Skip to main content Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill gdpr-compliance-vibeevalThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository fetching-arbitration-rules Use when retrieving arbitration institutional rules (ICC, LCIA, SCC, SIAC, HKIAC, VIAC, МКАС/МАК при ТПП України, UNCITRAL) — fetching current version, verifying redaction applicable to the date of arbitration agreement, constructing URLs for official rule texts
determining-pl-request-regime Use when choosing the Polish legal regime for letters, requests, applications, complaints, petitions, public-information requests, KPA filings, PPSA complaints, RODO access requests, registry extracts, court-file access, tax/ZUS/cudzoziemcy/USC procedures, or professional lawyer letters. Prevents mixing UDIP, KPA, PPSA, RODO, registry, special-procedure, and advocate/radca letter regimes.
applying-new-york-convention Use when preparing applications for recognition and enforcement of foreign arbitral awards in Poland, applications for setting aside arbitral awards under KPC art. 1205–1211, or opposing such applications — mapping Article V of the 1958 New York Convention to art. 1214–1215 of the Polish KPC, identifying grounds for refusal, structuring public policy arguments
Related occupations SOC
Based on SOC occupation classification
name gdpr-compliance-vibeeval title GDPR Compliance description GDPR compliance - data subject rights, lawful basis, DPIA, privacy by design, breach notification, consent management, cross-border transfers, PII masking author vibeeval author_url https://github.com/vibeeval/vibecosystem/tree/main/skills/gdpr-compliance license MIT version 0.1.0 execution_mode open jurisdiction general practice data-protection language en
GDPR Compliance
Data Subject Rights
Rights Overview
Right Article SLA Implementation Right of Access Art. 15 30 gun Data export endpoint Right to Rectification Art. 16 30 gun Profile edit + audit trail Right to Erasure Art. 17 30 gun Cascading delete + anonymize Right to Restriction Art. 18 30 gun Processing flag on record Right to Portability Art. 20 30 gun Machine-readable export (JSON/CSV) Right to Object Art. 21 30 gun Opt-out mechanism Automated Decision-Making Art. 22 30 gun Human review override
Data Subject Request Handler
interface DSRRequest {
id : string ;
type : 'access' | 'rectification' | 'erasure' | 'restriction' | 'portability' | 'objection' ;
subjectId : string ;
verifiedIdentity : boolean ;
receivedAt : Date ;
deadline : Date ;
status : 'received' | 'verified' | 'processing' | 'completed' | 'rejected' ;
reason ?: string ;
}
async
function
handleDSR
request : DSRRequest
Promise
DSRResponse
if
verifiedIdentity
return
status
'rejected'
reason
'Identity not verified'
const
differenceInDays
deadline
new
Date
if
5
await
alertDPO
type
'dsr_deadline_approaching'
switch
type
case
'access'
return
await
generateDataExport
subjectId
case
'erasure'
return
await
executeErasure
subjectId
case
'portability'
return
await
generatePortableExport
subjectId
'json'
case
'rectification'
return
await
updateSubjectData
subjectId
corrections
case
'restriction'
return
await
restrictProcessing
subjectId
case
'objection'
return
await
recordObjection
subjectId
reason
Right to Erasure Implementation async function executeErasure (subjectId : string Promise <ErasureResult > {
const erasureLog : ErasureStep [] = [];
await db.transaction (async (tx) => {
await tx.users .update ({
where : { id : subjectId },
data : {
email : `erased-${hash(subjectId)} @deleted.local` ,
name : 'Erased User' ,
phone : null ,
address : null ,
dateOfBirth : null ,
deletedAt : new Date (),
},
});
erasureLog.push ({ table : 'users' , action : 'anonymized' });
const deletedMessages = await tx.messages .deleteMany ({
where : { userId : subjectId },
});
erasureLog.push ({ table : 'messages' , action : 'deleted' , count : deletedMessages.count });
await tx.sessions .deleteMany ({ where : { userId : subjectId } });
await tx.refreshTokens .deleteMany ({ where : { userId : subjectId } });
erasureLog.push ({ table : 'sessions' , action : 'deleted' });
await tx.auditLogs .updateMany ({
where : { actorId : subjectId },
data : { actorId : 'erased' , actorEmail : 'erased' },
});
erasureLog.push ({ table : 'auditLogs' , action : 'anonymized' });
await notifyProcessors (subjectId, 'erasure' );
await tx.erasureRecords .create ({
data : {
subjectHash : hash (subjectId),
erasedAt : new Date (),
systems : erasureLog,
},
});
});
return { success : true , steps : erasureLog };
}
Lawful Basis for Processing Basis Article When to Use Example Consent Art. 6(1)(a) Optional processing, marketing Newsletter signup Contract Art. 6(1)(b) Necessary for service delivery Order processing Legal obligation Art. 6(1)(c) Required by law Tax records Vital interests Art. 6(1)(d) Life-threatening situations Emergency contact Public interest Art. 6(1)(e) Public authority tasks Government services Legitimate interest Art. 6(1)(f) Business need, balanced with rights Fraud prevention
Lawful Basis Checklist
Data Protection Impact Assessment (DPIA)
When Required (Art. 35)
Automated decision-making with legal effects
Large-scale processing of sensitive data
Systematic monitoring of public areas
New technology with high privacy risk
Large-scale profiling
DPIA Template ## Data Protection Impact Assessment
**Project:** [proje adi]
**Date:** [tarih]
**DPO Review:** [evet/hayir]
### 1. Processing Description
- What data: [veri turleri]
- Why: [amac]
- How: [islem yontemi]
- Who: [erisim kimlerde]
- How long: [saklama suresi]
### 2. Necessity & Proportionality
- Lawful basis: [hukuki dayanak]
- Data minimization: [minimum veri mi?]
