Individual skill
data-policy
Use when building internal data-governance machinery: a retention schedule (period, lawful basis, expiry action, system where deletion runs), an Art. 6 lawful-basis register, an Art. 30 ROPA, or a consent capture/withdrawal model. NOT the public privacy notice or DSAR handling (that is `gdpr-privacy`), NOT SOC 2 posture (that is `compliance`).
skills/data-policy/SKILL.md
Source commit d9d6bb338f66cc1e23998585e580a0ea45bbcb82
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Not checked yet
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 552
- Repository last updated
- Nov 4, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- agentic-ai Repository topic
- ai-agents Repository topic
- ai-coding Repository topic
- claude-code Repository topic
- cli Repository topic
- cline Repository topic
- codex Repository topic
- coding-assistant Repository topic
- cursor Repository topic
- data-governance Declared skill tag
- retention Declared skill tag
- gdpr Declared skill tag
- ropa Declared skill tag
- consent Declared skill tag
- lawful-basis Declared skill tag
- privacy Declared skill tag
- data-minimization Declared skill tag
- legal Derived category
- data Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 12,597 bytesevals/README.mddoc · 993 bytesevals/cases.yamlasset · 3,220 bytesreferences/consent-and-ropa.mddoc · 4,706 bytesreferences/retention-schedule.mddoc · 4,992 bytesscripts/verify.shruns · 5,398 bytes
Read excerpt
# Data policy
You produce the structured governance artifacts engineering and ops implement — a retention schedule, a lawful-basis register, a Record of Processing Activities (ROPA), a consent model — not the public-facing notice users read (that is `../gdpr-privacy/SKILL.md`). You are not a DPO and you never claim to be one.
**A retention rule is only real when it has all four parts: a concrete period, the lawful basis, the expiry action, and the system where deletion actually runs.** A policy that names a period but never deletes anything is a paper policy — and a paper policy is precisely what regulators fine. Cumulative GDPR fines hit ~EUR 5.65B across ~2,245 actions by March 2025, and the two failures that recur are *no systematic data classification* and *no automated deletion capability* (Secure Privacy / CMS Enforcement Tracker, 2025). Every schedule you emit ends with the DPO/counsel sign-off boundary below.
## First move: which artifact does the operator need?
Map the request to one artifact before writing anything. Each routes to a section.
| Operator says | Artifact | Go to |
|---|---|---|
| "How long do we keep X / write our retention policy" | Retention schedule | Build the retention schedule |
| "Is our basis consent or legitimate interest?" | Lawful-basis register | Pick the lawful basis |