Data protection legal-AI skills in Cross-jurisdiction

70 legal AI skills for data protection in Cross-jurisdiction.

Age Verification and Estimation Methods

Apache-2.0Cross-jurisdictionData protection

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

APEC Cross-Border Privacy Rules Certification

Apache-2.0Cross-jurisdictionData protection

Guides APEC Cross-Border Privacy Rules system certification process including self-assessment against the APEC Privacy Framework principles, accountability agent selection, intake questionnaire completion, certification decision, annual recertification, and Global CBPR Forum transition. Keywords: APEC, CBPR, cross-border privacy, accountability agent, certification, Global CBPR.

Assessing Health Data Processing

Apache-2.0Cross-jurisdictionData protection

Guides DPIA for health and medical data processing covering Art. 9(2)(h)-(j) exemptions, HIPAA crosswalk for transatlantic operations, clinical trial data protection under EU CTR 536/2014, and genetic data specifics under Art. 9(1). Activate for healthcare systems, clinical research, health apps, or medical device data. Keywords: health data, DPIA, Art. 9, clinical trial, genetic data, HIPAA, medical records, special category.

Auditoría de Protección de Datos — Orquestador Multi-jurisdicción

MITCross-jurisdictionData protection

Orquestador de auditorías de protección de datos en 8 jurisdicciones (RGPD, Ley 21.719, UK GDPR, LGPD, Ley 25.326, LFPDPPP, nFADP, CCPA/CPRA): detecta las leyes aplicables o acepta --ley, comparte el Paso 0 y entrega un informe consolidado con score por jurisdicción.

Auditoría Ley 21.719 — Protección de Datos Personales (Chile)

MITCross-jurisdictionData protection

Auditoría Ley 21.719 (Chile): detecta el sector y entrega informe con score, estado por artículo e issues priorizados. Sub-skill de /privacidad, también invocable sola.

CCPA / CPRA — Auditoría de Cumplimiento (California, EE.UU.)

MITCross-jurisdictionData protection

Auditoría CCPA/CPRA (California): umbrales de aplicación, 8 derechos del consumidor, opt-out y contratos con proveedores, con informe de score y sanciones en USD. Sub-skill de /privacidad, también invocable sola.

Children's Data Minimisation and Retention Limits

Apache-2.0Cross-jurisdictionData protection

Implements strict data minimization and retention limits for children's personal data under GDPR Art. 5(1)(c), Recital 38, UK AADC Standard 8, and COPPA Section 312.7. Covers strict necessity testing, shorter retention periods, limited profiling, parental dashboard design, and automated deletion. Keywords: data minimization, children, retention, necessity test, parental dashboard.

Children's Profiling Restrictions

Apache-2.0Cross-jurisdictionData protection

Implements profiling restrictions for children under GDPR Recital 71, Article 22, UK AADC Standard 12, and COPPA. Covers prohibition of behavioural advertising to children, recommendation algorithm limitations, nudge technique prohibition, and automated decision-making safeguards. Keywords: profiling, children, behavioural advertising, recommendation algorithm, AADC, automated decision.

Client Data Retention — MENA Jurisdiction Rules

MITCross-jurisdictionData protection

Use when configuring or reviewing data retention periods for client matter files, communications, and AML records across MENA jurisdictions. Covers mandatory minimum retention periods for KSA (Saudi Bar + PDPL), UAE (Federal Law on Legal Profession + DFSA AML), Lebanon (Beirut/Tripoli Bar), Egypt, DIFC (DFSA), and ADGM (FSRA). Also covers anonymization vs hard-delete obligations, legal-hold overrides, and tax-record retention minimums.

Client Data Retention — MENA Rules

MITCross-jurisdictionData protection

Use when configuring client data retention periods for a law firm operating in MENA, or advising on regulatory retention minimums. Covers mandatory retention floors for legal files, AML records, and tax records across KSA, UAE, Lebanon, and Egypt — with applicable bar association rules, AML legislation, and tax law references. Describes Louis's per-matter retention settings, auto-anonymization at the retention floor, and legal-hold freeze functionality.

Compliance Checker

MITCross-jurisdictionData protection

Audits a codebase or business process for regulatory compliance across GDPR, HIPAA, SOC2, CCPA, and PCI-DSS. Scans for PII handling, data retention, encryption, access controls, audit logging, consent management, and data transfer issues. Generates a structured compliance report with findings, gap analysis, remediation steps, and evidence requirements.

Compliance Skill

MITCross-jurisdictionData protection

Navigate privacy regulations (GDPR, CCPA), review DPAs, and handle data subject requests. Use when reviewing data processing agreements, responding to data subject access or deletion requests, assessing cross-border data transfer requirements, or evaluating privacy compliance.

Compliance Skill

Apache-2.0Cross-jurisdictionData protection

Navigate privacy regulations (GDPR, CCPA), review DPAs, and handle data subject requests. Use when reviewing data processing agreements, responding to data subject access or deletion requests, assessing cross-border data transfer requirements, or evaluating privacy compliance.

