[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE2TN47YK3QAP4W13FHHHN":3,"skill-same:01M6AE2TN47YK3QAP4W13FHHHN":146},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":37,"publishedAt":58,"linkOnly":59,"markdownContent":60,"markdownBody":61,"frontMatter":62,"refName":79,"commitSha":80,"skillDirectory":81,"forksCount":82,"repositoryHtmlUrl":83,"repositoryHomepageUrl":84,"ownerHtmlUrl":85,"ownerBlogUrl":86,"ownerDescription":87,"updatedAt":88,"install":89,"resources":102},"01M6AE2TN47YK3QAP4W13FHHHN","conducting-gdpr-compliance-assessment",null,"Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016\u002F679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical\u002Forganizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-gdpr-compliance-assessment\u002FSKILL.md",[18,23,26,31,34],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":32,"categoryName":33,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":35,"categoryName":36,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000037","律师与法务",[38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57],"conducting gdpr compliance assessment","assessment","compliance","gdpr","data","supervisory-authority","ico","eu-regulation","processor","controller","article-30","data-subject-rights","dpia","design","data protection","pr","governance","automation","cybersecurity","personal","2026-11-10 10:12:30",false,"---\nname: conducting-gdpr-compliance-assessment\ndescription: >-\n  Conduct comprehensive GDPR compliance assessments by evaluating data processing\n  activities against EU Regulation 2016\u002F679, including Article 30 records of processing,\n  lawful basis validation, data subject rights implementation, Data Protection Impact\n  Assessments (DPIAs) under Article 35, breach notification procedures, international\n  transfer safeguards (SCCs, adequacy decisions), and technical\u002Forganizational measures\n  under Article 32. Use when processing personal data of EU residents, preparing for\n  supervisory authority audits, implementing privacy-by-design for new systems, scoping\n  compliance gaps for M&A due diligence, assessing third-party processors, or responding\n  to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB,\n  and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing\n  specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR\n  automation — use implementing-gdpr-data-subject-access-request.\ndomain: cybersecurity\nsubdomain: compliance-governance\ntags:\n- gdpr\n- data-protection\n- privacy\n- compliance\n- dpia\n- data-subject-rights\n- article-30\n- controller\n- processor\n- eu-regulation\n- ico\n- supervisory-authority\nversion: \"1.0\"\nauthor: dakshverma23\nlicense: Apache-2.0\nnist_csf:\n- GV.OC-02\n- GV.PO-01\n- GV.RM-04\n- PR.DS-01\n- PR.DS-02\n- ID.AM-05\nmitre_attack:\n- T1530\n- T1567\n---\n# Conducting GDPR Compliance Assessment\n\n> **Effective Date**: August 2026  \n> **Legal Basis**: EU Regulation 2016\u002F679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga\u002F2025\u002F18)  \n> **Pending Changes**: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.\n\n## When to Use\n\n- When an organization **processes personal data of EU residents** (Article 3 territorial scope applies)\n- When preparing for a **supervisory authority audit** (ICO, CNIL, BfDI) or responding to formal inquiry\n- When implementing **privacy-by-design** requirements (Article 25) for new systems or data flows\n- When **scoping compliance gaps** before M&A due diligence or contract negotiations with EU entities\n- When responding to **data subject access requests (DSARs)** and discovering gaps in data inventory\n- When assessing **third-party processors** for GDPR compliance before signing Data Processing Agreements (DPAs)\n- After **data breach incidents** to verify notification procedures meet 72-hour requirement (Article 33)\n\n**Do not use** for:\n- **Technical implementation** of specific GDPR controls (encryption, pseudonymization, access controls) — use **implementing-gdpr-data-protection-controls** for Article 32 technical\u002Forganizational measures\n- **Automated DSAR processing workflows** (identity verification, PII discovery, redaction, delivery) — use **implementing-gdpr-data-subject-access-request** for DSAR automation\n- Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria\n- This skill is for **comprehensive compliance assessment** across all GDPR articles; use the specialized skills for focused implementation tasks\n\n## Prerequisites\n\n- Understanding of GDPR Articles 5-32 and key definitions\n- Access to Article 30 records of processing activities\n- Data Processing Agreements with third-party processors\n- Privacy policies, consent forms, cookie notices\n- Knowledge of lawful bases (Article 6)\n- Data breach response plan and incident register\n- List of international data transfers with safeguards\n\n## Workflow\n\n**For detailed procedures, templates, and examples, see `references\u002Fdetailed-workflow.md`**\n\n### Phase 1: Determine Territorial Applicability (Article 3)\n\nGDPR applies if:\n1. Organization has establishment in EU\n2. Offers goods\u002Fservices to EU residents\n3. Monitors behavior of EU residents\n\n**Check**: EU office? EU website targeting? Behavioral tracking?\n\n### Phase 2: Inventory Data Processing Activities (Article 30)\n\nDocument for EACH activity:\n- Controller\u002Fprocessor details\n- Processing purposes (specific)\n- Data categories and special categories (Art. 9)\n- Recipients and international transfers\n- Retention periods\n- Security measures\n\n**Tools**: Use `scripts\u002Farticle30_parser.py`, `article30_validator.py`, `generate_ropa_report.py`\n\n**Common gaps**: Missing retention periods (68%), vague purposes, undocumented transfers\n\n### Phase 3: Validate Lawful Basis (Article 6)\n\n| Basis | Use Case | Key Requirement |\n|-------|----------|-----------------|\n| **Consent** (6(1)(a)) | Marketing, profiling | Freely given, specific, withdrawable |\n| **Contract** (6(1)(b)) | Order fulfillment | Strictly necessary only |\n| **Legal Obligation** (6(1)(c)) | Tax records | Cite specific law |\n| **Legitimate Interest** (6(1)(f)) | Fraud prevention, analytics | Three-part test + balancing |\n\n**Action**: Map each Article 30 activity to one lawful basis. Document legitimate interest assessments.\n\n### Phase 4: Assess Data Subject Rights (Articles 12-23)\n\nVerify capability for:\n- **Access** (15): Provide copy in machine-readable format within 1 month\n- **Rectification** (16): Correct inaccurate data\n- **Erasure** (17): \"Right to be forgotten\" (with exceptions)\n- **Portability** (20): Transfer data in structured format\n- **Objection** (21): Opt-out of legitimate interest processing\n- **Automated Decision-Making** (22): Human review of algorithmic decisions\n\n**Test**: Process sample DSAR through full workflow. Use `scripts\u002F` for automation.\n\n### Phase 5: Review DPIAs (Article 35)\n\nDPIA **mandatory** for:\n- Large-scale profiling with automated decisions\n- Large-scale special categories processing\n- Systematic monitoring of public areas (facial recognition)\n\n**Template**: See `references\u002Fdetailed-workflow.md` for complete DPIA structure\n\n**Content**: Description, necessity, risks, mitigation, consultation (DPO, supervisory authority if novel high-risk)\n\n### Phase 6: Audit Breach Notification (Articles 33-34)\n\n**72-hour rule**: Notify supervisory authority within 72 hours of becoming aware of breach likely to risk rights.\n\n**Decision tree**:\n- Unencrypted SSNs stolen? → NOTIFY + notify data subjects\n- Encrypted backup stolen (key secure)? → Document only\n- Temporary exposure (2 hours, no financial data)? → NOTIFY authority, assess data subject notification\n\n**Content**: Nature, categories\u002Fnumbers, DPO contact, consequences, mitigation\n\n### Phase 7: Verify International Transfers (Chapter V)\n\n**Mechanisms**:\n- Adequacy decisions (UK, Japan, etc.)