- Purpose limitation: [amac sinirli mi?]
- Storage limitation: [saklama suresi uygun mu?]
### 3. Risk Assessment
| Risk | Likelihood | Impact | Severity | Mitigation |
|------|-----------|--------|----------|------------|
| Unauthorized access | [L/M/H] | [L/M/H] | [L/M/H] | [onlem] |
| Data breach | [L/M/H] | [L/M/H] | [L/M/H] | [onlem] |
| Purpose creep | [L/M/H] | [L/M/H] | [L/M/H] | [onlem] |
### 4. Measures
- [ ] Encryption at rest and in transit
- [ ] Access controls (RBAC)
- [ ] Audit logging
- [ ] Data minimization applied
- [ ] Retention policy configured
- [ ] Pseudonymization where possible
### 5. DPO Sign-off
Date: [tarih] | Approved: [evet/hayir]
Privacy by Design Patterns
Data Minimization
const user = await db.users .findUnique ({
where : { id },
});
const user = await db.users .findUnique ({
where : { id },
select : {
id : true ,
name : true ,
email : true ,
},
});
PII Masking function maskPII (data : Record <string , unknown >Record <string , unknown > {
const piiFields : Record <string , (val : string string > = {
email : (v ) => v.replace (/^(.{2}).*(@.*)$/ , '$1***$2' ),
phone : (v ) => v.replace (/^(.{3}).*(.{2})$/ , '$1*****$2' ),
ssn : (v ) => `***-**-${v.slice(-4 )} ` ,
creditCard : (v ) => `****-****-****-${v.slice(-4 )} ` ,
ip : (v ) => v.replace (/\.\d+$/ , '.xxx' ),
name : (v ) => `${v.charAt(0 )} ${'*' .repeat(v.length - 1 )} ` ,
};
return Object .fromEntries (
Object .entries (data).map (([key, value] ) => {
const masker = piiFields[key];
if (masker && typeof value === 'string' ) {
return [key, masker (value)];
}
return [key, value];
})
);
}
Encryption at Rest import { createCipheriv, createDecipheriv, randomBytes } from 'crypto' ;
const ALGORITHM = 'aes-256-gcm' ;
function encryptPII (plaintext : string , key : Buffer EncryptedData {
const iv = randomBytes (16 );
const cipher = createCipheriv (ALGORITHM , key, iv);
const encrypted = Buffer .concat ([cipher.update (plaintext, 'utf8' ), cipher.final ()]);
const authTag = cipher.getAuthTag ();
return {
ciphertext : encrypted.toString ('base64' ),
iv : iv.toString ('base64' ),
authTag : authTag.toString ('base64' ),
};
}
function decryptPII (data : EncryptedData , key : Buffer string {
const decipher = createDecipheriv (
ALGORITHM ,
key,
Buffer .from (data.iv , 'base64' )
);
decipher.setAuthTag (Buffer .from (data.authTag , 'base64' ));
return decipher.update (data.ciphertext , 'base64' , 'utf8' ) + decipher.final ('utf8' );
}
Data Breach Notification (72 Saat Kurali)
Notification Workflow 0h → Breach detected
→ Incident response team activated
→ Containment measures started
24h → Impact assessment completed
→ Affected data subjects identified
→ Breach severity classified
48h → Notification to DPA prepared
→ Data subject notification prepared (if high risk)
72h → DEADLINE: DPA notification submitted (Art. 33)
→ Data subject notification sent if required (Art. 34)
Breach Assessment interface BreachAssessment {
detectedAt : Date ;
nature : string ;
categoriesAffected : string [];
subjectsAffected : number ;
likelyConsequences : string [];
measuresTaken : string [];
riskLevel : 'low' | 'medium' | 'high' ;
notifyDPA : boolean ;
notifySubjects : boolean ;
dpaNotificationDeadline : Date ;
}
function assessBreachRisk (breach : BreachAssessment string {
const highRiskFactors = [
breach.categoriesAffected .includes ('financial' ),
breach.categoriesAffected .includes ('health' ),
breach.categoriesAffected .includes ('credentials' ),
breach.subjectsAffected > 1000 ,
];
const highRiskCount = highRiskFactors.filter (Boolean ).length ;
if (highRiskCount >= 2 ) return 'high' ;
if (highRiskCount >= 1 ) return 'medium' ;