Conducting AI System Privacy Assessment

Apache-2.0Cross-jurisdictionData protection

Guides the combined DPIA and AI Act conformity assessment for AI systems processing personal data. Covers EDPB-EDPS Joint Opinion 5/2021, training data lawfulness under Art. 6 and Art. 9, Art. 22 automated decision-making, algorithmic bias detection, and NIST AI RMF MAP function. Keywords: AI privacy, DPIA, AI Act, algorithmic bias, automated decision-making, Art. 22, training data, NIST AI RMF.

Contract Review

MITCross-jurisdictionData protection

Analyze contracts for risks, obligations, key clauses, and generate structured risk reports with severity ratings. Use when the user requests contract review or provides relevant inputs for this workflow.

Cookie Consent Banner and Policy

Apache-2.0Cross-jurisdictionData protection

Drafts publication-ready cookie policies, banner copy, and consent-flow language under GDPR/ePrivacy, CCPA/CPRA, and major U.S. state privacy laws. Converts a verified cookie inventory into enforceable policy sections with lawful-basis mapping, granular opt-in controls, withdrawal mechanics, and user-rights handling. Use when asked for cookie policy, cookie banner, tracking notice, consent management, do-not-sell notice, or privacy rights messaging.

Cross-Border Data Transfer Assessment

MITCross-jurisdictionData protection

Use when a privacy lawyer or compliance officer needs to assess the lawfulness of transferring personal data from one jurisdiction to another. Analyses adequacy decisions, appropriate safeguards (SCCs, BCRs, binding corporate rules), supplementary measures, and jurisdiction-specific risks. Covers GDPR (EU/UK), UAE PDPL, KSA PDPL, DIFC DP Law, ADGM DP Regs, and GCC data localisation requirements; includes Schrems II and post-Schrems transfer impact assessment methodology.

Cross-Border Data Transfer — GCC ↔ EU

MITCross-jurisdictionData protection

Use when assessing the legality of personal data transfers between GCC member states and the EU, or vice versa. Covers GDPR Articles 44–50 transfer mechanisms, KSA PDPL Article 29, UAE PDPL Article 22, and Bahrain PDPL Articles 12–13. Addresses the "transfer" question for MENA-hosted data accessed by EU lawyers, supplementary technical measures (AES-256, TLS 1.3), and DPIA requirements for sensitive data. Pairs with privacy-policy drafting and compliance gap-analysis skills.

Cross-Border Data Transfer — GCC ↔ EU Compliance

MITCross-jurisdictionData protection

Use when assessing or operationalizing the legality of personal data transfers between GCC member states and the EU. Covers GDPR Articles 44–50 transfer mechanisms (SCCs, BCRs, derogations), KSA PDPL Article 29, UAE PDPL Article 22, and Bahrain PDPL Articles 12–13. Triggers on questions about cross-border transfer legality, data processing agreements with EU or GCC vendors, AI tool hosting location, and MENA–EU client data flows. Alias of safety-cross-border-data-transfer-gcc-eu kept for safety-compliance category routing.

Cyber Law Compliance Summary

Apache-2.0Cross-jurisdictionData protection

Produces structured cyber law compliance memoranda covering GDPR, CCPA, state privacy laws, and sector-specific regulations for US and EU operations. Includes Bluebook citations, jurisdiction comparison tables, penalty exposure, and regulatory trends. Use when advising on digital operations compliance, privacy program design, incident response readiness, or preparing compliance gap assessments.

Data privacy agreement

Apache-2.0Cross-jurisdictionData protection

Draft and fill data privacy contract and agreement templates — DPA, data processing contract, GDPR, HIPAA BAA, business associate agreement, AI addendum. Produces signable DOCX files from Common Paper standard forms. Use when user says "DPA," "data processing agreement," "HIPAA BAA," "business associate agreement," or "AI addendum." To understand a U.S. state's consumer privacy law (CCPA etc.) rather than draft, see data-privacy-law-explainer. Includes lawyer-reviewed practice guides; see openagreements.org/editors.

Data retention and deletion

MITCross-jurisdictionData protection

Use when deciding how long data may or must be kept, building a retention schedule, implementing a deletion or expiry job, answering an erasure request, or filling in the storage-period column of a privacy notice or ROPA. Also use when a table has no expiry at all, when logs, backups, warehouses or third-party tools hold copies nobody scheduled, when a TTL or lifecycle rule is about to be treated as proof of deletion, or before a processor engagement ends.

Data Sovereignty Patterns

MITCross-jurisdictionData protection

Navigate cross-border data transfer rules — Schrems II, EU SCCs, adequacy decisions, data localization requirements for EU, US, Brazil, and other jurisdictions.

Design Data Retention Policy

MITCross-jurisdictionData protection

Use when creating or auditing a data retention policy that balances legal obligations, business needs, and privacy requirements