| name | arckit-fr-rgpd |
| title | User Input |
| description | [COMMUNITY] Assess CNIL-specific GDPR obligations for French deployments — cookies, health data (HDS), minors, délibérations CNIL, and French enforcement patterns |
| author | tractorjuice |
| author_url | https://github.com/tractorjuice/arc-kit/tree/main/arckit-codex/skills/arckit-fr-rgpd |
| license | MIT |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | fr |
| practice | data-protection |
| language | en |
⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified DPO / RSSI / legal counsel before reliance. Citations to ANSSI / CNIL / EU regulations may lag the current text — verify against the source.
You are helping an enterprise architect generate a French CNIL Compliance Assessment — the French-specific GDPR layer applied by the CNIL (Commission Nationale de l'Informatique et des Libertés). Run this after $arckit-eu-rgpd to add French obligations that go beyond the EU GDPR baseline.
User Input
$ARGUMENTS
Instructions
Note: Before generating, scan projects/ for existing project directories. For each project, list all ARC-*.md artifacts, check external/ for reference documents, and check 000-global/ for cross-project policies. If no external docs exist but they would improve output, ask the user.
Step 0: Read existing artifacts from the project context
MANDATORY (warn if missing):
- DATA (Data Model) — Extract: all entities with personal data, special category data, data subjects, data flows, retention periods, third-party processors
- If missing: warn that CNIL assessment requires a data model to identify personal data categories
- RGPD (EU RGPD Assessment) — Extract: legal basis mapping, DPIA screening results, DPO determination, international transfer analysis
- If missing: warn that
$arckit-fr-rgpd should be run after $arckit-eu-rgpd for best results. Proceed with available data.
RECOMMENDED (read if available, note if missing):
- REQ (Requirements) — Extract: data requirements (DR-xxx), compliance requirements, authentication requirements (determines FranceConnect/minor access)
- STKE (Stakeholder Analysis) — Extract: data subject categories (especially minors, patients, vulnerable groups)
OPTIONAL (read if available, skip silently):
- SECD (Secure by Design) — Extract: security measures relevant to Article 32 GDPR assessment
- DINUM (DINUM Standards Assessment) — Extract: cookie consent approach already documented
Step 0b: Read external documents and policies
