What it does. Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/conducting-gdpr-compliance-assessment/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-gdpr-compliance-assessment, or copy the skill folder into ~/.claude/skills/conducting-gdpr-compliance-assessment/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-gdpr-compliance-assessment/SKILL.md

SKILL.md (verbatim)

name: conducting-gdpr-compliance-assessment
description: >-
  Conduct comprehensive GDPR compliance assessments by evaluating data processing
  activities against EU Regulation 2016/679, including Article 30 records of processing,
  lawful basis validation, data subject rights implementation, Data Protection Impact
  Assessments (DPIAs) under Article 35, breach notification procedures, international
  transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures
  under Article 32. Use when processing personal data of EU residents, preparing for
  supervisory authority audits, implementing privacy-by-design for new systems, scoping
  compliance gaps for M&A due diligence, assessing third-party processors, or responding
  to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB,
  and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing
  specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR
  automation — use implementing-gdpr-data-subject-access-request.
domain: cybersecurity
subdomain: compliance-governance
tags:
- gdpr
- data-protection
- privacy
- compliance
- dpia
- data-subject-rights
- article-30
- controller
- processor
- eu-regulation
- ico
- supervisory-authority
version: "1.0"
author: dakshverma23
license: Apache-2.0
nist_csf:
- GV.OC-02
- GV.PO-01
- GV.RM-04
- PR.DS-01
- PR.DS-02
- ID.AM-05
mitre_attack:
- T1530
- T1567

Conducting GDPR Compliance Assessment

Effective Date: August 2026
Legal Basis: EU Regulation 2016/679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga/2025/18)
Pending Changes: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.

When to Use

• When an organization processes personal data of EU residents (Article 3 territorial scope applies)
• When preparing for a supervisory authority audit (ICO, CNIL, BfDI) or responding to formal inquiry
• When implementing privacy-by-design requirements (Article 25) for new systems or data flows
• When scoping compliance gaps before M&A due diligence or contract negotiations with EU entities
• When responding to data subject access requests (DSARs) and discovering gaps in data inventory
• When assessing third-party processors for GDPR compliance before signing Data Processing Agreements (DPAs)
• After data breach incidents to verify notification procedures meet 72-hour requirement (Article 33)

Do not use for:

• Technical implementation of specific GDPR controls (encryption, pseudonymization, access controls) — use implementing-gdpr-data-protection-controls for Article 32 technical/organizational measures
• Automated DSAR processing workflows (identity verification, PII discovery, redaction, delivery) — use implementing-gdpr-data-subject-access-request for DSAR automation
• Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria
• This skill is for comprehensive compliance assessment across all GDPR articles; use the specialized skills for focused implementation tasks

Prerequisites

• Understanding of GDPR Articles 5-32 and key definitions
• Access to Article 30 records of processing activities
• Data Processing Agreements with third-party processors
• Privacy policies, consent forms, cookie notices
• Knowledge of lawful bases (Article 6)
• Data breach response plan and incident register
• List of international data transfers with safeguards

Workflow

For detailed procedures, templates, and examples, see references/detailed-workflow.md

Phase 1: Determine Territorial Applicability (Article 3)

GDPR applies if:

1. Organization has establishment in EU
2. Offers goods/services to EU residents
3. Monitors behavior of EU residents

Check: EU office? EU website targeting? Behavioral tracking?

Phase 2: Inventory Data Processing Activities (Article 30)

Document for EACH activity:

• Controller/processor details
• Processing purposes (specific)
• Data categories and special categories (Art. 9)
• Recipients and international transfers
• Retention periods
• Security measures

Tools: Use scripts/article30_parser.py, article30_validator.py, generate_ropa_report.py

Common gaps: Missing retention periods (68%), vague purposes, undocumented transfers

Phase 3: Validate Lawful Basis (Article 6)

Basis	Use Case	Key Requirement
Consent (6(1)(a))	Marketing, profiling	Freely given, specific, withdrawable
Contract (6(1)(b))	Order fulfillment	Strictly necessary only
Legal Obligation (6(1)(c))	Tax records	Cite specific law
Legitimate Interest (6(1)(f))	Fraud prevention, analytics	Three-part test + balancing

Action: Map each Article 30 activity to one lawful basis. Document legitimate interest assessments.