\n- Standard Contractual Clauses (SCCs) 2021 + Transfer Impact Assessment\n- Binding Corporate Rules (BCRs)\n- Derogations (Article 49 - limited)\n\n**Post-Schrems II**: Assess destination country surveillance laws, implement supplementary measures (encryption with EU-held keys)\n\n### Phase 8: Assess Security Measures (Article 32)\n\n\"Security appropriate to the risk\":\n- **Low risk**: TLS 1.2+, password hashing, access logs, patching\n- **Medium risk**: AES-256 encryption, MFA, RBAC, penetration testing, SOC 2\n- **High risk**: HSMs, key rotation, SIEM, bug bounty, ISO 27001\n\n**Pseudonymization** vs. **Anonymization**: Pseudo = reversible (still personal data); Anon = irreversible (no longer GDPR)\n\n### Phase 9: Compile Findings and Remediation Roadmap\n\nGenerate compliance report:\n- Executive summary (overall status, high-priority gaps)\n- Article-by-article findings\n- Risk-prioritized remediation plan (Critical\u002FHigh\u002FMedium\u002FLow)\n- Cost estimates and timelines\n- Responsible parties (DPO, IT, Legal, Business)\n\n**Format**: See Output Format section below\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Controller** | Determines purposes and means of processing (Article 4(7)) |\n| **Processor** | Processes on behalf of controller (Article 4(8); requires DPA per Article 28) |\n| **Personal Data** | Any information relating to identified\u002Fidentifiable natural person (Article 4(1)) |\n| **Special Categories** | Health, biometric, genetic, racial, political, religious, trade union, sex life data (Article 9; heightened protection) |\n| **Consent** | Freely given, specific, informed, unambiguous indication of wishes (Article 4(11)) |\n| **Legitimate Interest** | Lawful basis requiring three-part test: purpose, necessity, balancing (Recital 47) |\n| **DPIA** | Data Protection Impact Assessment for high-risk processing (Article 35) |\n| **DPO** | Data Protection Officer (Article 37; mandatory for public authorities, large-scale monitoring\u002Fspecial categories) |\n| **SCCs** | Standard Contractual Clauses for international transfers (Commission Implementing Decision 2021\u002F914) |\n| **Supervisory Authority** | National data protection regulator (ICO for UK, CNIL for France, BfDI for Germany) |\n\n## Tools & Systems\n\n- **ICO Self-Assessment**: https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fsme-web-hub\u002Fchecklists\u002Fgdpr-check-list\u002F\n- **EDPB Guidelines**: https:\u002F\u002Fedpb.europa.eu\u002Four-work-tools\u002Fgeneral-guidance_en\n- **OneTrust \u002F TrustArc**: Commercial GRC platforms with DPIA, Article 30, cookie consent modules\n- **Article 30 Scripts**: `article30_parser.py`, `article30_validator.py` (included)\n- **SCCs (2021)**: https:\u002F\u002Fcommission.europa.eu\u002Flaw\u002Flaw-topic\u002Fdata-protection\u002Finternational-dimension-data-protection\u002Fstandard-contractual-clauses-scc_en\n- **DPO Certification**: IAPP CIPP\u002FE (Certified Information Privacy Professional\u002FEurope)\n\n## Common Scenarios\n\n### Scenario: M&A Due Diligence\n\n**Context**: Acquiring SaaS company with 50K EU customers. Need compliance assessment within 2 weeks.\n\n**Approach**:\n1. Request Article 30 records + DPAs with processors (AWS, Stripe, Mailchimp)\n2. Validate lawful basis: Consent for marketing, Contract for service delivery\n3. Check breach notification procedures (Article 33): No procedures found → HIGH RISK\n4. Review international transfers: AWS US-East-1 without SCCs → BLOCKER\n5. Deliverable: Gap analysis with remediation costs ($120K for SCCs + DPO hire + breach procedures)\n\n### Scenario: Supervisory Authority Audit\n\n**Context**: ICO formal inquiry after consumer complaint about unsubscribe not working.