Data Privacy Architect

Gdpr data handling

by wshobson · MIT license · ★ 39,857 on GitHub · updated Sep 21

Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.

---
name: gdpr-data-handling
description: Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.
---

# GDPR Data Handling

Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.

## When to Use This Skill

- Building systems that process EU personal data
- Implementing consent management
- Handling data subject requests (DSRs)
- Conducting GDPR compliance reviews
- Designing privacy-first architectures
- Creating data processing agreements

Overview

Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.

Manual install (npx, ZIP)

Claude Codenpx skills add wshobson/agents --skill gdpr-data-handling -g -a claude-code

Claude Code (manual)

mkdir -p ~/.claude/skills && curl -sL https://codeload.github.com/wshobson/agents/tar.gz/4236bb91f839 \
  | tar -xz -C ~/.claude/skills --strip-components=4 agents-4236bb91f839/plugins/hr-legal-compliance/skills/gdpr-data-handling

Windows (PowerShell)

New-Item -ItemType Directory -Force "$HOME\.claude\skills" | Out-Null; Invoke-WebRequest "https://m.agentalley.io/zip/49b71f6d2f331eb547dc/gdpr-data-handling.zip" -OutFile "$env:TEMP\gdpr-data-handling.zip"; Expand-Archive "$env:TEMP\gdpr-data-handling.zip" -DestinationPath "$HOME\.claude\skills" -Force

Claude.ai / desktopDownload the ZIP and upload it under Settings → Capabilities → Skills.

Codex, Cursor, other agentsPoint them at SKILL.md. The other files are plain text.

Connects with Agent Alley MCP · agentalley.io/mcp

Files included

SKILL.md2.6 KB
references/1 file · 17.0 KB

Read the files here

wshobson/4236bb92 files

SKILL.md2.6 KB

SKILL.md

Show the full text74 lines

gdpr-data-handling/SKILL.md74 lines · 2.6 KB

PreviewCode

Outline

RawView on GitHub

Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.

When to Use This Skill

Building systems that process EU personal data
Implementing consent management
Handling data subject requests (DSRs)
Conducting GDPR compliance reviews
Designing privacy-first architectures
Creating data processing agreements

Core Concepts

1. Personal Data Categories

Category	Examples	Protection Level
Basic	Name, email, phone	Standard
Sensitive (Art. 9)	Health, religion, ethnicity	Explicit consent
Criminal (Art. 10)	Convictions, offenses	Official authority
Children's	Under 16 data	Parental consent

2. Legal Bases for Processing

Article 6 - Lawful Bases:
├── Consent: Freely given, specific, informed
├── Contract: Necessary for contract performance
├── Legal Obligation: Required by law
├── Vital Interests: Protecting someone's life
├── Public Interest: Official functions
└── Legitimate Interest: Balanced against rights

3. Data Subject Rights

Right to Access (Art. 15)      ─┐
Right to Rectification (Art. 16) │
Right to Erasure (Art. 17)       │ Must respond
Right to Restrict (Art. 18)      │ within 1 month
Right to Portability (Art. 20)   │
Right to Object (Art. 21)       ─┘

Detailed worked examples and patterns

Detailed sections (starting with ## Implementation Patterns) live in references/details.md. Read that file when the navigation summary above is insufficient.

Best Practices

Do's

Minimize data collection - Only collect what's needed
Document everything - Processing activities, legal bases
Encrypt PII - At rest and in transit
Implement access controls - Need-to-know basis
Regular audits - Verify compliance continuously

Don'ts

Don't pre-check consent boxes - Must be opt-in
Don't bundle consent - Separate purposes separately
Don't retain indefinitely - Define and enforce retention
Don't ignore DSARs - 30-day response required
Don't transfer without safeguards - SCCs or adequacy decisions

1	---
2	name: gdpr-data-handling
3	description: Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.
4	---
5
6	# GDPR Data Handling
7
8	Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.
9
10	## When to Use This Skill
11
12	- Building systems that process EU personal data
13	- Implementing consent management
14	- Handling data subject requests (DSRs)
15	- Conducting GDPR compliance reviews
16	- Designing privacy-first architectures
17	- Creating data processing agreements
18
19	## Core Concepts
20
21	### 1. Personal Data Categories
22
23	\| Category \| Examples \| Protection Level \|
24	\| ---------------------- \| --------------------------- \| ------------------ \|
25	\| Basic \| Name, email, phone \| Standard \|
26	\| Sensitive (Art. 9) \| Health, religion, ethnicity \| Explicit consent \|
27	\| Criminal (Art. 10) \| Convictions, offenses \| Official authority \|
28	\| Children's \| Under 16 data \| Parental consent \|
29
30	### 2. Legal Bases for Processing
31
32	```
33	Article 6 - Lawful Bases:
34	├── Consent: Freely given, specific, informed
35	├── Contract: Necessary for contract performance
36	├── Legal Obligation: Required by law
37	├── Vital Interests: Protecting someone's life
38	├── Public Interest: Official functions
39	└── Legitimate Interest: Balanced against rights
40	```
41
42	### 3. Data Subject Rights
43
44	```
45	Right to Access (Art. 15) ─┐
46	Right to Rectification (Art. 16) │
47	Right to Erasure (Art. 17) │ Must respond
48	Right to Restrict (Art. 18) │ within 1 month
49	Right to Portability (Art. 20) │
50	Right to Object (Art. 21) ─┘
51	```
52
53	## Detailed worked examples and patterns
54
55	Detailed sections (starting with `## Implementation Patterns`) live in `references/details.md`. Read that file when the navigation summary above is insufficient.
56
57	## Best Practices
58
59	### Do's
60
61	- Minimize data collection - Only collect what's needed
62	- Document everything - Processing activities, legal bases
63	- Encrypt PII - At rest and in transit
64	- Implement access controls - Need-to-know basis
65	- Regular audits - Verify compliance continuously
66
67	### Don'ts
68
69	- Don't pre-check consent boxes - Must be opt-in
70	- Don't bundle consent - Separate purposes separately
71	- Don't retain indefinitely - Define and enforce retention
72	- Don't ignore DSARs - 30-day response required
73	- Don't transfer without safeguards - SCCs or adequacy decisions
74