Data protection legal-AI skills in General

286 legal AI skills for data protection in General.

CPRA Sensitive Personal Information

Apache-2.0GeneralData protection

CPRA §1798.121 sensitive personal information restrictions and compliance. Covers all 9 sensitive PI categories including SSN, precise geolocation, racial/ethnic origin, biometric, genetic, health, and sex life data. Right to limit use/disclosure, permitted purposes, and implementation.

Creating GDPR Remediation Roadmap

Apache-2.0GeneralData protection

Guides conversion of gap analysis findings into phased implementation plans with milestones and risk-based prioritisation. Activate when building compliance programmes or allocating privacy budgets. Keywords: remediation roadmap, implementation plan, phased approach, prioritisation.

Criminal Conviction and Offence Data Handling — GDPR Art. 10

Apache-2.0GeneralData protection

Handles GDPR Art. 10 criminal conviction and offence data classification including official authority requirements, national law derogations, and comprehensive register restrictions. Covers controller obligations for criminal background checks and offence records. Keywords: criminal data, Art 10, conviction data, offence records, criminal background, DBS check.

Cross-Jurisdiction Cookie Compliance

Apache-2.0GeneralData protection

Implementing cookie compliance across multiple jurisdictions including EU ePrivacy Directive, UK PECR, US California CCPA/CPRA opt-out model, and Brazil LGPD. Provides a requirements matrix and geolocation-based implementation approach.

Cross-Jurisdiction Data Classification Harmonisation

Apache-2.0GeneralData protection

Harmonises data classification across jurisdictions mapping GDPR special categories vs CCPA sensitive PI (1798.140(ae)) vs HIPAA PHI (160.103) vs LGPD sensitive data (Art. 5-II). Provides cross-regulation mapping matrix for multinational compliance. Keywords: cross-jurisdiction, GDPR, CCPA, HIPAA, LGPD, sensitive data, multinational, classification mapping.

/cs:gdpr-audit-prep — GDPR DPO Forcing Questions

MITGeneralData protection

/cs:gdpr-audit-prep <scope> — GDPR audit 6-question Article-cited forcing interrogation. Use before annual internal GDPR review, post-breach internal audit, DPA investigation readiness, or acquisition due diligence.

/customize

Apache-2.0GeneralData protection

Guided customization of your privacy practice profile — change one thing without re-running the whole cold-start interview. Adjust risk posture, escalation contacts, DPA playbook, privacy policy commitments, PIA house style, DSAR process, or matter workspace paths. Use when the user says "change my [thing]", "update my profile", "edit my playbook", or "customize".

Data Breach Response Plan

MITGeneralData protection

Use when a company needs to draft an internal Data Breach Response Plan covering incident detection and classification, initial assessment, containment, notification to regulators and affected individuals, documentation, post-incident review, and role assignments. MENA-aware: covers UAE PDPL (72-hour notification), DIFC DP Law, ADGM DP Regs, KSA PDPL, GDPR, and UK GDPR notification requirements with their different timelines and thresholds.

Data Classification Labels and Tagging System

Apache-2.0GeneralData protection

Implements data classification labels and tagging systems including metadata tagging, DLP integration, automated label propagation, user-applied labels, and label inheritance rules. Covers Microsoft Purview sensitivity labels and enterprise labeling architecture. Keywords: data labeling, sensitivity labels, metadata tagging, DLP integration, label propagation, Purview, classification.

Data Classification Policy Development

Apache-2.0GeneralData protection

Develops data classification policies with tiered handling (public, internal, confidential, restricted), labeling requirements, enforcement mechanisms, and procedures per tier. Covers policy governance, exception handling, and compliance monitoring. Keywords: classification policy, data tiers, handling procedures, labeling, enforcement, data governance, information security.

Data Inventory and Mapping for Classification

Apache-2.0GeneralData protection

Builds comprehensive data inventory per GDPR Art. 30 Records of Processing Activities. Covers system-by-system discovery, data flow diagramming, third-party identification, and legal basis per category. Keywords: data inventory, data mapping, Art 30, RoPA, data flow, processing activities.

Data Lineage Tracking

Apache-2.0GeneralData protection

Implements data lineage tracking for privacy compliance including origin tracking, transformation logging, access auditing, deletion verification, and cross-system lineage graphs. Covers source-to-sink mapping, GDPR Art. 30 RoPA integration, automated lineage discovery, and breach impact scoping. Keywords: data lineage, data provenance, data flow mapping, transformation logging, deletion verification.

Data Processing Agreement

MITGeneralData protection

Use when a data controller needs to formalise its relationship with a data processor under a Data Processing Agreement (DPA), covering GDPR Article 28 requirements, security obligations, sub-processor approval, audit rights, and breach notification. MENA-aware: DIFC DP Law Art. 26, ADGM DP Regs, UAE PDPL, KSA PDPL all require controller-processor agreements with broadly similar content. Essential for any cloud, SaaS, or outsourcing arrangement.