\n\n**Response**:\n1. Produce Article 30 records within 7 days\n2. Demonstrate consent records (timestamp, version, scope)\n3. Show withdrawal mechanism (unsubscribe link functional, processed within 48h)\n4. Provide audit logs of DSAR\u002Ferasure requests\n5. Outcome: Warning + 3-month corrective order (no fine due to cooperation)\n\n## Output Format\n\n```\nGDPR COMPLIANCE ASSESSMENT REPORT\n===================================\nOrganization: XYZ Corp | Assessment Date: 2026-08-24\nAssessor: Jane Smith, CIPP\u002FE | DPO: dpo@xyzcorp.com\n\nEXECUTIVE SUMMARY\n━━━━━━━━━━━━━━━━━\nOverall Status: PARTIAL COMPLIANCE (67\u002F100)\nCritical Gaps: 3 | High: 5 | Medium: 8 | Low: 12\n\nCRITICAL FINDINGS\n━━━━━━━━━━━━━━━━━\n1. Article 33: No breach notification procedures (72-hour deadline unmet)\n2. Chapter V: International transfers to US without SCCs (Schrems II violation)\n3. Article 30: Records incomplete (retention periods missing for 40% of activities)\n\nARTICLE-BY-ARTICLE STATUS\n━━━━━━━━━━━━━━━━━━━━━━━━\n✅ Article 3: Applicability confirmed (EU establishment)\n⚠️  Article 6: Lawful basis documented but 3 activities use invalid bundled consent\n✅ Article 15-23: DSAR procedures operational (18-day avg response time)\n❌ Article 28: 40% of processors lack signed DPAs\n⚠️  Article 32: Encryption at rest implemented but no MFA on admin accounts\n❌ Article 33\u002F34: No breach notification procedures\n⚠️  Article 35: DPIA completed for profiling but not reviewed in 18 months\n❌ Chapter V: US transfers without SCCs\n\nREMEDIATION ROADMAP\n━━━━━━━━━━━━━━━━━━━\nPriority 1 (0-30 days, $50K):\n  - Implement breach notification procedures + incident register\n  - Execute SCCs with AWS, Stripe (Module 2)\n  - Complete Article 30 records (retention periods, security measures)\n\nPriority 2 (1-3 months, $80K):\n  - Execute DPAs with remaining 8 processors\n  - Deploy MFA on all admin accounts\n  - Conduct legitimate interest assessments for analytics\n\nPriority 3 (3-6 months, $40K):\n  - Review and update DPIA\n  - Automated DSAR response workflow\n  - Annual GDPR training for staff\n\nCOMPLIANCE SCORE: 67\u002F100 → Target 90\u002F100 (6 months post-remediation)\n```\n\n## Verification Checklist\n\n- [ ] Article 3 applicability determination documented\n- [ ] Article 30 records complete for all activities (controller + processor roles)\n- [ ] Lawful basis identified and documented for each activity\n- [ ] Legitimate interest assessments documented with balancing test\n- [ ] Consent mechanism is granular, withdrawable, and logged\n- [ ] Data subject rights procedures operational (1-month response time)\n- [ ] DPIA completed for high-risk processing (profiling, special categories, monitoring)\n- [ ] Breach notification procedures documented (72-hour timeline)\n- [ ] DPAs executed with all processors (Article 28 requirements)\n- [ ] International transfers use SCCs 2021 + Transfer Impact Assessment\n- [ ] Security measures appropriate to risk (encryption, MFA, logging, testing)\n- [ ] Retention periods defined and automated deletion implemented\n- [ ] Privacy policy published and updated within 12 months\n- [ ] DPO designated if required (Article 37 criteria met)\n- [ ] Staff trained on GDPR principles and data subject rights\n\n","# Conducting GDPR Compliance Assessment\n\n> **Effective Date**: August 2026  \n> **Legal Basis**: EU Regulation 2016\u002F679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga\u002F2025\u002F18)  \n> **Pending Changes**: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.\n\n## When to Use\n\n- When an organization **processes personal data of EU residents** (Article 3 territorial scope applies)\n- When preparing for a **supervisory authority audit** (ICO, CNIL, BfDI) or responding to formal inquiry\n- When implementing **privacy-by-design** requirements (Article 25) for new systems or data flows\n- When **scoping compliance gaps** before M&A due diligence or contract negotiations with EU entities\n- When responding to **data subject access requests (DSARs)** and discovering gaps in data inventory\n- When assessing **third-party processors** for GDPR compliance before signing Data Processing Agreements (DPAs)\n- After **data breach incidents** to verify notification procedures meet 72-hour requirement (Article 33)\n\n**Do not use** for:\n- **Technical implementation** of specific GDPR