Data protection legal-AI skills in General

286 legal AI skills for data protection in General.

Intake — Data Privacy Assessment

MITGeneralData protection

Use when a user requests a data-privacy compliance assessment or gap analysis for their organization — to gather the 13 required inputs spanning organization profile, data subjects, data categories, processing purposes, lawful bases, data sharing, cross-border transfers, and current policies. Outputs a gap-analysis matrix against applicable frameworks (GDPR, KSA PDPL, UAE PDPL, and others) plus a prioritized remediation roadmap. Applies across all jurisdictions; particularly strong for MENA organizations subject to multiple overlapping frameworks.

Intellectual Property Analysis

MITGeneralData protection

Analyze intellectual property rights across patents, trademarks, copyrights, and trade secrets. Use this skill when the user needs to understand IP protection options, evaluate whether their work is protectable, assess infringement risk, or design an IP strategy — even if they say 'can I patent this', 'someone copied our design', 'how do we protect our brand name', or 'what IP do we have'.

Internal Privacy Audit Program

Apache-2.0GeneralData protection

Guides internal privacy audit program design and execution including risk-based audit planning, scope definition, fieldwork procedures, finding classification, evidence gathering, remediation tracking, and management reporting. Covers audit universe definition, annual audit plan, working papers, and closure verification. Keywords: internal audit, privacy audit, fieldwork, remediation, findings, audit plan.

ISO 27701 Privacy Information Management Skill

MITGeneralData protection

Expert ISO 27701 Privacy Information Management System (PIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 27701:2025, ISO/IEC 27701:2019, privacy information management, PIMS certification, PII controller or processor obligations, privacy risk assessment, Statement of Applicability for privacy, privacy by design, data subject rights, DPIA, records of processing activities, transitioning from ISO 27701:2019, GDPR alignment with ISO 27701, or any privacy management system topic. Also trigger for questions about Annex A.1 (controller controls), A.2 (processor controls), A.3 (shared security controls), or implementing a standalone PIMS without ISO 27001. When in doubt, use this skill — it covers the full ISO 27701 lifecycle from gap assessment through certification.

ISO 27701 Privacy Information Management System Implementation

Apache-2.0GeneralData protection

Guides ISO 27701 Privacy Information Management System implementation extending ISO 27001/27002. Covers Clause 5 PIMS-specific requirements, Clause 6 PIMS guidance for ISO 27002, Clause 7 PII controller guidance (Annex A), Clause 8 PII processor guidance (Annex B), gap assessment, and certification path. Keywords: ISO 27701, PIMS, privacy management system, ISO 27001 extension, certification, Annex A, Annex B.

Kantara Initiative Consent Receipt Specification

Apache-2.0GeneralData protection

Implement the Kantara Initiative consent receipt specification including machine-readable receipt structure, JWT-based verification mechanisms, receipt lifecycle management, and integration patterns for consent management platforms. Supports ISO/IEC 27560 consent record information structure.

Lawful Basis for AI Training Data

Apache-2.0GeneralData protection

Assesses lawful basis for AI training data processing per EDPB April 2025 report on LLMs and general-purpose AI. Covers legitimate interest balancing tests, consent challenges for ML training, public dataset assessment, and web scraping lawfulness. Keywords: AI training data, lawful basis, EDPB LLM, legitimate interest, consent, web scraping.

legal-advisor

MITGeneralData protection

legal-advisor workflow skill. Use this skill when the user needs Draft privacy policies, terms of service, disclaimers, and legal notices. Creates GDPR-compliant texts, cookie policies, and data processing agreements and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

Legal advisor

MITGeneralData protection

LINDDUN Privacy Threat Modeling

Apache-2.0GeneralData protection

Conduct LINDDUN privacy threat modeling across all seven categories: Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness, and Non-compliance. Includes DFD-based analysis, threat trees, privacy-specific mitigation strategies, and integration with STRIDE security threat modeling.

LLM Output Privacy Risk Assessment

Apache-2.0GeneralData protection

Assessing privacy risks in large language model outputs including training data memorisation, PII leakage in generated text, prompt injection leading to data extraction, and hallucinated personal data. Covers output filtering, guardrails, and monitoring. Keywords: LLM privacy, output risk, memorisation, PII leakage, prompt injection, hallucinated PII.

Maintaining Breach Documentation Records

Apache-2.0GeneralData protection

Maintains the GDPR Article 33(5) breach register documenting all personal data breaches regardless of whether supervisory authority notification was required. Covers mandatory register fields including facts, effects, and remedial actions, retention periods, audit readiness, and integration with the accountability framework. Keywords: breach register, Article 33(5), breach documentation, accountability, audit readiness, remedial actions.