Data Processing Agreement Drafting

Apache-2.0GeneralData protection

GDPR-compliant Data Processing Agreement drafting per Article 28(3). Covers all 8 mandatory provisions including subject matter, duration, nature and purpose, data types, categories of data subjects, controller and processor obligations, and sub-processor cascade requirements.

Data Protection Impact Assessment for AI/ML Systems

Apache-2.0GeneralData protection

Conducts Data Protection Impact Assessments for AI and ML systems per EDPB Guidelines 04/2025 on AI processing. Covers training data lawfulness evaluation, model risk assessment, automated decision triggers, and AI-specific DPIA methodology. Keywords: AI DPIA, machine learning impact assessment, EDPB AI guidelines, model risk, training data.

Data Retention Policy

MITGeneralData protection

Use when a company needs to draft a Data Retention Policy specifying how long different categories of personal and business data are retained, the legal and business justification for each retention period, secure deletion procedures, and litigation hold protocols. MENA-aware: covers UAE PDPL, DIFC DP Law, ADGM DP Regs, KSA PDPL, and Lebanon/Egypt frameworks, as well as GDPR and commercial/regulatory retention minimums across GCC, EU, and UK.

Data Retention Schedule Design and Implementation

Apache-2.0GeneralData protection

Designs and implements data retention schedules compliant with GDPR Article 5(1)(e) storage limitation principle. Maps data categories to retention periods with legal basis justification, regulatory minimum holding periods, and automated review triggers for schedule maintenance. Activate for retention policy, storage limitation, data lifecycle, retention period queries.

Data Subject Access Request Procedure

MITGeneralData protection

Use when a company needs to draft an internal procedure for handling Data Subject Access Requests (DSARs) or equivalent individual rights requests under applicable data protection law. Covers identity verification, search protocols, response timelines, exemptions assessment, format of response, and escalation. MENA-aware: UAE PDPL, DIFC DP Law, ADGM DP Regs, KSA PDPL alongside GDPR and UK GDPR; timelines and exemptions differ by jurisdiction.

Data Subject Rights for AI Systems

Apache-2.0GeneralData protection

Implements data subject rights mechanisms for AI systems including right to explanation of AI decisions, contestation procedures, human review, model output correction, and training data access. Covers GDPR Arts. 15-22 and AI Act Art. 86. Keywords: data subject rights, AI explanation, contestation, human review, training data access, model correction.

Decodificador de Términos de Servicio

MITGeneralData protection

Decodifica unos términos de servicio o una política de privacidad a lo que realmente estás aceptando, clasificado por impacto en el mundo real. Úsalo cuando alguien pregunte 'qué estoy aceptando', 'decodifica esta política de privacidad', 'estos ToS son malos' o 'debería hacer clic en aceptar'. Produce una tabla de hallazgos clasificados con un veredicto de '¿debería importarme?' por hallazgo, cubriendo reventa de datos, arbitraje y renuncia a demandas colectivas, cambios unilaterales, licencias sobre tu contenido y qué significa realmente la eliminación.

Delaware Personal Data Privacy Act (DPPA)

Apache-2.0GeneralData protection

Delaware Personal Data Privacy Act (DPPA) compliance implementation. Covers consumer rights (access, correct, delete, portability, opt-out), controller obligations, processor requirements, sensitive data consent, universal opt-out recognition, DPIA requirements, and AG enforcement. Effective January 1, 2025, with no revenue threshold for applicability.

Designing Breach Simulation Exercise

Apache-2.0GeneralData protection

Designs and executes tabletop breach simulation exercises for testing organizational breach response capabilities. Covers scenario creation with realistic inject timelines, participant role assignment, communication testing across internal and external channels, decision-point evaluation, and after-action report generation. Keywords: tabletop exercise, breach simulation, incident response testing, scenario design, after-action report.

Designing Federated Learning Architecture

Apache-2.0GeneralData protection

Architecture guide for GDPR-compliant federated learning systems. Covers horizontal and vertical FL, aggregation strategies (FedAvg, FedProx), communication efficiency, secure aggregation, and differential privacy integration. Includes privacy guarantees analysis and deployment patterns for cross-organizational ML without data sharing.

Designing Privacy-Preserving Analytics

Apache-2.0GeneralData protection

Design privacy-preserving analytics systems using differential privacy, k-anonymity, l-diversity, and t-closeness. Covers privacy budget allocation with epsilon tracking, references Google DP library, OpenDP, and Apple PPML. Includes Python differential privacy implementation for GDPR-compliant statistical analysis.