Phase 4: Assess Data Subject Rights (Articles 12-23)

Verify capability for:

• Access (15): Provide copy in machine-readable format within 1 month
• Rectification (16): Correct inaccurate data
• Erasure (17): "Right to be forgotten" (with exceptions)
• Portability (20): Transfer data in structured format
• Objection (21): Opt-out of legitimate interest processing
• Automated Decision-Making (22): Human review of algorithmic decisions

Test: Process sample DSAR through full workflow. Use scripts/ for automation.

Phase 5: Review DPIAs (Article 35)

DPIA mandatory for:

• Large-scale profiling with automated decisions
• Large-scale special categories processing
• Systematic monitoring of public areas (facial recognition)

Template: See references/detailed-workflow.md for complete DPIA structure

Content: Description, necessity, risks, mitigation, consultation (DPO, supervisory authority if novel high-risk)

Phase 6: Audit Breach Notification (Articles 33-34)

72-hour rule: Notify supervisory authority within 72 hours of becoming aware of breach likely to risk rights.

Decision tree:

• Unencrypted SSNs stolen? → NOTIFY + notify data subjects
• Encrypted backup stolen (key secure)? → Document only
• Temporary exposure (2 hours, no financial data)? → NOTIFY authority, assess data subject notification

Content: Nature, categories/numbers, DPO contact, consequences, mitigation

Phase 7: Verify International Transfers (Chapter V)

Mechanisms:

• Adequacy decisions (UK, Japan, etc.)
• Standard Contractual Clauses (SCCs) 2021 + Transfer Impact Assessment
• Binding Corporate Rules (BCRs)
• Derogations (Article 49 - limited)

Post-Schrems II: Assess destination country surveillance laws, implement supplementary measures (encryption with EU-held keys)

Phase 8: Assess Security Measures (Article 32)

"Security appropriate to the risk":

• Low risk: TLS 1.2+, password hashing, access logs, patching
• Medium risk: AES-256 encryption, MFA, RBAC, penetration testing, SOC 2
• High risk: HSMs, key rotation, SIEM, bug bounty, ISO 27001

Pseudonymization vs. Anonymization: Pseudo = reversible (still personal data); Anon = irreversible (no longer GDPR)

Phase 9: Compile Findings and Remediation Roadmap

Generate compliance report:

• Executive summary (overall status, high-priority gaps)
• Article-by-article findings
• Risk-prioritized remediation plan (Critical/High/Medium/Low)
• Cost estimates and timelines
• Responsible parties (DPO, IT, Legal, Business)

Format: See Output Format section below

Key Concepts

Term	Definition
Controller	Determines purposes and means of processing (Article 4(7))
Processor	Processes on behalf of controller (Article 4(8); requires DPA per Article 28)
Personal Data	Any information relating to identified/identifiable natural person (Article 4(1))
Special Categories	Health, biometric, genetic, racial, political, religious, trade union, sex life data (Article 9; heightened protection)
Consent	Freely given, specific, informed, unambiguous indication of wishes (Article 4(11))
Legitimate Interest	Lawful basis requiring three-part test: purpose, necessity, balancing (Recital 47)
DPIA	Data Protection Impact Assessment for high-risk processing (Article 35)
DPO	Data Protection Officer (Article 37; mandatory for public authorities, large-scale monitoring/special categories)
SCCs	Standard Contractual Clauses for international transfers (Commission Implementing Decision 2021/914)
Supervisory Authority	National data protection regulator (ICO for UK, CNIL for France, BfDI for Germany)

Tools & Systems

• ICO Self-Assessment: https://ico.org.uk/for-organisations/sme-web-hub/checklists/gdpr-check-list/
• EDPB Guidelines: https://edpb.europa.eu/our-work-tools/general-guidance_en
• OneTrust / TrustArc: Commercial GRC platforms with DPIA, Article 30, cookie consent modules
• Article 30 Scripts: article30_parser.py, article30_validator.py (included)
• SCCs (2021): https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
• DPO Certification: IAPP CIPP/E (Certified Information Privacy Professional/Europe)

Common Scenarios

Scenario: M&A Due Diligence

Context: Acquiring SaaS company with 50K EU customers. Need compliance assessment within 2 weeks.

