Data protection legal-AI skills in 🇪🇺 European Union

51 legal AI skills for data protection in European Union.

AI Automated Decision-Making and Human Oversight

Apache-2.0European UnionData protection

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

AI System Pre-Deployment Privacy Checklist

Apache-2.0European UnionData protection

Pre-deployment privacy compliance checklist for AI/ML systems covering DPIA completion, lawful basis verification, transparency notices, human oversight mechanisms, bias testing, and post-deployment monitoring setup. Keywords: AI deployment, privacy checklist, go-live, model deployment, compliance gate.

AI Transparency Requirements

Apache-2.0European UnionData protection

Implements AI transparency requirements under EU AI Act Arts. 13-14 and GDPR Arts. 13-14. Covers user notification of AI interaction, system capability disclosure, limitation documentation, and meaningful information about automated logic. Keywords: AI transparency, EU AI Act, GDPR notification, explainability, automated decision.

Analisi fornitori — screening privacy del mastrino

Apache-2.0European UnionData protection

Usa questa skill quando il cliente invia il mastrino fornitori (o un elenco fatture/fornitori) e serve lo screening privacy — es. «analizza il mastrino fornitori», «chi dobbiamo nominare responsabile ex art. 28», «screening fornitori GDPR», «analisi fornitori per la nomina», «il cliente ci ha mandato l'elenco dei fornitori/fatture». Estrae i fornitori da qualunque formato (Excel, CSV, PDF, scansioni, corpo mail), li deduplica, li identifica via web e VIES, ipotizza il ruolo privacy di ciascuno (Responsabile art. 28 / Titolare autonomo / Fuori perimetro) con confidenza tarata, produce l'Excel standard con genera_report_fornitori e, su conferma, le bozze di nomina ex art. 28 con genera_dpa per i responsabili senza DPA proprio.

Audit GDPR Compliance

MITEuropean UnionData protection

Use when assessing an organization's compliance with the General Data Protection Regulation

Cold-start privacy

MITEuropean UnionData protection

Intervista cold-start per profilo privacy: ruoli GDPR, sistemi, processo DSAR, template informativa/DPA. Scrive privacy-gdpr/CLAUDE.md. Nessuna consulenza legale.

consent-and-preferences

MITEuropean UnionData protection

Decide on what basis the program may write to a person, in which channel and for what, what the person chose afterward, how far and how fast a withdrawal takes effect, and which uses of their data beyond sending (selection, scoring, inferred attributes) rest on which basis. Use when a base was imported with a "subscribed" flag and no record behind it, when a person unsubscribes and keeps getting texts from another system, when a checkout ticks the marketing box for everyone, when a segment is built on a purchase that reveals a health condition, or when somebody wants to re-permission the whole base by email. Covers the basis record and its proof, confirmed opt in, basis lifetime, the preference center, withdrawal scope and propagation, special categories, and erasure that keeps the suppression entry. Not the capture form, not the merge of records, not the cap, not the envelope, not the class check of a service message, and not legal advice.

Consent and Tracking

MITEuropean UnionData protection

Inventory everything that touches the user's device, decide what is strictly necessary, and build a consent mechanism that actually gates the scripts

Consent implementation

MITEuropean UnionData protection

Use when wiring a cookie banner, consent manager or CMP into a site — blocking scripts before consent, gating embeds, Google Consent Mode, server-side tagging, consent records, Global Privacy Control — or when asked why trackers still fire before the click. Also use when a site already has a banner and needs an audit, when adding any third-party script, pixel, font, map or video embed, and before any release that touches analytics or advertising tags.

Data policy

MITEuropean UnionData protection

Use when building internal data-governance machinery: a retention schedule (period, lawful basis, expiry action, system where deletion runs), an Art. 6 lawful-basis register, an Art. 30 ROPA, or a consent capture/withdrawal model. NOT the public privacy notice or DSAR handling (that is `gdpr-privacy`), NOT SOC 2 posture (that is `compliance`).

Data Processing Agreement (GDPR — Article 28)

MITEuropean UnionData protection

Use when drafting a Data Processing Agreement (DPA) compliant with GDPR Article 28. Covers all mandatory clauses, the three standard annexes (description of processing, technical/organizational measures, sub-processor list), international transfer mechanisms (SCCs, adequacy, BCRs), UK-GDPR adaptations (IDTA), sub-processor authorization models, audit rights, and liability allocation. P0 data-privacy skill applicable to any controller-processor relationship where EU/EEA personal data is processed.

