | - AES-256 encryption at rest |
| 109 | - TLS 1.3 in transit |
| 110 | - Role-based access control |
| 111 | - Audit logging of all access |
| 112 | dpia_required: false |
| 113 | last_reviewed: "2024-06-01" |
| 114 | |
| 115 | # Template for each processing activity |
| 116 | processing_activity_template: |
| 117 | name: "" |
| 118 | controller: "" |
| 119 | joint_controller: "" # if applicable |
| 120 | processor: "" # if acting as processor |
| 121 | dpo_contact: "" |
| 122 | purpose: "" |
| 123 | legal_basis: "" # consent | contract | legal_obligation | vital_interests | public_interest | legitimate_interest |
| 124 | legitimate_interest_assessment: "" # if legitimate interest |
| 125 | categories_of_data_subjects: [] |
| 126 | categories_of_personal_data: [] |
| 127 | special_categories: "" # Art. 9 data |
| 128 | recipients: [] |
| 129 | international_transfers: [] |
| 130 | retention_period: "" |
| 131 | security_measures: [] |
| 132 | dpia_required: false |
| 133 | date_added |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