controls (encryption, pseudonymization, access controls) — use **implementing-gdpr-data-protection-controls** for Article 32 technical\u002Forganizational measures\n- **Automated DSAR processing workflows** (identity verification, PII discovery, redaction, delivery) — use **implementing-gdpr-data-subject-access-request** for DSAR automation\n- Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria\n- This skill is for **comprehensive compliance assessment** across all GDPR articles; use the specialized skills for focused implementation tasks\n\n## Prerequisites\n\n- Understanding of GDPR Articles 5-32 and key definitions\n- Access to Article 30 records of processing activities\n- Data Processing Agreements with third-party processors\n- Privacy policies, consent forms, cookie notices\n- Knowledge of lawful bases (Article 6)\n- Data breach response plan and incident register\n- List of international data transfers with safeguards\n\n## Workflow\n\n**For detailed procedures, templates, and examples, see `references\u002Fdetailed-workflow.md`**\n\n### Phase 1: Determine Territorial Applicability (Article 3)\n\nGDPR applies if:\n1. Organization has establishment in EU\n2. Offers goods\u002Fservices to EU residents\n3. Monitors behavior of EU residents\n\n**Check**: EU office? EU website targeting? Behavioral tracking?\n\n### Phase 2: Inventory Data Processing Activities (Article 30)\n\nDocument for EACH activity:\n- Controller\u002Fprocessor details\n- Processing purposes (specific)\n- Data categories and special categories (Art. 9)\n- Recipients and international transfers\n- Retention periods\n- Security measures\n\n**Tools**: Use `scripts\u002Farticle30_parser.py`, `article30_validator.py`, `generate_ropa_report.py`\n\n**Common gaps**: Missing retention periods (68%), vague purposes, undocumented transfers\n\n### Phase 3: Validate Lawful Basis (Article 6)\n\n| Basis | Use Case | Key Requirement |\n|-------|----------|-----------------|\n| **Consent** (6(1)(a)) | Marketing, profiling | Freely given, specific, withdrawable |\n| **Contract** (6(1)(b)) | Order fulfillment | Strictly necessary only |\n| **Legal Obligation** (6(1)(c)) | Tax records | Cite specific law |\n| **Legitimate Interest** (6(1)(f)) | Fraud prevention, analytics | Three-part test + balancing |\n\n**Action**: Map each Article 30 activity to one lawful basis. Document legitimate interest assessments.\n\n### Phase 4: Assess Data Subject Rights (Articles 12-23)\n\nVerify capability for:\n- **Access** (15): Provide copy in machine-readable format within 1 month\n- **Rectification** (16): Correct inaccurate data\n- **Erasure** (17): \"Right to be forgotten\" (with exceptions)\n- **Portability** (20): Transfer data in structured format\n- **Objection** (21): Opt-out of legitimate interest processing\n- **Automated Decision-Making** (22): Human review of algorithmic decisions\n\n**Test**: Process sample DSAR through full workflow. Use `scripts\u002F` for automation.\n\n### Phase 5: Review DPIAs (Article 35)\n\nDPIA **mandatory** for:\n- Large-scale profiling with automated decisions\n- Large-scale special categories processing\n- Systematic monitoring of public areas (facial recognition)\n\n**Template**: See `references\u002Fdetailed-workflow.md` for complete DPIA structure\n\n**Content**: Description, necessity, risks, mitigation, consultation (DPO, supervisory authority if novel high-risk)\n\n### Phase 6: Audit Breach Notification (Articles 33-34)\n\n**72-hour rule**: Notify supervisory authority within 72 hours of becoming aware of breach likely to risk rights.\n\n**Decision tree**:\n- Unencrypted SSNs stolen? → NOTIFY + notify data subjects\n- Encrypted backup stolen (key secure)? → Document only\n- Temporary exposure (2 hours, no financial data)? → NOTIFY authority, assess data subject notification\n\n**Content**: Nature, categories\u002Fnumbers, DPO contact, consequences, mitigation\n\n### Phase 7: Verify International Transfers (Chapter V)\n\n**Mechanisms**:\n- Adequacy decisions (UK, Japan, etc.)