Approach:

1. Request Article 30 records + DPAs with processors (AWS, Stripe, Mailchimp)
2. Validate lawful basis: Consent for marketing, Contract for service delivery
3. Check breach notification procedures (Article 33): No procedures found → HIGH RISK
4. Review international transfers: AWS US-East-1 without SCCs → BLOCKER
5. Deliverable: Gap analysis with remediation costs ($120K for SCCs + DPO hire + breach procedures)

Scenario: Supervisory Authority Audit

Context: ICO formal inquiry after consumer complaint about unsubscribe not working.

Response:

1. Produce Article 30 records within 7 days
2. Demonstrate consent records (timestamp, version, scope)
3. Show withdrawal mechanism (unsubscribe link functional, processed within 48h)
4. Provide audit logs of DSAR/erasure requests
5. Outcome: Warning + 3-month corrective order (no fine due to cooperation)

Output Format

GDPR COMPLIANCE ASSESSMENT REPORT
===================================
Organization: XYZ Corp | Assessment Date: 2026-08-24
Assessor: Jane Smith, CIPP/E | DPO: dpo@xyzcorp.com

EXECUTIVE SUMMARY
━━━━━━━━━━━━━━━━━
Overall Status: PARTIAL COMPLIANCE (67/100)
Critical Gaps: 3 | High: 5 | Medium: 8 | Low: 12

CRITICAL FINDINGS
━━━━━━━━━━━━━━━━━
1. Article 33: No breach notification procedures (72-hour deadline unmet)
2. Chapter V: International transfers to US without SCCs (Schrems II violation)
3. Article 30: Records incomplete (retention periods missing for 40% of activities)

ARTICLE-BY-ARTICLE STATUS
━━━━━━━━━━━━━━━━━━━━━━━━
✅ Article 3: Applicability confirmed (EU establishment)
⚠️  Article 6: Lawful basis documented but 3 activities use invalid bundled consent
✅ Article 15-23: DSAR procedures operational (18-day avg response time)
❌ Article 28: 40% of processors lack signed DPAs
⚠️  Article 32: Encryption at rest implemented but no MFA on admin accounts
❌ Article 33/34: No breach notification procedures
⚠️  Article 35: DPIA completed for profiling but not reviewed in 18 months
❌ Chapter V: US transfers without SCCs

REMEDIATION ROADMAP
━━━━━━━━━━━━━━━━━━━
Priority 1 (0-30 days, $50K):
  - Implement breach notification procedures + incident register
  - Execute SCCs with AWS, Stripe (Module 2)
  - Complete Article 30 records (retention periods, security measures)

Priority 2 (1-3 months, $80K):
  - Execute DPAs with remaining 8 processors
  - Deploy MFA on all admin accounts
  - Conduct legitimate interest assessments for analytics

Priority 3 (3-6 months, $40K):
  - Review and update DPIA
  - Automated DSAR response workflow
  - Annual GDPR training for staff

COMPLIANCE SCORE: 67/100 → Target 90/100 (6 months post-remediation)

Verification Checklist

• Article 3 applicability determination documented
• Article 30 records complete for all activities (controller + processor roles)
• Lawful basis identified and documented for each activity
• Legitimate interest assessments documented with balancing test
• Consent mechanism is granular, withdrawable, and logged
• Data subject rights procedures operational (1-month response time)
• DPIA completed for high-risk processing (profiling, special categories, monitoring)
• Breach notification procedures documented (72-hour timeline)
• DPAs executed with all processors (Article 28 requirements)
• International transfers use SCCs 2021 + Transfer Impact Assessment
• Security measures appropriate to risk (encryption, MFA, logging, testing)
• Retention periods defined and automated deletion implemented
• Privacy policy published and updated within 12 months
• DPO designated if required (Article 37 criteria met)
• Staff trained on GDPR principles and data subject rights

Other files in this skill

• LICENSE
• assets/compliance-scorecard.md
• references/api-reference.md
• references/detailed-workflow.md
• references/standards.md
• scripts/article30_parser.py
• scripts/article30_validator.py
• scripts/generate_ropa_report.py

assets/compliance-scorecard.md (verbatim)

GDPR Compliance Scorecard Template

Use this template to assess and track GDPR compliance across all key areas. Replace [ORGANIZATION NAME] and fill in assessment results.

