Data protection legal-AI skills in 🇪🇺 European Union

51 legal AI skills for data protection in European Union.

GDPR Data Subject Requests

MITEuropean UnionData protection

Handle a data subject rights request under GDPR Articles 12 and 15-22: identify the right invoked (access, rectification, erasure, restriction, portability, objection, automated decisions), verify identity, track the one-month deadline and the two-month extension, check exemptions and refusal grounds, and draft the response plus a request register entry. Use when a subject access request, erasure request, objection, or portability request arrives and the deadline and legal gates must be worked through. The workflow drafts; a human decides, performs the erasure or export, and sends the response.

GDPR DPIA EN - Data Protection Impact Assessment (Art. 35-36)

MITEuropean UnionData protection

Data Protection Impact Assessment (DPIA) assistant grounded in GDPR Art. 35-36, the EDPB WP248 rev.01 guidelines, and national supervisory-authority blacklists. Walks through: (1) the threshold test - is a DPIA REQUIRED (EDPB's 9 criteria, the ">=2" rule of thumb, Art. 35(3) mandatory cases, the SA's mandatory list), (2) the DPIA structure mandated by Art. 35(7) (systematic description, necessity & proportionality, risk assessment, mitigating measures), (3) the Art. 36 prior-consultation decision. Drafts the DPIA and a decision log - it does NOT make the controller's risk decision or file with the authority (those are human acts). Adds no connectors and makes no outbound calls of its own; the system description you paste still goes to the model you have configured. Use when: "do I need a DPIA", "data protection impact assessment", "DPIA for profiling/CCTV/AI", "Art. 35 GDPR", "prior consultation", "high-risk processing".

GDPR DSAR EN - data subject rights requests (Art. 12, 15-22)

MITEuropean UnionData protection

Data subject rights request (DSAR) assistant grounded in GDPR Art. 12 and 15-22. Identifies the request type (access 15, rectification 16, erasure 17, restriction 18, portability 20, objection 21, automated decisions 22), tracks the DEADLINE (one month from receipt, Art. 12(3); +2 months if complex), gates exemptions and refusal grounds (e.g. Art. 17(3), manifestly unfounded/excessive requests - Art. 12(5)), and drafts the response + a request register. Identity verification of the requester (Art. 12(6)) comes first. It does NOT send responses or erase data (human acts). The skill itself adds no connectors and makes no outbound calls; the text you put in front of it still reaches whatever model you have configured, so keep the request file out of the prompt or point the agent at a local model. Use when: "subject access request", "erasure request", "right to be forgotten", "objection", "DSAR deadline", "data portability".

GDPR/DSGVO Expert

MITEuropean UnionData protection

GDPR and German DSGVO compliance automation. Scans codebases for privacy risks, generates DPIA documentation, tracks data subject rights requests with Art. 12(3) one-month deadlines. Use when running GDPR compliance assessments, privacy audits, data protection planning, DPIA generation, or data subject rights (DSAR) management (e.g., 'check this service for GDPR risks', 'track an access request deadline'). Final compliance determinations route to the DPO or legal counsel.

GDPR Expert

MITEuropean UnionData protection

GDPR expert for EU privacy compliance. Deep knowledge of General Data Protection Regulation including 99 articles, 7 principles, 6 lawful bases, data subject rights, DPO requirements, DPIA, breach notification, cross-border transfers, and enforcement.

GDPR for Health Data

MITEuropean UnionData protection

When the user is processing health, genetic, or biometric data of people in the EU/EEA, UK, or other GDPR-aligned jurisdictions, or designing controls for special-category health data. Also use when the user mentions "GDPR," "Article 9," "special category data," "Article 6," "lawful basis," "explicit consent," "controller," "processor," "joint controller," "DPA," "data processing agreement," "DPIA," "DPO," "Article 30," "records of processing," "72 hour breach," "SCCs," "Standard Contractual Clauses," "Schrems II," "Transfer Impact Assessment," "TIA," "Recital 26," "UK GDPR," "EHDS," or "European Health Data Space." For US HIPAA, see hipaa-compliance. For operational PHI controls applicable globally, see phi-handling. For audit-log design, see audit-logging.

