メニュー
[COMMUNITY] Generate GDPR (EU 2016/679) compliance assessment for EU/EEA data processing — legal basis mapping, data subject rights, transfers, DPIA screening, and breach notification across all member states
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill arckit-eu-rgpdコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Use when retrieving arbitration institutional rules (ICC, LCIA, SCC, SIAC, HKIAC, VIAC, МКАС/МАК при ТПП України, UNCITRAL) — fetching current version, verifying redaction applicable to the date of arbitration agreement, constructing URLs for official rule texts
Use when choosing the Polish legal regime for letters, requests, applications, complaints, petitions, public-information requests, KPA filings, PPSA complaints, RODO access requests, registry extracts, court-file access, tax/ZUS/cudzoziemcy/USC procedures, or professional lawyer letters. Prevents mixing UDIP, KPA, PPSA, RODO, registry, special-procedure, and advocate/radca letter regimes.
Use when preparing applications for recognition and enforcement of foreign arbitral awards in Poland, applications for setting aside arbitral awards under KPC art. 1205–1211, or opposing such applications — mapping Article V of the 1958 New York Convention to art. 1214–1215 of the Polish KPC, identifying grounds for refusal, structuring public policy arguments
SOC 職業分類に基づく
SKILL.md を表示中
| name | arckit-eu-rgpd |
| title | User Input |
| description | [COMMUNITY] Generate GDPR (EU 2016/679) compliance assessment for EU/EEA data processing — legal basis mapping, data subject rights, transfers, DPIA screening, and breach notification across all member states |
| author | tractorjuice |
| author_url | https://github.com/tractorjuice/arc-kit/tree/main/arckit-codex/skills/arckit-eu-rgpd |
| license | MIT |
| version | 0.1.1 |
| execution_mode | open |
| jurisdiction | eu |
| practice | data-protection |
| language | en |
⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified DPO / RSSI / legal counsel before reliance. Citations to ANSSI / CNIL / EU regulations may lag the current text — verify against the source.
You are helping an enterprise architect generate a GDPR Compliance Assessment (EU 2016/679) for any organisation processing personal data of EU/EEA residents. This command takes a member-state-neutral approach to the EU GDPR baseline. For French-specific CNIL obligations, run $arckit-fr-rgpd after this assessment.
$ARGUMENTS
Note: Before generating, scan
projects/for existing project directories. For each project, list allARC-*.mdartifacts, checkexternal/for reference documents, and check000-global/for cross-project policies. If no external docs exist but they would improve output, ask the user.
MANDATORY (warn if missing):
RECOMMENDED (read if available, note if missing):
OPTIONAL (read if available, skip silently):
external/000-global/policies/ — extract organisational privacy policy, data retention schedule, data classification scheme, DPO mandate.arckit/references/citation-instructions.md.Identify the target project from the hook context. If the project doesn't exist:
projects/*/ directories and find the highest NNN-* numberprojects/{NNN}-{slug}/README.mdPROJECT_ID and PROJECT_PATHRead all documents from Step 0. Identify:
Read the template (with user override support):
.arckit/templates-custom/eu-rgpd-template.md exists in the project root.arckit/templates/eu-rgpd-template.mdBased on the data model and requirements, automatically score the EDPB 9 criteria:
| # | Criterion | Score YES if... |
|---|---|---|
| 1 | Evaluation/scoring | AI/ML profiling, credit scoring, behavioural profiling |
| 2 | Automated decisions | Legal/significant effect without human review |
| 3 | Systematic monitoring | Continuous tracking, surveillance, CCTV, web analytics at scale |
| 4 | Sensitive/special category data | ANY Article 9 category (health, biometric, genetic, etc.) |
| 5 | Large-scale processing | > 5,000 data subjects OR national/regional scope |
| 6 | Matching/combining datasets | Multiple data sources joined for new purposes |
| 7 | Vulnerable data subjects | Children, elderly, patients, job seekers |
| 8 | Innovative technology | AI/ML, biometrics, IoT, blockchain, facial recognition |
| 9 | Prevents exercising rights | No SAR/deletion/portability mechanism |
DPIA Decision:
$arckit-dpiaCRITICAL: Use the Write tool to create the assessment document.
