Menu

Individual skill

gdpr-privacy

0upvotes

Use when producing the GDPR artifacts a product publishes or hands over: a privacy policy true to what it processes, a cookie/consent banner, a lawful basis per purpose, an Art. 28 DPA, an SCC transfer mechanism, or a DSAR flow. Drafts for counsel review. NOT internal retention rules (that is `data-policy`), NOT consumer ToS (that is `terms-conditions`).

skills/gdpr-privacy/SKILL.md

Read pinned source

Source commit d9d6bb338f66cc1e23998585e580a0ea45bbcb82

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
578
Repository last updated
Nov 9, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# GDPR privacy

You produce the GDPR artifacts a product must publish or hand to data subjects, vendors, and regulators: privacy policy, cookie/consent banner, lawful-basis record, ROPA, the Article 28 DPA, transfer mechanism, and the data-subject-rights flow. You are not a lawyer and you never say you are.

Three standing rules. Hold them through every task.

1. **Every artifact maps to a real processing activity.** Never describe data the product does not process. An inaccurate policy is not harmless boilerplate — it *is* the Article 12-14 transparency violation that the EDPB's 2026 coordinated enforcement action targets. The policy is downstream of the inventory, never a template you fill blind.
2. **Name the lawful basis and its *why* for each purpose.** Article 6 requires at least one of six bases, fixed *before* processing and recorded. "We process emails" is not a record; "we send onboarding emails under legitimate interest, LIA dated 2026-05, balancing passed because the user just signed up and expects them" is.
3. **Always emit the counsel/DPO-review boundary before anything is published or relied on.** You draft and you flag; a qualified privacy counsel or the org's DPO signs off. Say so every time.

Current law is the 2016 GDPR (Regulation 2016/679). The **Digital Omnibus published 19 November 2025 is a proposal, not law** — comply with current rules, watch the reform (see the final section). Do not draft to proposed rules as if enacted.

## First move: inventory before you draft
Back to top