Organization Information

• Organization Name: [ORGANIZATION NAME]
• Assessment Date: [YYYY-MM-DD]
• Assessor: [Name, Role]
• Scope: [All EU operations / Specific business unit / Specific system]
• Next Review Date: [YYYY-MM-DD] (recommended: annual)

---

Executive Summary

Metric	Score	Target	Status
Overall Compliance	__/100	100	🔴 / 🟡 / 🟢
Critical Issues	__	0	🔴 / 🟡 / 🟢
High Priority Gaps	__	0	🔴 / 🟡 / 🟢
Medium Priority Gaps	__	-	🔴 / 🟡 / 🟢

Compliance Status Legend:

• 🟢 Compliant (≥90%): Minor gaps only
• 🟡 Partially Compliant (70-89%): Action required
• 🔴 Non-Compliant (<70%): Immediate remediation required

---

1. Territorial Applicability (Article 3)

Check	Status	Evidence
EU establishment identified?	☐ Yes ☐ No ☐ N/A	[Location/entity]
Targeting EU data subjects?	☐ Yes ☐ No ☐ N/A	[Website/marketing evidence]
Monitoring EU data subjects?	☐ Yes ☐ No ☐ N/A	[Tracking/profiling activities]
Article 27 representative (if non-EU)?	☐ Yes ☐ No ☐ N/A	[Representative contact]

Assessment: ☐ Applies ☐ Does not apply
Score: __/4

---

2. Article 30 Records of Processing (RoPA)

Requirement	Status	Score	Notes
Written RoPA exists	☐ Yes ☐ Partial ☐ No	__/10	[Last updated: date]
All processing activities documented	☐ Yes ☐ Partial ☐ No	__/10	[X of Y activities]
Purposes specified	☐ Yes ☐ Partial ☐ No	__/5
Data subjects categorized	☐ Yes ☐ Partial ☐ No	__/5
Personal data categories listed	☐ Yes ☐ Partial ☐ No	__/5
Recipients documented	☐ Yes ☐ Partial ☐ No	__/5
Retention periods specified	☐ Yes ☐ Partial ☐ No	__/10	[Gap: __% missing]
International transfers documented	☐ Yes ☐ Partial ☐ No ☐ N/A	__/5
Security measures described	☐ Yes ☐ Partial ☐ No	__/5

Assessment Notes: [Key gaps identified]
Score: __/55 → __% compliant

---

3. Lawful Basis (Article 6)

Check	Status	Evidence
Lawful basis identified for all processing	☐ Yes ☐ Partial ☐ No	[X of Y activities]
Consent mechanisms valid (if used)	☐ Yes ☐ Partial ☐ No ☐ N/A	[Consent tool: name]
Legitimate Interest Assessments (LIAs) conducted	☐ Yes ☐ Partial ☐ No ☐ N/A	[X LIAs on file]
Special category data legal basis (Article 9)	☐ Yes ☐ Partial ☐ No ☐ N/A	[Additional condition documented]

Common Issues Found:

• Consent not freely given (bundled)
• "Legitimate interest" claimed without LIA
• Contract claimed for non-essential processing
• Special category data without explicit consent

Score: __/10

---

4. Data Subject Rights (Articles 12-23)

Right	Capability	Response Time	Status
Right to be Informed (Art 13-14)	Privacy notices at collection	-	☐ ✓ ☐ ✗
Right of Access (Art 15)	DSAR process documented	__ days (≤30 required)	☐ ✓ ☐ ✗
Right to Rectification (Art 16)	Correction mechanism	__ days	☐ ✓ ☐ ✗
Right to Erasure (Art 17)	Deletion across all systems	__ days	☐ ✓ ☐ ✗
Right to Restrict Processing (Art 18)	Processing pause capability	__ days	☐ ✓ ☐ ✗
Right to Data Portability (Art 20)	CSV/JSON export	__ days	☐ ✓ ☐ ✗
Right to Object (Art 21)	Marketing opt-out	Immediate	☐ ✓ ☐ ✗
Automated Decision-Making (Art 22)	Human review process	☐ Yes ☐ No ☐ N/A	☐ ✓ ☐ ✗

DSAR Volume (last 12 months): __ requests
Average Response Time: __ days
Score: __/8 → __% implemented

