conducting-gdpr-compliance-assessment

Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.

Jump to install

Repository: mukul975/Anthropic-Cybersecurity-Skills
Last source activity: August 24, 2026 at 10:35
Detected SKILL.md language: English
Stars: 31,065
Forks: 3,698

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill conducting-gdpr-compliance-assessment

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

9 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

analyzing-kubernetes-audit-logs

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '

2026-08-23

auditing-kubernetes-rbac-privilege-escalation

Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin. Use when reviewing who can escalate privileges in a cluster, hunting exploitable RoleBindings during an authorized review, or validating least privilege after an RBAC change. Keywords: RBAC, ClusterRoleBinding, service account token, auth can-i, rbac-police, escalate, bind, impersonate. Do not use for designing and applying hardened RBAC - use implementing-rbac-hardening-for-kubernetes.

2026-08-23

benchmarking-kubernetes-with-kube-bench

Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or JUnit output for pipelines. Use when setting kube-bench up for the first time, choosing which benchmark version and node targets to run, wiring it into CI, or troubleshooting skipped or misdetected checks. Keywords: kube-bench, DaemonSet, --benchmark, --targets, JSON output, JUnit, CI integration. Do not use for interpreting the findings or producing an audit report - use performing-kubernetes-cis-benchmark-with-kube-bench.

2026-08-23

View all from this repository

Conducting GDPR Compliance Assessment

Effective Date: August 2026
Legal Basis: EU Regulation 2016/679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga/2025/18)
Pending Changes: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.

When to Use

When an organization processes personal data of EU residents (Article 3 territorial scope applies)

When preparing for a supervisory authority audit (ICO, CNIL, BfDI) or responding to formal inquiry

When implementing privacy-by-design requirements (Article 25) for new systems or data flows

When scoping compliance gaps before M&A due diligence or contract negotiations with EU entities

When responding to data subject access requests (DSARs) and discovering gaps in data inventory

When assessing third-party processors for GDPR compliance before signing Data Processing Agreements (DPAs)

After data breach incidents to verify notification procedures meet 72-hour requirement (Article 33)

Do not use for:

Technical implementation of specific GDPR controls (encryption, pseudonymization, access controls) — use implementing-gdpr-data-protection-controls for Article 32 technical/organizational measures

Automated DSAR processing workflows (identity verification, PII discovery, redaction, delivery) — use implementing-gdpr-data-subject-access-request for DSAR automation

Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria

This skill is for comprehensive compliance assessment across all GDPR articles; use the specialized skills for focused implementation tasks

Prerequisites

Understanding of GDPR Articles 5-32 and key definitions

Access to Article 30 records of processing activities

Data Processing Agreements with third-party processors

Privacy policies, consent forms, cookie notices

Knowledge of lawful bases (Article 6)

Data breach response plan and incident register

List of international data transfers with safeguards

Conducting GDPR Compliance Assessment

When to Use

When an organization processes personal data of EU residents (Article 3 territorial scope applies)

When preparing for a supervisory authority audit (ICO, CNIL, BfDI) or responding to formal inquiry

When implementing privacy-by-design requirements (Article 25) for new systems or data flows

When scoping compliance gaps before M&A due diligence or contract negotiations with EU entities

When responding to data subject access requests (DSARs) and discovering gaps in data inventory

When assessing third-party processors for GDPR compliance before signing Data Processing Agreements (DPAs)

After data breach incidents to verify notification procedures meet 72-hour requirement (Article 33)

Do not use for:

Automated DSAR processing workflows (identity verification, PII discovery, redaction, delivery) — use implementing-gdpr-data-subject-access-request for DSAR automation

Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria

This skill is for comprehensive compliance assessment across all GDPR articles; use the specialized skills for focused implementation tasks

Prerequisites

Understanding of GDPR Articles 5-32 and key definitions

Access to Article 30 records of processing activities

Data Processing Agreements with third-party processors

Privacy policies, consent forms, cookie notices

Knowledge of lawful bases (Article 6)

Data breach response plan and incident register

List of international data transfers with safeguards

name	conducting-gdpr-compliance-assessment
description	Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
domain	cybersecurity
subdomain	compliance-governance
tags	["gdpr","data-protection","privacy","compliance","dpia","data-subject-rights","article-30","controller","processor","eu-regulation","ico","supervisory-authority"]
version	1.0
author	dakshverma23
license	Apache-2.0
nist_csf	["GV.OC-02","GV.PO-01","GV.RM-04","PR.DS-01","PR.DS-02","ID.AM-05"]
mitre_attack	["T1530","T1567"]

name	conducting-gdpr-compliance-assessment
description	Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
domain	cybersecurity
subdomain	compliance-governance
tags	["gdpr","data-protection","privacy","compliance","dpia","data-subject-rights","article-30","controller","processor","eu-regulation","ico","supervisory-authority"]
version	1.0
author	dakshverma23
license	Apache-2.0
nist_csf	["GV.OC-02","GV.PO-01","GV.RM-04","PR.DS-01","PR.DS-02","ID.AM-05"]
mitre_attack	["T1530","T1567"]

Basis	Use Case	Key Requirement
Consent (6(1)(a))	Marketing, profiling	Freely given, specific, withdrawable
Contract (6(1)(b))	Order fulfillment	Strictly necessary only
Legal Obligation (6(1)(c))	Tax records	Cite specific law
Legitimate Interest (6(1)(f))	Fraud prevention, analytics	Three-part test + balancing

Term	Definition
Controller	Determines purposes and means of processing (Article 4(7))
Processor	Processes on behalf of controller (Article 4(8); requires DPA per Article 28)
Personal Data	Any information relating to identified/identifiable natural person (Article 4(1))
Special Categories	Health, biometric, genetic, racial, political, religious, trade union, sex life data (Article 9; heightened protection)
Consent	Freely given, specific, informed, unambiguous indication of wishes (Article 4(11))
Legitimate Interest	Lawful basis requiring three-part test: purpose, necessity, balancing (Recital 47)
DPIA	Data Protection Impact Assessment for high-risk processing (Article 35)
DPO	Data Protection Officer (Article 37; mandatory for public authorities, large-scale monitoring/special categories)
SCCs	Standard Contractual Clauses for international transfers (Commission Implementing Decision 2021/914)
Supervisory Authority	National data protection regulator (ICO for UK, CNIL for France, BfDI for Germany)

conducting-gdpr-compliance-assessment

Install options

Review the source files