Detect version: Check for existing ARC-{PROJECT_ID}-RGPD-v*.md files:
Auto-populate Document Control:
ARC-{PROJECT_ID}-RGPD-v{VERSION}Section 1: Scope and Role Determination
Section 2: Lawful Basis Assessment (Articles 6 and 9)
Section 3: Privacy by Design and Default (Article 25)
Section 4: Data Subject Rights (Articles 15–22)
Section 5: Records of Processing Activities (Article 30)
Section 6: DPIA Assessment
Section 7: Data Processors and Sub-Processors (Article 28)
Section 8: International Transfers (Articles 44–49)
Section 9: Breach Notification (Articles 33–34)
Section 10: National Supervisory Authority Context
$arckit-fr-rgpd for CNIL-specific requirementsSection 11: Gap Analysis and Action Plan
Before writing the file, read .arckit/references/quality-checklist.md and verify all Common Checks pass.
Write the document to:
projects/{project_id}/ARC-{PROJECT_ID}-RGPD-v{VERSION}.md
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ GDPR Assessment Generated
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 Document: projects/{project_id}/ARC-{PROJECT_ID}-RGPD-v{VERSION}.md
📋 Document ID: {document_id}
📅 Assessment Date: {date}
🔒 Classification: OFFICIAL-SENSITIVE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 Assessment Summary
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Role: {Controller / Processor / Joint Controller}
Lead DPA: {Authority name}
Data Subjects: {Categories}
Special Category Data: {Yes (categories) / No}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔍 DPIA Screening: {N}/9 criteria → {REQUIRED / RECOMMENDED / NOT REQUIRED}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
International Transfers: {N} transfers identified
{List destination countries and mechanisms}
Total Gaps: {N} ({N} high, {N} medium, {N} low)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Next steps:
{If DPIA required: 1. Run $arckit-dpia — DPIA required (2+ criteria met)}
{If French deployment: Run $arckit-fr-rgpd — CNIL-specific requirements}
{If AI: Run $arckit-eu-ai-act — AI and personal data intersection}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
$arckit-fr-rgpd after this assessment.| Document | Publisher | URL |
|---|---|---|
| GDPR full text (Regulation 2016/679) | EUR-Lex | https://eur-lex.europa.eu/eli/reg/2016/679/oj |
| EDPB — European Data Protection Board (guidelines and opinions) | EDPB | https://edpb.europa.eu/ |
| EU-US Data Privacy Framework | European Commission | https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en |
| CNIL (French DPA) | CNIL | https://www.cnil.fr/ |
| EDPB DPIA guidelines (WP248) | EDPB | https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-92017-data-protection-impact-assessment_en |
| Standard Contractual Clauses (SCCs) | European Commission | https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en |
| DPA contacts across EU member states | EDPB | https://edpb.europa.eu/about-edpb/about-edpb/members_en |
projects/{project_id}/ARC-{PROJECT_ID}-RGPD-v{VERSION}.md$arckit-fr-rgpd follow-up$arckit-eu-rgpd Assess GDPR compliance for a French e-commerce platform expanding to Germany and Spain, processing purchase history, behavioural analytics, and email marketing, using AWS eu-west-3 (Paris) with Salesforce Marketing Cloud (US-based processor)
$arckit-eu-rgpd GDPR assessment for 001 — SaaS HR platform operating across 5 EU member states, processing employee data, using US-based payroll sub-processor
$arckit-eu-rgpd Assess GDPR for a healthcare research project processing anonymised patient data across FR, DE, NL — assess whether anonymisation is complete
After completing this command, consider running:
$arckit-dpia -- Run a full Data Protection Impact Assessment if screening flags 2+ high-risk criteria (when DPIA screening score is 2 or more)$arckit-fr-rgpd -- Add French CNIL-specific obligations on top of the EU GDPR baseline (when Project processes personal data of French residents or is operated by a French entity)$arckit-eu-ai-act -- Assess AI Act obligations where AI systems process personal data (when Project uses AI or automated decision-making involving personal data)