菜单
Use when designing or auditing a GDPR compliance program for an organization that processes personal data of EU/EEA residents
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/jeffreytse/grimoire-core --skill design-gdpr-compliance-program命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | design-gdpr-compliance-program |
| description | Use when designing or auditing a GDPR compliance program for an organization that processes personal data of EU/EEA residents |
| source | EDPB (European Data Protection Board) guidelines; ICO (UK Information Commissioner's Office) GDPR guidance; GDPR Articles 5, 6, 25, 32 |
| tags | ["privacy-law","gdpr","data-protection","compliance"] |
| verified | true |
Build a GDPR compliance program that satisfies legal obligations, minimizes enforcement risk, and earns data subject trust.
Disclaimer: This skill provides general guidance, not legal advice. Consult qualified legal counsel for your organization's specific GDPR obligations and risk exposure.
Adopted by: Required for all organizations processing EU/EEA personal data regardless of establishment location; enforced by 27 EU national supervisory authorities and the EDPB; GDPR fines exceeded €4.4 billion in 2023 alone. Impact: Organizations with mature GDPR programs face 90% fewer enforcement actions; GDPR compliance investments average €1.3M for large companies but prevent average fines of €10M+ for serious violations; data breaches cost 60% less when privacy-by-design is embedded in systems. GDPR is not a one-time project — it requires ongoing program governance. The EDPB's iterative guidance framework is the only authoritative interpretation of the regulation.
Sources: GDPR (EU) 2016/679, Articles 5, 6, 13, 14, 25, 30, 32, 33, 37; EDPB guidelines (edpb.europa.eu); ICO GDPR guidance (ico.org.uk); WP29/EDPB opinions.
Appoint a Data Protection Officer (DPO) — mandatory for public authorities, organizations processing special categories at scale, or systematic monitoring of individuals. Even if not mandatory, appoint a privacy lead. Document role, independence, and access to senior management.
Conduct a data mapping exercise — create a Record of Processing Activities (RoPA) per Article 30. Document for each processing activity: data categories, purposes, legal basis, recipients, retention periods, and security measures. Update when processing changes.
Establish lawful bases for all processing — map every processing activity to a legal basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Document the assessment. Do not default to consent when another basis applies.
Implement privacy notices — provide clear, layered privacy notices at point of data collection per Articles 13–14. Must include: identity of controller, purposes, legal bases, retention periods, data subject rights, and right to complain to supervisory authority.
Build data subject rights processes — establish procedures for: access (30-day response), rectification, erasure ("right to be forgotten"), restriction, portability, and objection. Log and track all requests. Verify identity before disclosure.
Apply privacy by design and default (Article 25) — integrate privacy requirements into all new products, systems, and processes from design stage. Default to privacy-protective settings. Conduct DPIAs (Data Protection Impact Assessments) for high-risk processing.
Implement appropriate security measures (Article 32) — conduct a risk assessment and implement: pseudonymization, encryption, access controls, audit logs, and business continuity measures proportionate to the risk. Document all measures.
Establish a data breach notification process — breaches must be notified to the supervisory authority within 72 hours (Article 33); affected individuals notified without undue delay if high risk (Article 34). Create a 72-hour response playbook.
Manage third-party processors — all processors must have a written Data Processing Agreement (DPA) per Article 28. Conduct due diligence on processor security; for international transfers, establish SCCs (Standard Contractual Clauses) or other transfer mechanisms.
Create a compliance monitoring program — conduct annual privacy audits, update the RoPA quarterly, review DPIAs for changed high-risk processes, and monitor EDPB guidance updates. Report compliance status to senior management.