\n- Standard Contractual Clauses (SCCs) 2021 + Transfer Impact Assessment\n- Binding Corporate Rules (BCRs)\n- Derogations (Article 49 - limited)\n\n**Post-Schrems II**: Assess destination country surveillance laws, implement supplementary measures (encryption with EU-held keys)\n\n### Phase 8: Assess Security Measures (Article 32)\n\n\"Security appropriate to the risk\":\n- **Low risk**: TLS 1.2+, password hashing, access logs, patching\n- **Medium risk**: AES-256 encryption, MFA, RBAC, penetration testing, SOC 2\n- **High risk**: HSMs, key rotation, SIEM, bug bounty, ISO 27001\n\n**Pseudonymization** vs. **Anonymization**: Pseudo = reversible (still personal data); Anon = irreversible (no longer GDPR)\n\n### Phase 9: Compile Findings and Remediation Roadmap\n\nGenerate compliance report:\n- Executive summary (overall status, high-priority gaps)\n- Article-by-article findings\n- Risk-prioritized remediation plan (Critical\u002FHigh\u002FMedium\u002FLow)\n- Cost estimates and timelines\n- Responsible parties (DPO, IT, Legal, Business)\n\n**Format**: See Output Format section below\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Controller** | Determines purposes and means of processing (Article 4(7)) |\n| **Processor** | Processes on behalf of controller (Article 4(8); requires DPA per Article 28) |\n| **Personal Data** | Any information relating to identified\u002Fidentifiable natural person (Article 4(1)) |\n| **Special Categories** | Health, biometric, genetic, racial, political, religious, trade union, sex life data (Article 9; heightened protection) |\n| **Consent** | Freely given, specific, informed, unambiguous indication of wishes (Article 4(11)) |\n| **Legitimate Interest** | Lawful basis requiring three-part test: purpose, necessity, balancing (Recital 47) |\n| **DPIA** | Data Protection Impact Assessment for high-risk processing (Article 35) |\n| **DPO** | Data Protection Officer (Article 37; mandatory for public authorities, large-scale monitoring\u002Fspecial categories) |\n| **SCCs** | Standard Contractual Clauses for international transfers (Commission Implementing Decision 2021\u002F914) |\n| **Supervisory Authority** | National data protection regulator (ICO for UK, CNIL for France, BfDI for Germany) |\n\n## Tools & Systems\n\n- **ICO Self-Assessment**: https:\u002F\u002Fico.org.uk\u002Ffor-organisations\u002Fsme-web-hub\u002Fchecklists\u002Fgdpr-check-list\u002F\n- **EDPB Guidelines**: https:\u002F\u002Fedpb.europa.eu\u002Four-work-tools\u002Fgeneral-guidance_en\n- **OneTrust \u002F TrustArc**: Commercial GRC platforms with DPIA, Article 30, cookie consent modules\n- **Article 30 Scripts**: `article30_parser.py`, `article30_validator.py` (included)\n- **SCCs (2021)**: https:\u002F\u002Fcommission.europa.eu\u002Flaw\u002Flaw-topic\u002Fdata-protection\u002Finternational-dimension-data-protection\u002Fstandard-contractual-clauses-scc_en\n- **DPO Certification**: IAPP CIPP\u002FE (Certified Information Privacy Professional\u002FEurope)\n\n## Common Scenarios\n\n### Scenario: M&A Due Diligence\n\n**Context**: Acquiring SaaS company with 50K EU customers. Need compliance assessment within 2 weeks.\n\n**Approach**:\n1. Request Article 30 records + DPAs with processors (AWS, Stripe, Mailchimp)\n2. Validate lawful basis: Consent for marketing, Contract for service delivery\n3. Check breach notification procedures (Article 33): No procedures found → HIGH RISK\n4. Review international transfers: AWS US-East-1 without SCCs → BLOCKER\n5. Deliverable: Gap analysis with remediation costs ($120K for SCCs + DPO hire + breach procedures)\n\n### Scenario: Supervisory Authority Audit\n\n**Context**: ICO formal inquiry after consumer complaint about unsubscribe not working.