return 'low' ;
}
Consent Management
Consent Collection interface ConsentRecord {
subjectId : string ;
purpose : string ;
granted : boolean ;
grantedAt : Date | null ;
revokedAt : Date | null ;
method : 'explicit_opt_in' | 'form' | 'api' ;
version : string ;
ip ?: string ;
evidence : string ;
}
async function recordConsent (consent : ConsentRecord Promise <void > {
await db.consents .create ({ data : consent });
await auditLog ({
action : `consent.${consent.granted ? 'granted' : 'revoked' } ` ,
actor : consent.subjectId ,
resource : consent.purpose ,
details : { version : consent.version },
});
}
Consent Anti-Patterns Anti-Pattern GDPR Violation Dogru Yol Pre-ticked checkboxes Art. 7 - not freely given Unchecked by default Bundled consent Art. 7 - not specific Separate consent per purpose Dark patterns (confusing UI) Art. 7 - not informed Clear, plain language No withdrawal mechanism Art. 7(3) - easy withdrawal One-click unsubscribe Consent wall (block access) Art. 7 - not freely given Allow access without consent Implicit consent Art. 4(11) - not unambiguous Explicit opt-in required
Cross-Border Data Transfer
Transfer Mechanisms Mechanism When to Use Complexity Adequacy decision EU-approved country (UK, Japan, etc.) Low Standard Contractual Clauses (SCCs) US, India, etc. Medium Binding Corporate Rules (BCRs) Intra-group transfers High Explicit consent One-off transfers Low EU-US Data Privacy Framework US companies certified Medium
Transfer Impact Assessment (TIA) ## Transfer Impact Assessment
**From:** [EU entity]
**To:** [Non-EU entity, country]
**Mechanism:** [SCC / BCR / Adequacy / Consent]
### Data Transferred
- Categories: [personal data types]
- Volume: [approximate records/month]
- Frequency: [continuous / batch / ad-hoc]
### Recipient Country Assessment
- Privacy laws: [adequacy level]
- Government access: [surveillance risk]
- Legal remedies: [available to EU subjects?]
### Supplementary Measures
- [ ] End-to-end encryption (keys retained in EU)
- [ ] Pseudonymization before transfer
- [ ] Access controls at destination
- [ ] Contractual prohibition on government disclosure
- [ ] Regular compliance audits
Data Minimization & Retention
Retention Policy Data Category Retention Period Legal Basis After Expiry Active user data Account lifetime Contract Anonymize Inactive user data 2 yil inactivity Legitimate interest Delete Transaction records 7 yil Legal obligation (tax) Archive encrypted Marketing consent Until revoked Consent Delete Support tickets 3 yil after resolution Legitimate interest Anonymize Access logs 1 yil Legitimate interest Delete Analytics (aggregated) Indefinite Legitimate interest N/A (no PII)
Automated Retention Enforcement async function enforceRetentionPolicies (Promise <RetentionReport > {
const report : RetentionReport = { deletedCount : 0 , anonymizedCount : 0 };
const inactiveThreshold = subYears (new Date (), 2 );
const inactiveUsers = await db.users .findMany ({
where : { lastActiveAt : { lt : inactiveThreshold }, deletedAt : null },
});
for (const user of inactiveUsers) {
await executeErasure (user.id );
report.deletedCount ++;
}
const ticketThreshold = subYears (new Date (), 3 );
const oldTickets = await db.tickets .updateMany ({
where : { resolvedAt : { lt : ticketThreshold }, anonymized : false },
data : { userEmail : 'anonymized' , userName : 'anonymized' , anonymized : true },
});
report.anonymizedCount += oldTickets.count ;
const logThreshold = subYears (new Date (), 1 );
await db.accessLogs .deleteMany ({
where : { createdAt : { lt : logThreshold } },
});
return report;
}
GDPR Compliance Checklist
Organizational
Technical 