Data protection legal-AI skills in General

286 legal AI skills for data protection in General.

Slovak to English GDPR Translation

MITGeneralData protection

Translates legal articles from Slovak to English with strict terminology mappings for GDPR terms ('prevádzkovateľ' to 'Controller', 'sprostredkovateľ' to 'processor'), maintaining text structure and grammatical accuracy.

Special Category Data Classification — GDPR Art. 9

Apache-2.0GeneralData protection

Identifies and classifies GDPR Art. 9 special category data including racial origin, political opinions, religious beliefs, trade union membership, genetic, biometric, health, and sexual orientation data. Covers processing conditions under Art. 9(2)(a)-(j). Keywords: special category, Art 9, sensitive data, biometric, genetic, health data, explicit consent.

Sub-Processor Management

Apache-2.0GeneralData protection

GDPR Article 28(2) sub-processor approval workflow management. Covers prior specific and general authorization mechanisms, change notification procedures, objection windows, flow-down obligation enforcement, and sub-processor chain risk monitoring.

Supervisory Authority Inspection Preparation

Apache-2.0GeneralData protection

Guides preparation for supervisory authority (DPA) inspections and investigations including document readiness checklists, interview preparation for key personnel, technical demonstration procedures, on-site logistics, response protocols, and post-inspection follow-up. Covers unannounced inspections, formal audits, and complaint-triggered investigations. Keywords: DPA inspection, supervisory authority, investigation, readiness, interview preparation, response protocol.

Terms of Service Analyzer

MITGeneralData protection

Analyze terms of service and privacy policies to identify concerning clauses, hidden permissions, and user rights implications

Terms Recon

MITGeneralData protection

Survey existing privacy and legal docs for completeness and GDPR compliance.

Thailand PDPA Compliance

Apache-2.0GeneralData protection

Guides compliance with Thailand's Personal Data Protection Act B.E. 2562 (2019). Covers consent framework, DPO requirements, PDPC enforcement, lawful bases for processing, cross-border transfer mechanisms, and data subject rights under the PDPA. Keywords: Thailand PDPA, PDPC, consent, DPO, cross-border transfers, data subject rights.

Third-Party Data Sharing Agreement

MITGeneralData protection

Use when a user needs to draft a data sharing agreement between two or more organizations that jointly determine or separately control the purposes and means of processing personal data. Covers controller-to-controller and controller-to-processor configurations, legal bases for sharing, data subject rights obligations, security standards, onward transfer restrictions, and liability allocation. Especially relevant for MENA jurisdictions (UAE PDPL, KSA PDPL, Lebanon draft law, Egypt PDPL) and GDPR-governed cross-border flows.

Transactional — Privacy Impact Assessment (PIA / DPIA)

MITGeneralData protection

Use when a transactional or privacy lawyer needs to conduct a Privacy Impact Assessment (PIA) or Data Protection Impact Assessment (DPIA) for a new processing activity, product launch, M&A transaction, or system change involving personal data. Structures the assessment across six steps: processing identification, necessity/proportionality, risk assessment, mitigation, residual risk documentation, and sign-off registration. MENA-focused (UAE PDPL, KSA PDPL, DIFC DP Law, ADGM DP Regulations) with EU GDPR and UK GDPR alignment.

UK Age Appropriate Design Code Implementation

Apache-2.0GeneralData protection

Implements the UK Age Appropriate Design Code (Children's Code) 15 standards under the Data Protection Act 2018 Section 123. Covers best interests assessment, age-appropriate application, transparency, data minimization, geolocation restrictions, and profiling defaults. Keywords: AADC, Children's Code, ICO, age appropriate design, UK.

Use case triage

Apache-2.0GeneralData protection

Quickly determine whether a processing activity needs a PIA, a mandatory GDPR DPIA, or can proceed — surfaces privacy policy conflicts and routes to the right next step. Use when the user asks "does this need a PIA", "triage this feature", "privacy check on X", "is this okay from a privacy perspective", or describes a new data processing activity, product feature, or vendor relationship.

US State Privacy Law Tracker

Apache-2.0GeneralData protection

Tracks and monitors US state privacy legislation across all 50 states, DC, and territories. Covers enacted comprehensive privacy laws (California CCPA/CPRA, Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, and subsequent enactments), pending bills, effective dates, and key requirement differences. Keywords: state privacy law, CCPA, CPRA, VCDPA, CPA, CTDPA, UCPA, multi-state.

Vendor AI review

Apache-2.0GeneralData protection

Review vendor AI terms — agreement, addendum, or ToS AI provisions — against your governance positions; flag training-on-data, liability, model changes, and AI policy consistency. Use when user says "review this AI agreement", "check OpenAI terms", "what did we agree to with [vendor]", "vendor sent an AI addendum", "is this AI contract okay", or attaches vendor AI terms.

Vendor Breach Notification Cascade

Apache-2.0GeneralData protection

Vendor breach notification cascade management per GDPR Article 33(2). Covers processor-to-controller notification without undue delay, escalation paths, coordinated multi-party breach response, liability allocation, and regulatory notification coordination.

Vendor Certification Acceptance Criteria

Apache-2.0GeneralData protection

Vendor certification acceptance criteria and equivalence mapping. Covers ISO 27701, SOC 2 Privacy, APEC CBPR, EU Code of Conduct evaluation, certification scope analysis, gap supplementation requirements, and cross-framework equivalence assessment.

Vendor Data Protection Addendum

MITGeneralData protection

Use when a company needs to attach a data protection addendum (DPA) to a vendor or supplier agreement where the vendor may access, process, or store personal data on behalf of the company. Covers processor obligations, security requirements, sub-processing restrictions, audit rights, cross-border transfer mechanisms, and breach notification. Especially important for MENA entities subject to UAE PDPL, KSA PDPL, Egypt PDPL, or GDPR, where a written data processing agreement is legally mandatory.

Vendor Privacy Audit

Apache-2.0GeneralData protection

On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.

Vendor Privacy Due Diligence

Apache-2.0GeneralData protection

Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.

Vendor Privacy Monitoring Program

Apache-2.0GeneralData protection

Ongoing vendor privacy compliance monitoring program. Covers annual reassessment procedures, continuous monitoring signals, contract renewal privacy triggers, performance metrics, KPIs, and vendor governance reporting dashboards.

Vendor Privacy Risk Scoring

Apache-2.0GeneralData protection

Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.

Vendor Termination Data Return and Deletion

Apache-2.0GeneralData protection

Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.

Whistleblower Data Protection

Apache-2.0GeneralData protection

Implements data protection compliance for whistleblowing systems under EU Directive 2019/1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019/1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.