GDPR — General Data Protection Regulation

MITEuropean UnionData protection

Use this skill when the software processes personal data from users. Although GDPR is EU legislation, this skill applies as a data protection standard for any software regardless of the geographic location of users. Covers granular consent system, data subject rights (ARCO+), encryption and pseudonymization, retention policy, cookie banner, and compliance checklist.

Gdpr Privacy

Apache-2.0European UnionData protection

Use when implementing GDPR compliance, handling data subject requests, conducting DPIAs, managing consent, or responding to data breaches - covers all key GDPR requirementsUse when ", " mentioned.

GDPR privacy

MITEuropean UnionData protection

Use when producing the GDPR artifacts a product publishes or hands over: a privacy policy true to what it processes, a cookie/consent banner, a lawful basis per purpose, an Art. 28 DPA, an SCC transfer mechanism, or a DSAR flow. Drafts for counsel review. NOT internal retention rules (that is `data-policy`), NOT consumer ToS (that is `terms-conditions`).

GDPR Readiness Review

MITEuropean UnionData protection

Use when an organization needs a structured GDPR readiness review across the 10 core compliance areas — lawful basis documentation, privacy notice, consent mechanism, Article 30 records of processing, DPIAs, DPO appointment, DSR handling, 72-hour breach notification, international transfer mechanisms, and vendor/processor management. Produces a traffic-light maturity score per area with findings and prioritized recommendations. Relevant for any organization that processes EU personal data, including MENA companies with EU operations or EU customer data flows.

GDPR Records of Processing

MITEuropean UnionData protection

Build and validate the records of processing activities (RoPA) required by GDPR Article 30: the controller register under Article 30(1) and the processor register under Article 30(2), enforcing every mandatory field - purposes, categories of data subjects and data, recipients, third-country transfers and safeguards, erasure time limits, and security measures. Flags activities that trigger a DPIA and tests the narrow Article 30(5) exemption. Use when creating a RoPA from scratch, auditing an existing register for gaps, or preparing accountability evidence for a supervisory authority. Complements the DPA review workflows, which cover the processor contract itself.

GDPR Regulation for Java Enterprise Personal Data Protection

Apache-2.0European UnionData protection

Use when reviewing, designing, or modifying Java enterprise systems that process personal data and need GDPR-aware engineering controls. This should trigger for requests such as Review a Java service for GDPR privacy controls; Design data-subject rights workflows; Add retention, deletion, pseudonymization, or privacy-safe logging; Assess data transfer, DPIA, breach evidence, or processor/controller boundary concerns before production release. Part of Plinth Toolkit

GDPR RoPA + DPA EN - records of processing (Art. 30) and processor contracts (Art. 28)

MITEuropean UnionData protection

Records of processing (RoPA, GDPR Art. 30) and data processing agreement (DPA, Art. 28) review assistant. Part 1 - RoPA: builds and validates the controller register (Art. 30(1)) and processor register (Art. 30(2)), enforcing the required fields (purposes, categories of data subjects and data, recipients, transfers, erasure timelines, security measures). Part 2 - DPA: checks a processor contract against the mandatory Art. 28(3)(a)-(h) clauses (controller's instructions, confidentiality, security, sub-processing, assistance with data-subject rights, assistance with Art. 32-36, deletion/return, audits) + Chapter V transfers. Produces a draft register and a contract redline - it does NOT sign (a human act). Adds no connectors and makes no outbound calls of its own; the contract text you paste still goes to the model you have configured. Use when: "records of processing", "RoPA Art. 30", "data processing agreement", "DPA Art. 28", "processor contract review", "GDPR register".

GDPR Skill

MITEuropean UnionData protection

Use when the user asks about GDPR — lawful bases for processing, data subject rights (DSRs), Records of Processing Activities (ROPA, Article 30), Data Protection Impact Assessments (DPIA, Article 35), international data transfers (SCCs, adequacy, TIA), controller vs processor obligations, breach notification (Articles 33–34), or DPO appointment. For controllers, processors, and sub-processors operating in the EU/EEA or targeting EU residents.