\n\n**Response**:\n1. Produce Article 30 records within 7 days\n2. Demonstrate consent records (timestamp, version, scope)\n3. Show withdrawal mechanism (unsubscribe link functional, processed within 48h)\n4. Provide audit logs of DSAR\u002Ferasure requests\n5. Outcome: Warning + 3-month corrective order (no fine due to cooperation)\n\n## Output Format\n\n```\nGDPR COMPLIANCE ASSESSMENT REPORT\n===================================\nOrganization: XYZ Corp | Assessment Date: 2026-08-24\nAssessor: Jane Smith, CIPP\u002FE | DPO: dpo@xyzcorp.com\n\nEXECUTIVE SUMMARY\n━━━━━━━━━━━━━━━━━\nOverall Status: PARTIAL COMPLIANCE (67\u002F100)\nCritical Gaps: 3 | High: 5 | Medium: 8 | Low: 12\n\nCRITICAL FINDINGS\n━━━━━━━━━━━━━━━━━\n1. Article 33: No breach notification procedures (72-hour deadline unmet)\n2. Chapter V: International transfers to US without SCCs (Schrems II violation)\n3. Article 30: Records incomplete (retention periods missing for 40% of activities)\n\nARTICLE-BY-ARTICLE STATUS\n━━━━━━━━━━━━━━━━━━━━━━━━\n✅ Article 3: Applicability confirmed (EU establishment)\n⚠️  Article 6: Lawful basis documented but 3 activities use invalid bundled consent\n✅ Article 15-23: DSAR procedures operational (18-day avg response time)\n❌ Article 28: 40% of processors lack signed DPAs\n⚠️  Article 32: Encryption at rest implemented but no MFA on admin accounts\n❌ Article 33\u002F34: No breach notification procedures\n⚠️  Article 35: DPIA completed for profiling but not reviewed in 18 months\n❌ Chapter V: US transfers without SCCs\n\nREMEDIATION ROADMAP\n━━━━━━━━━━━━━━━━━━━\nPriority 1 (0-30 days, $50K):\n  - Implement breach notification procedures + incident register\n  - Execute SCCs with AWS, Stripe (Module 2)\n  - Complete Article 30 records (retention periods, security measures)\n\nPriority 2 (1-3 months, $80K):\n  - Execute DPAs with remaining 8 processors\n  - Deploy MFA on all admin accounts\n  - Conduct legitimate interest assessments for analytics\n\nPriority 3 (3-6 months, $40K):\n  - Review and update DPIA\n  - Automated DSAR response workflow\n  - Annual GDPR training for staff\n\nCOMPLIANCE SCORE: 67\u002F100 → Target 90\u002F100 (6 months post-remediation)\n```\n\n## Verification Checklist\n\n- [ ] Article 3 applicability determination documented\n- [ ] Article 30 records complete for all activities (controller + processor roles)\n- [ ] Lawful basis identified and documented for each activity\n- [ ] Legitimate interest assessments documented with balancing test\n- [ ] Consent mechanism is granular, withdrawable, and logged\n- [ ] Data subject rights procedures operational (1-month response time)\n- [ ] DPIA completed for high-risk processing (profiling, special categories, monitoring)\n- [ ] Breach notification procedures documented (72-hour timeline)\n- [ ] DPAs executed with all processors (Article 28 requirements)\n- [ ] International transfers use SCCs 2021 + Transfer Impact Assessment\n- [ ] Security measures appropriate to risk (encryption, MFA, logging, testing)\n- [ ] Retention periods defined and automated deletion implemented\n- [ ] Privacy policy published and updated within 12 months\n- [ ] DPO designated if required (Article 37 criteria met)\n- [ ] Staff trained on GDPR principles and data subject rights\n\n",{"name":5,"tags":63,"author":66,"domain":56,"license":15,"version":67,"nist_csf":68,"subdomain":75,"description":7,"mitre_attack":76},[41,64,65,40,50,49,48,47,46,45,44,43],"data-protection","privacy","dakshverma23","1.0",[69,70,71,72,73,74],"GV.OC-02","GV.PO-01","GV.RM-04","PR.DS-01","PR.DS-02","ID.AM-05","compliance-governance",[77,78],"T1530","T1567","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fconducting-gdpr-compliance-assessment",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":90,"prompt":100,"zipAvailable":101},[91,94,97],{"tool":92,"command":93},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-gdpr-compliance-assessment",{"tool":95,"command":96},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-gdpr-compliance-assessment",{"tool":98,"command":99},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-gdpr-compliance-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-gdpr-compliance-assessment\u002FSKILL.md",true,[103,109,114,118,124,128,132,138,142],{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