Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
Effective Date: August 2026 Legal Basis: EU Regulation 2016/679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga/2025/18) Pending Changes: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.
When to Use
When an organization processes personal data of EU residents (Article 3 territorial scope applies)
When preparing for a supervisory authority audit (ICO, CNIL, BfDI) or responding to formal inquiry
When implementing privacy-by-design requirements (Article 25) for new systems or data flows
When scoping compliance gaps before M&A due diligence or contract negotiations with EU entities
When responding to data subject access requests (DSARs) and discovering gaps in data inventory
When assessing third-party processors for GDPR compliance before signing Data Processing Agreements (DPAs)
After data breach incidents to verify notification procedures meet 72-hour requirement (Article 33)
Do not use for:
Technical implementation of specific GDPR controls (encryption, pseudonymization, access controls) — use implementing-gdpr-data-protection-controls for Article 32 technical/organizational measures
Automated DSAR processing workflows (identity verification, PII discovery, redaction, delivery) — use implementing-gdpr-data-subject-access-request for DSAR automation
Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria
This skill is for comprehensive compliance assessment across all GDPR articles; use the specialized skills for focused implementation tasks
Prerequisites
Understanding of GDPR Articles 5-32 and key definitions
Access to Article 30 records of processing activities
Data Processing Agreements with third-party processors
Privacy policies, consent forms, cookie notices
Knowledge of lawful bases (Article 6)
Data breach response plan and incident register
List of international data transfers with safeguards
Workflow
For detailed procedures, templates, and examples, see references/detailed-workflow.md