GOLDEN RULES

MITEuropean UnionData protection

Draft and audit data-protection documents from a ROPA-driven model. TRIGGER WHEN: the user needs a Privacy Policy, Cookie Policy, DPA, consent notice, or DPIA under GDPR, ePrivacy, Codice Privacy, CCPA, LGPD, or FADP. DO NOT TRIGGER WHEN: general legal, contract, NDA, or IP questions (use legal-advisor); cookie banners, Consent Mode v2, or GTM (use digital-marketing:ga4-implementation-expert); business planning (use business-planner).

Italian mandatory online legal texts

MITEuropean UnionData protection

Use when writing, reviewing, or fixing legally required texts for an Italian website, webshop, app, or newsletter — informazioni sul sito, informativa privacy, cookie policy and banner, condizioni generali di vendita, informativa sul recesso, modulo di recesso, garanzia di conformità, dichiarazione di accessibilità — or when asked whether an Italian online presence is compliant. Also use when a German, US or generic-EU legal template is about to be reused for Italy, when personal data processing starts, or before a site goes live.

/it-recht:cloud-auftragsverarbeitung

Apache-2.0European UnionData protection

Datenschutzkonforme Gestaltung der Cloud-Nutzung: Auftragsverarbeitung nach Art. 28 DSGVO, technische und organisatorische Maßnahmen nach Art. 32 DSGVO und Drittlandtransfer nach Kapitel V DSGVO (Art. 44 ff.). Use when ein Cloud- oder SaaS-Dienst eingesetzt wird und der AVV sowie der Datentransfer geprüft oder gestaltet werden sollen.

Knowledge Pack — GDPR (EU 2016/679) and UK GDPR

MITEuropean UnionData protection

Use when a matter involves EU or UK data protection law, including GDPR compliance, lawful bases for processing, data subject rights, DPO obligations, international transfers, breach notification, or supervisory authority engagement. Also use when comparing GDPR requirements against MENA-region privacy laws (Egypt, KSA PDPL, UAE PDPL) for cross-border operations. Priority P0 reference for any EU/UK-data-touching transaction.

Monitoraggio informativa

MITEuropean UnionData protection

Revisione periodica informativa privacy / policy interne: completezza art. 13-14, coerenza con trattamenti attuali, azioni aggiornamento. Nessuna consulenza legale.

Performing Transfer Impact Assessment

Apache-2.0European UnionData protection

Guides the post-Schrems II Transfer Impact Assessment process following EDPB Recommendations 01/2020 six-step methodology. Covers assessment of third country legal frameworks, supplementary measures evaluation, and TIA scoring. Activate for international data transfers, SCCs, third-country adequacy, or Chapter V compliance. Keywords: TIA, Schrems II, transfer assessment, EDPB, supplementary measures, SCCs, international transfer.

Revisione DPA (art. 28 GDPR)

MITEuropean UnionData protection

Revisione contratto di nomina responsabile (art. 28 GDPR) term-by-term: istruzioni, sub-responsabile, misure, breach, audit, trasferimenti. Output tabella gap con severity. Nessuna consulenza legale.

Risposta diritti interessato (GDPR)

MITEuropean UnionData protection

Workflow completo per richieste interessato GDPR (artt. 15-22): classificazione, verifica identità, mappatura sistemi, esenzioni, bozza lettera e log decisioni. Usare quando arriva accesso, cancellazione, portabilità, rettifica, opposizione o limitazione. Nessuna consulenza legale.

Third-party vendor and integration review (GDPR / ePrivacy)

MITEuropean UnionData protection

Use when a third-party service, SDK, script, API or dependency is about to be added to a product, when an existing integration needs a data-protection sign-off, or when someone asks whether a vendor is "GDPR compliant". Also use when a sub-processor list changes, when a vendor announces a new region or a new owner, when an AI or LLM API is wired into a product, and before any launch that ships a tag, pixel, embed or telemetry SDK.

Triage trattamento

MITEuropean UnionData protection

Valutazione preliminare nuovo trattamento: base giuridica, rischio, necessità DPIA (art. 35), LIA, proceed/hold. Matrice rischio in bozza. Nessuna consulenza legale.