Managing Automated Decision-Making and Profiling Rights

Apache-2.0GeneralData protection

Manages GDPR Article 22 rights related to solely automated decision-making and profiling, including identification of automated decisions, meaningful human oversight implementation, logic explanation requirements, and contestation mechanisms. Activate for automated decision, profiling, Art. 22, algorithmic decision, AI decision queries.

Managing Breach Credit Monitoring

Apache-2.0GeneralData protection

Coordinates credit monitoring and identity theft protection services for individuals affected by a data breach. Covers vendor selection criteria, enrollment logistics, coverage duration (12-24 months), identity theft insurance options, communication to affected individuals, and enrollment rate tracking. Keywords: credit monitoring, identity protection, breach response, Experian, enrollment, identity theft insurance.

Managing CCPA Consumer Requests

Apache-2.0GeneralData protection

Manages California Consumer Privacy Act (CCPA) consumer rights requests under Civil Code sections 1798.100-125, covering the right to know, right to delete, right to opt-out of sale, and non-discrimination. Includes 45-day response window and identity verification requirements. Activate for CCPA, California privacy, right to know, right to delete, opt-out of sale queries.

Managing Consent for Analytics Cookies

Apache-2.0GeneralData protection

Managing consent for analytics cookies and implementing privacy-preserving measurement. Covers GA4 privacy configuration, consent mode fallback behavior, aggregate reporting alternatives, and cookieless measurement approaches.

Managing Consent for Research

Apache-2.0GeneralData protection

Guide for managing consent for scientific research under GDPR Article 89 and Recital 33 broad consent provisions. Covers ethical review board coordination, purpose evolution management, appropriate safeguards including pseudonymization, and the interplay between consent and other lawful bases for research processing.

Managing Consent for Transfers

Apache-2.0GeneralData protection

Guide for obtaining explicit consent for international data transfers under GDPR Article 49(1)(a). Covers informed consent requirements including risks of transfers without adequacy decisions or appropriate safeguards, specific destination country disclosure, and the narrow scope of derogation-based transfers.

Managing Data Subject Breach Communication

Apache-2.0GeneralData protection

Manages direct communication to affected data subjects following a personal data breach under GDPR Article 34 when the breach is likely to result in a high risk to their rights and freedoms. Covers the high risk threshold, required notification content per Art. 34(2), exemptions under Art. 34(3), and breach notification letter templates for five scenarios. Keywords: data subject notification, Article 34, high risk, breach communication, GDPR.

Managing Deletion Requests for Children's Data

Apache-2.0GeneralData protection

Manages deletion requests for children's personal data. Covers parental-initiated versus child-initiated requests, age of capacity assessment, identity verification, scope determination, third-party notification obligations, and regulatory timelines under GDPR Art. 17, COPPA Section 312.6, and UK AADC Standard 15. Keywords: deletion, children, right to erasure, parental request, data deletion, COPPA.

Managing Direct Marketing Objection

Apache-2.0GeneralData protection

Manages the absolute right to object to direct marketing under GDPR Article 21(2)-(3), covering immediate cessation of all direct marketing processing, suppression list management, cross-channel enforcement, and profiling for marketing purposes. Activate for marketing opt-out, unsubscribe, Art. 21(2), direct marketing objection queries.

Managing Joint Controller Arrangements

Apache-2.0GeneralData protection

Guides the establishment and management of joint controller arrangements under GDPR Article 26, including determination of joint controllership, allocation of responsibilities, and transparency obligations. Activate when two or more controllers jointly determine purposes and means of processing, or when evaluating shared data platforms. Keywords: joint controller, Article 26, shared responsibility, arrangement, joint determination.

Managing Mobile App Consent

Apache-2.0GeneralData protection

Guide for mobile-specific consent management covering Apple ATT framework for iOS, Android permission model, in-app consent flows, SDK consent propagation to third-party libraries, and IDFA/GAID handling. Addresses platform-specific requirements alongside GDPR and ePrivacy compliance for mobile applications.

Managing PIA Review and Update Cadence

Apache-2.0GeneralData protection

Guides the periodic DPIA review lifecycle including trigger identification for regulatory changes, new data categories, technology changes, and breach incidents. Covers version control, stakeholder sign-off procedures, and DPIA register management per Art. 35(11). Keywords: DPIA review, PIA update, review cadence, version control, Art. 35(11), periodic review, trigger events, stakeholder sign-off.