MIT🇪🇺European UnionData protection
Handle a data subject rights request under GDPR Articles 12 and 15-22: identify the right invoked (access, rectification, erasure, restriction, portability, objection, automated decisions), verify identity, track the one-month deadline and the two-month extension, check exemptions and refusal grounds, and draft the response plus a request register entry. Use when a subject access request, erasure request, objection, or portability request arrives and the deadline and legal gates must be worked through. The workflow drafts; a human decides, performs the erasure or export, and sends the response.
MIT🇪🇺European UnionData protection
Data Protection Impact Assessment (DPIA) assistant grounded in GDPR Art. 35-36, the EDPB WP248 rev.01 guidelines, and national supervisory-authority blacklists. Walks through: (1) the threshold test - is a DPIA REQUIRED (EDPB's 9 criteria, the ">=2" rule of thumb, Art. 35(3) mandatory cases, the SA's mandatory list), (2) the DPIA structure mandated by Art. 35(7) (systematic description, necessity & proportionality, risk assessment, mitigating measures), (3) the Art. 36 prior-consultation decision. Drafts the DPIA and a decision log - it does NOT make the controller's risk decision or file with the authority (those are human acts). Adds no connectors and makes no outbound calls of its own; the system description you paste still goes to the model you have configured. Use when: "do I need a DPIA", "data protection impact assessment", "DPIA for profiling/CCTV/AI", "Art. 35 GDPR", "prior consultation", "high-risk processing".
MIT🇪🇺European UnionData protection
Data subject rights request (DSAR) assistant grounded in GDPR Art. 12 and 15-22. Identifies the request type (access 15, rectification 16, erasure 17, restriction 18, portability 20, objection 21, automated decisions 22), tracks the DEADLINE (one month from receipt, Art. 12(3); +2 months if complex), gates exemptions and refusal grounds (e.g. Art. 17(3), manifestly unfounded/excessive requests - Art. 12(5)), and drafts the response + a request register. Identity verification of the requester (Art. 12(6)) comes first. It does NOT send responses or erase data (human acts). The skill itself adds no connectors and makes no outbound calls; the text you put in front of it still reaches whatever model you have configured, so keep the request file out of the prompt or point the agent at a local model. Use when: "subject access request", "erasure request", "right to be forgotten", "objection", "DSAR deadline", "data portability".
MIT🇪🇺European UnionData protection
When the user is processing health, genetic, or biometric data of people in the EU/EEA, UK, or other GDPR-aligned jurisdictions, or designing controls for special-category health data. Also use when the user mentions "GDPR," "Article 9," "special category data," "Article 6," "lawful basis," "explicit consent," "controller," "processor," "joint controller," "DPA," "data processing agreement," "DPIA," "DPO," "Article 30," "records of processing," "72 hour breach," "SCCs," "Standard Contractual Clauses," "Schrems II," "Transfer Impact Assessment," "TIA," "Recital 26," "UK GDPR," "EHDS," or "European Health Data Space." For US HIPAA, see hipaa-compliance. For operational PHI controls applicable globally, see phi-handling. For audit-log design, see audit-logging.
MIT🇪🇺European UnionData protection
Use when an organization needs a structured GDPR readiness review across the 10 core compliance areas — lawful basis documentation, privacy notice, consent mechanism, Article 30 records of processing, DPIAs, DPO appointment, DSR handling, 72-hour breach notification, international transfer mechanisms, and vendor/processor management. Produces a traffic-light maturity score per area with findings and prioritized recommendations. Relevant for any organization that processes EU personal data, including MENA companies with EU operations or EU customer data flows.
MIT🇪🇺European UnionData protection
Records of processing (RoPA, GDPR Art. 30) and data processing agreement (DPA, Art. 28) review assistant. Part 1 - RoPA: builds and validates the controller register (Art. 30(1)) and processor register (Art. 30(2)), enforcing the required fields (purposes, categories of data subjects and data, recipients, transfers, erasure timelines, security measures). Part 2 - DPA: checks a processor contract against the mandatory Art. 28(3)(a)-(h) clauses (controller's instructions, confidentiality, security, sub-processing, assistance with data-subject rights, assistance with Art. 32-36, deletion/return, audits) + Chapter V transfers. Produces a draft register and a contract redline - it does NOT sign (a human act). Adds no connectors and makes no outbound calls of its own; the contract text you paste still goes to the model you have configured. Use when: "records of processing", "RoPA Art. 30", "data processing agreement", "DPA Art. 28", "processor contract review", "GDPR register".
MIT🇪🇺European UnionData protection
Use when the user asks about GDPR — lawful bases for processing, data subject rights (DSRs), Records of Processing Activities (ROPA, Article 30), Data Protection Impact Assessments (DPIA, Article 35), international data transfers (SCCs, adequacy, TIA), controller vs processor obligations, breach notification (Articles 33–34), or DPO appointment. For controllers, processors, and sub-processors operating in the EU/EEA or targeting EU residents.
MIT🇪🇺European UnionData protection
Draft and audit data-protection documents from a ROPA-driven model. TRIGGER WHEN: the user needs a Privacy Policy, Cookie Policy, DPA, consent notice, or DPIA under GDPR, ePrivacy, Codice Privacy, CCPA, LGPD, or FADP. DO NOT TRIGGER WHEN: general legal, contract, NDA, or IP questions (use legal-advisor); cookie banners, Consent Mode v2, or GTM (use digital-marketing:ga4-implementation-expert); business planning (use business-planner).