implementing-gdpr-data-protection-controls

Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer mechanisms (SCCs, BCRs, adequacy). Use when designing or auditing GDPR controls, building a DPIA, handling data subject access/erasure requests, or assessing cross-border data transfers.

Jump to install

Repository: mukul975/Anthropic-Cybersecurity-Skills
Last source activity: August 2, 2026 at 16:32
Detected SKILL.md language: English
Stars: 27,732
Forks: 3,366

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

Implementing GDPR Data Protection Controls

Overview

The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill covers implementing the technical and organizational measures required by GDPR, including data protection by design and by default, Data Protection Impact Assessments (DPIAs), data subject rights management, breach notification procedures, and cross-border data transfer mechanisms.

When to Use

When deploying or configuring implementing gdpr data protection controls capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Understanding of EU data protection law and its territorial scope
Knowledge of personal data processing activities within the organization
Familiarity with data architecture, databases, and application systems
Understanding of data flows including cross-border transfers

Core Concepts

Key GDPR Articles for Technical Controls

Article	Requirement
Art. 5	Principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability
Art. 6	Lawful basis for processing (consent, contract, legal obligation, vital interests, public task, legitimate interest)
Art. 25	Data protection by design and by default
Art. 28	Processor obligations and contractual requirements
Art. 30	Records of processing activities (ROPA)
Art. 32	Security of processing (technical and organizational measures)
Art. 33	Breach notification to supervisory authority (72 hours)
Art. 34	Communication of breach to data subjects
Art. 35	Data Protection Impact Assessment (DPIA)
Art. 37-39	Data Protection Officer (DPO) appointment and role
Art. 44-49	Cross-border data transfers (adequacy, SCCs, BCRs)

Article 32 Security Measures

The regulation requires organizations to implement measures appropriate to the risk:

Pseudonymization and encryption of personal data
Confidentiality, integrity, availability, and resilience of processing systems
Ability to restore availability and access to personal data in a timely manner
Regular testing and evaluation of technical and organizational measures

Data Subject Rights (Articles 12-22)

Right	Article	Description
Right to be informed	13-14	Transparent information about processing
Right of access	15	Obtain copy of personal data
Right to rectification	16	Correct inaccurate data
Right to erasure	17	"Right to be forgotten"
Right to restrict processing	18	Limit processing of data
Right to data portability	20	Receive data in machine-readable format
Right to object	21	Object to processing (especially direct marketing)
Automated decision-making	22	Not be subject to solely automated decisions

Workflow

Phase 1: Data Mapping and Assessment (Weeks 1-6)

Create comprehensive data inventory:
- What personal data is collected
- From whom (data subjects)
- Why (purposes and lawful bases)
- Where it's stored (systems, locations, countries)
- Who has access (internal and external)
- How long it's retained
- What security measures protect it
Document Records of Processing Activities (ROPA) per Article 30
Identify lawful basis for each processing activity
Map cross-border data transfers and transfer mechanisms
Identify processing activities requiring DPIA

Phase 2: Gap Analysis and Risk Assessment (Weeks 7-10)

Assess current state against GDPR requirements
Perform DPIAs for high-risk processing activities
Identify security gaps in Article 32 compliance
Evaluate data retention compliance
Assess data subject rights request handling capabilities

Phase 3: Technical Controls Implementation (Weeks 11-24)

Encryption:
- Data at rest: AES-256 for databases, file systems, backups
- Data in transit: TLS 1.2+ for all personal data transfers
- Key management: secure key storage and rotation procedures
Pseudonymization:
- Implement tokenization for sensitive identifiers
- Separate pseudonymization keys from data stores
Access Controls:
- Role-based access control (RBAC) for personal data
- Principle of least privilege
- MFA for systems processing personal data
- Regular access reviews
Data Minimization:
- Implement data collection limits at application layer
- Default privacy settings (data protection by default)
- Automated data retention enforcement
Erasure and Portability:
- Build data deletion workflows across all systems
- Implement data export in machine-readable formats (JSON, CSV)
- Cascade deletion to backups and archives
Consent Management:
- Implement granular consent collection mechanisms
- Consent withdrawal functionality
- Consent audit trail and versioning
Breach Detection:
- SIEM for personal data access monitoring
- Data loss prevention (DLP) controls
- Anomalous access detection

Phase 4: Organizational Controls (Weeks 11-24)

Appoint Data Protection Officer (DPO) if required
Develop data protection policies and procedures
Create breach notification procedures (72-hour timeline)
Establish data subject request (DSR) handling procedures
Implement vendor management with Data Processing Agreements (DPAs)
Deploy privacy awareness training for all staff
Create data protection by design guidance for development teams

Phase 5: Documentation and Compliance Evidence (Weeks 25-30)

Finalize ROPA documentation
Document all DPIAs and outcomes
Create data protection policies
Document technical and organizational measures
Establish privacy notice and consent records
Create international transfer documentation (SCCs, TIAs)

Phase 6: Ongoing Compliance (Continuous)

Regular DPIA reviews for new processing activities
Annual data mapping refresh
Periodic security measure testing (Art. 32 requirement)
Data subject request tracking and SLA monitoring
Breach response readiness testing
Training refresh and awareness campaigns

Key Artifacts

Records of Processing Activities (ROPA)
Data Protection Impact Assessments (DPIAs)
Data Processing Agreements (DPAs)
Privacy Notices and Consent Records
Breach Response Procedures and Register
Data Subject Request Handling Procedures
International Data Transfer Mechanisms (SCCs, BCRs)
Technical and Organizational Measures Documentation

Common Pitfalls

Treating GDPR as only a legal/compliance exercise without technical implementation
Incomplete data mapping missing shadow IT or legacy systems
Failing to maintain consent audit trails
Not testing 72-hour breach notification capability
Ignoring cross-border transfer requirements for cloud services
Over-reliance on consent as lawful basis when legitimate interest applies

References