data-privacy

Design data handling for privacy compliance — PII classification, data minimization, GDPR/CCPA rights implementation, consent patterns, data retention and deletion, and privacy-by-design principles. Use when asked about "GDPR", "CCPA", "data privacy", "right to be forgotten", "PII", "personal data", "consent", "data retention", or "we need to be compliant". Do NOT use for: security penetration testing — use `red-team-check`.

Ir para a instalação

Repositório: yanacuti1121/Yana-AI
Última atividade na origem: 2 de julho de 2026 às 23:25
Idioma detectado do SKILL.md: inglês
Estrelas: 1
Forks: 0

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/yanacuti1121/Yana-AI --skill data-privacy

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

Category	Examples	Sensitivity
Direct identifiers	Name, email, phone, SSN, passport	High
Indirect identifiers	IP address, device ID, cookie ID	Medium
Sensitive categories (GDPR Art. 9)	Health, race, religion, biometrics, sexual orientation	Very high — special rules
Quasi-identifiers	Age + zip + gender (can re-identify combined)	Context-dependent
Non-personal	Aggregated statistics, anonymized data	Low

Before collecting any field, ask:
  1. Why do we need this?
  2. What specific feature breaks without it?
  3. When do we delete it?

If no clear answer to all three → don't collect it.

Right	What it means	Implementation
Access	User can request all their data	Export as structured file (JSON/CSV) within 30 days
Rectification	User can correct inaccurate data	Edit endpoints for profile fields
Erasure (Right to be forgotten)	Delete or anonymize all user data	Deletion pipeline — see below
Portability	Machine-readable export	JSON or CSV download
Restriction	Pause processing, don't delete	`processing_restricted: true` flag
Object	Opt out of marketing/profiling	Preference center with immediate effect

User requests deletion:
1. Mark account deleted_at = now(), disable login
2. Queue async job: delete or anonymize all PII
3. Cascade: delete from: profile, orders (anonymize), logs (anonymize), analytics events
4. Third-party data: send deletion request to downstream processors (email provider, analytics)
5. Confirm to user within 30 days

Anonymize (not delete) where legal retention required:
  user_id → "anon-{hash}", email → null, name → "Deleted User"

Consent must be:
  ✓ Freely given (no consent wall blocking core service)
  ✓ Specific (separate consent per purpose)
  ✓ Informed (clear language, not legalese)
  ✓ Unambiguous (explicit opt-in — pre-ticked boxes invalid under GDPR)
  ✓ Withdrawable at any time (as easy to withdraw as to give)

{
  "user_id": "usr-123",
  "purpose": "marketing_emails",
  "granted": true,
  "granted_at": "2025-01-15T10:00:00Z",
  "mechanism": "checkbox_signup_form_v2",
  "ip_address": "hashed or omitted",
  "version": "tos-2025-01"
}

Data type	Typical retention	Rationale
Active user profiles	Until deletion requested	Core service function
Transactional records	7 years	Tax / legal obligation
Access logs	90 days	Security audit
Analytics events	13 months	Year-over-year comparison
Marketing data	2 years post-inactivity	Re-engagement window
Failed login attempts	30 days	Security monitoring

□ Data minimization: only collect fields with a documented, current purpose
□ PII classification: every table with personal data labeled (Direct/Indirect/Sensitive)
□ Encryption at rest: PII fields encrypted in DB (or full-disk encryption documented)
□ Encryption in transit: TLS 1.2+ on all data paths
□ Access control: PII accessible only to services/roles that need it
□ Deletion pipeline: right to erasure implemented and tested end-to-end
□ Consent records: stored alongside the data they authorize
□ Retention schedule: defined and enforced by automated job
□ Third-party processors: DPA (Data Processing Agreement) in place with each vendor
□ Logs: PII not present in application logs (audit 5 representative log lines)

name	data-privacy
description	Design data handling for privacy compliance — PII classification, data minimization, GDPR/CCPA rights implementation, consent patterns, data retention and deletion, and privacy-by-design principles. Use when asked about "GDPR", "CCPA", "data privacy", "right to be forgotten", "PII", "personal data", "consent", "data retention", or "we need to be compliant". Do NOT use for: security penetration testing — use `red-team-check`.
origin	yamtam-original
license	MIT © 2025 Vũ Văn Tâm
version	1.0.0
compatibility	Any backend system handling personal data. GDPR + CCPA focused.

name	data-privacy
description	Design data handling for privacy compliance — PII classification, data minimization, GDPR/CCPA rights implementation, consent patterns, data retention and deletion, and privacy-by-design principles. Use when asked about "GDPR", "CCPA", "data privacy", "right to be forgotten", "PII", "personal data", "consent", "data retention", or "we need to be compliant". Do NOT use for: security penetration testing — use `red-team-check`.
origin	yamtam-original
license	MIT © 2025 Vũ Văn Tâm
version	1.0.0
compatibility	Any backend system handling personal data. GDPR + CCPA focused.

data-privacy

Opções de instalação

Revise os arquivos de origem

When to Use

PII Classification

When to Use

PII Classification

Data Minimization

GDPR User Rights (Implementation)

Deletion pipeline design

Consent Management

Consent record (store with the data)

Cookie consent

Data Retention Policy

Privacy-by-Design Checklist

Anti-Fake-Pass Rules

data-privacy

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Mais deste repositório

When to Use

PII Classification

When to Use

PII Classification

Data Minimization

GDPR User Rights (Implementation)

Deletion pipeline design

Consent Management

Consent record (store with the data)

Cookie consent

Data Retention Policy

Privacy-by-Design Checklist

Anti-Fake-Pass Rules