"assets\u002Fcompliance-scorecard.md","ASSET","资产文件",10111,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-gdpr-compliance-assessment\u002Fassets\u002Fcompliance-scorecard.md",{"path":110,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"LICENSE","许可证",741,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-gdpr-compliance-assessment\u002FLICENSE",{"path":115,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":116,"sourceHtmlUrl":117},"LICENSE.txt",1071,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Favoid-ai-writing\u002FLICENSE.txt",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"references\u002Fapi-reference.md","REFERENCE","参考文档",6640,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-gdpr-compliance-assessment\u002Freferences\u002Fapi-reference.md",{"path":125,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":126,"sourceHtmlUrl":127},"references\u002Fdetailed-workflow.md",20170,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-gdpr-compliance-assessment\u002Freferences\u002Fdetailed-workflow.md",{"path":129,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":130,"sourceHtmlUrl":131},"references\u002Fstandards.md",6375,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-gdpr-compliance-assessment\u002Freferences\u002Fstandards.md",{"path":133,"resourceType":134,"resourceTypeDesc":135,"sizeBytes":136,"sourceHtmlUrl":137},"scripts\u002Farticle30_parser.py","SCRIPT","脚本",7746,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-gdpr-compliance-assessment\u002Fscripts\u002Farticle30_parser.py",{"path":139,"resourceType":134,"resourceTypeDesc":135,"sizeBytes":140,"sourceHtmlUrl":141},"scripts\u002Farticle30_validator.py",6978,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-gdpr-compliance-assessment\u002Fscripts\u002Farticle30_validator.py",{"path":143,"resourceType":134,"resourceTypeDesc":135,"sizeBytes":144,"sourceHtmlUrl":145},"scripts\u002Fgenerate_ropa_report.py",7559,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-gdpr-compliance-assessment\u002Fscripts\u002Fgenerate_ropa_report.py",[147,173,197,224,249,276],{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":154,"publishedAt":58},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[153],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[155,156,157,158,159,56,160,161,53,162,163,164,165,166,167,168,169,170,171,172],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":180,"publishedAt":58},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[179],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[181,169,182,183,159,184,56,53,185,186,187,188,189,190,191,192,193,194,195,196],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":207,"publishedAt":58},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[203,206],{"categoryNo":204,"categoryName":205,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[191,208,209,210,211,56,212,213,185,40,214,215,216,217,218,219,220,221,222,223],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":231,"publishedAt":58},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[230],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[232,233,234,56,235,236,237,238,239,240,241,42,242,243,244,245,188,246,247,248],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":250,"name":251,"nameZh":6,"description":252,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":253,"categories":254,"keywords":256,"publishedAt":58},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[255],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[257,258,259,56,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":277,"name":278,"nameZh":6,"description":279,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":280,"categories":281,"keywords":283,"publishedAt":58},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[282],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[159,284,56,285,286,287,288,289,290,291,292,219,293,220,294,295,296,297,298,299],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]