Design Data Retention

MITEuropean UnionData protection

Use when establishing or reviewing a data retention and deletion policy for personal or business data

Design GDPR Compliance Program

MITEuropean UnionData protection

Use when designing or auditing a GDPR compliance program for an organization that processes personal data of EU/EEA residents

EU AI Act Compliance Audit

MITEuropean UnionData protection

Perform a full codebase audit for EU AI Act (Regulation 2024/1689) compliance. This skill scans the project for AI systems, classifies risk levels, checks transparency and GDPR obligations article-by-article, and produces a prioritized remediation report with file:line references. Use this skill when the user wants a comprehensive compliance review of their project against European AI regulation — e.g., "revisa si este proyecto cumple el AI Act", "audit this repo for EU AI Act compliance", "cumple mi proyecto la ley de IA europea", "what do we need for AI Act before August 2026". This skill is for full project audits that require scanning code, reading legal pages, and producing structured reports. Do NOT use for quick factual questions about specific AI Act articles, risk categories, or obligations — Claude can answer those directly without this skill.

EU baseline for online legal texts

MITEuropean UnionData protection

Use when writing, reviewing, or fixing the EU-law layer of legally required texts for a website, webshop, app, platform, or newsletter reaching the European Union — privacy notice, cookie banner and consent flow, distance-selling information, withdrawal instructions, conformity and guarantee wording, DSA notice-and-action, AI transparency, accessibility information — or when asked whether an online product is EU-compliant. Also use when a template cites an EU directive article at a consumer, when a US or single-member-state template is about to be reused across the EU, when personal data processing starts, or before an EU-facing product goes live.

Gap normativo privacy

MITEuropean UnionData protection

Gap analysis tra documentazione interna (informativa, registro, policy) e requisiti richiesti dall'utente o da nuovo trattamento. Nessuna consulenza legale.

GDPR Breach 72h EN - personal data breach response (Art. 33-34)

MITEuropean UnionData protection

Personal data breach response assistant grounded in GDPR Art. 33-34, EDPB Guidelines 9/2022 on breach notification, and national supervisory-authority breach forms. Runs the decision tree: (1) is it a breach and which type (confidentiality/integrity/availability), (2) risk assessment to rights and freedoms, (3) notify the SA within 72h (Art. 33) - with a deadline counter from awareness, (4) communicate to data subjects (Art. 34, "high risk") + exemptions, (5) internal breach register entry (Art. 33(5)). Drafts the notification and communications - it does NOT send to the SA or to data subjects (human acts). Adds no connectors and makes no outbound calls of its own; the incident details you paste still go to the model you have configured. Use when: "data leak", "GDPR breach", "72-hour notification", "do we notify individuals", "Art. 33", "breach response".

GDPR Breach Notification

MITEuropean UnionData protection

Run the personal data breach decision tree under GDPR Articles 33-34 and EDPB Guidelines 9/2022: classify the breach, assess risk to rights and freedoms, track the 72-hour notification deadline from awareness, decide on communication to data subjects, and draft the supervisory authority notification, the data subject communication, and the internal register entry. Use when a data leak, ransomware incident, misdirected email, or lost device raises the question of whether and whom to notify. The workflow drafts; the controller or DPO decides and sends.

GDPR Compliance Skill

MITEuropean UnionData protection

Expert GDPR compliance assistant covering all four core workflows: (1) auditing code and systems for GDPR violations, (2) drafting GDPR-compliant documents such as privacy policies, Data Processing Agreements (DPAs), and consent notices, (3) answering GDPR compliance questions with authoritative article citations, and (4) reviewing data flows and PII handling practices. Use this skill whenever the user mentions GDPR, data protection, privacy compliance, lawful basis, data subject rights, DPA, privacy notices, consent management, data breaches, DPIAs, controller/ processor relationships, cross-border data transfers, or any EU/UK data privacy topic. Also trigger for questions like "is this GDPR compliant?", "how do I handle personal data?", "what does a privacy policy need?", or any request involving PII, personal data, or data retention in a regulatory context.

GDPR Compliance Skill

Apache-2.0European UnionData protection

Ensure GDPR compliance for personal data processing in CIA platform with privacy-by-design principles

GDPR Data Handling Note

MITEuropean UnionData protection

Drafts a plain-language data handling notice for a journalistic or media production project that involves collecting, storing, or processing personal data — structured to meet GDPR transparency requirements while remaining understandable to non-lawyers.

GDPR Data Map

MITEuropean UnionData protection

Map every field to a purpose, a lawful basis, a retention period and a deletion path — then generate the Art. 30 record and flag the DPIA trigger

GDPR Data Protection

MITEuropean UnionData protection

Implement GDPR (Reg 2016/679) data protection — DPIA templates, Art.30 processing records, data subject rights, legal bases, and cross-border transfers.

GDPR / Data Protection Implementation Pack

MITEuropean UnionData protection

Use when an organization needs to implement GDPR compliance (or the parallel MENA data protection regimes — UAE PDPL, Saudi PDPL) from scratch or remediate gaps. Covers all twelve implementation phases from data mapping through governance, with a parallel track for MENA-specific requirements. Produces a compliance dashboard, updated privacy notice, cookie consent infrastructure, vendor DPAs, DSR processes, breach response playbook, and staff training records.