---

5. Data Protection Impact Assessments (Article 35)

Check	Status	Notes
High-risk processing identified	☐ Yes ☐ No	[List activities requiring DPIA]
DPIAs conducted for mandatory cases	☐ Yes ☐ Partial ☐ No	[X of Y required DPIAs completed]
DPIAs include necessity/proportionality	☐ Yes ☐ Partial ☐ No
Risks to data subjects assessed	☐ Yes ☐ Partial ☐ No
Mitigation measures documented	☐ Yes ☐ Partial ☐ No
DPO consulted (if designated)	☐ Yes ☐ No ☐ N/A
Supervisory authority consulted (if high residual risk)	☐ Yes ☐ No ☐ N/A

Mandatory DPIA Triggers:

• Large-scale processing of special category data
• Systematic monitoring of public areas
• Systematic extensive profiling
• Large-scale processing of biometric/genetic data

Score: __/7

---

6. Data Breach Procedures (Articles 33-34)

Requirement	Status	Metric
Breach detection capability	☐ Yes ☐ Partial ☐ No	Detection time: __ hours
Incident response plan documented	☐ Yes ☐ No	[Last updated: date]
72-hour notification process	☐ Yes ☐ No	Current capability: __ hours
Breach register maintained (Art 33(5))	☐ Yes ☐ No	[X breaches in last 12 months]
Data subject notification process	☐ Yes ☐ No
Breach simulation/tabletop exercise	☐ Yes ☐ No	[Last conducted: date]

Last Breach: [Date or "None"]
Reported to Supervisory Authority: ☐ Yes ☐ No ☐ N/A
Within 72 Hours: ☐ Yes ☐ No ☐ N/A

Score: __/6

---

7. International Data Transfers (Chapter V)

Transfer	Destination	Safeguard	Status
[Service/System 1]	[Country]	☐ Adequacy ☐ SCCs ☐ BCRs ☐ None	☐ ✓ ☐ ✗
[Service/System 2]	[Country]	☐ Adequacy ☐ SCCs ☐ BCRs ☐ None	☐ ✓ ☐ ✗
[Service/System 3]	[Country]	☐ Adequacy ☐ SCCs ☐ BCRs ☐ None	☐ ✓ ☐ ✗

Common Transfer Destinations:

• USA: ☐ Adequacy (Data Privacy Framework) ☐ SCCs ☐ None
• UK: ☐ Adequacy ☐ SCCs
• Other: [List countries]

SCCs in Use: ☐ 2021 version ☐ 2010 version (must update)
Transfer Impact Assessment (TIA) Conducted: ☐ Yes ☐ No (required for high-risk countries)

Score: __/10

---

8. Technical & Organizational Measures (Article 32)

Security Control	Implemented	Evidence
Encryption at rest	☐ Yes ☐ Partial ☐ No	[Algorithm: AES-256 / other]
Encryption in transit	☐ Yes ☐ Partial ☐ No	[TLS 1.2+ / other]
Access control (least privilege)	☐ Yes ☐ Partial ☐ No	[IAM tool]
Multi-factor authentication	☐ Yes ☐ Partial ☐ No	[X% of users]
Audit logging	☐ Yes ☐ Partial ☐ No	[Retention: X months]
Pseudonymization	☐ Yes ☐ Partial ☐ No ☐ N/A	[Where implemented]
Backup and recovery	☐ Yes ☐ Partial ☐ No	[RPO: __ / RTO: __]
Vulnerability scanning	☐ Yes ☐ Partial ☐ No	[Frequency: quarterly / monthly]
Penetration testing	☐ Yes ☐ No	[Last conducted: date]
Security awareness training	☐ Yes ☐ Partial ☐ No	[X% of staff trained]

Score: __/10

---

9. Processor Management (Article 28)

Requirement	Status	Notes
List of all processors maintained	☐ Yes ☐ Partial ☐ No	[X processors identified]
Data Processing Agreements (DPAs) signed	☐ Yes ☐ Partial ☐ No	[__% coverage]
DPAs contain all Article 28(3) requirements	☐ Yes ☐ Partial ☐ No
Sub-processor list disclosed	☐ Yes ☐ Partial ☐ No
Sub-processor approval mechanism	☐ Yes ☐ No
Processor audits conducted	☐ Yes ☐ No	[Last audit: date]

Score: __/6

---

10. Data Protection Officer (Articles 37-39)

Check	Status	Notes
DPO designation required?	☐ Yes ☐ No	[Public authority / large-scale / special categories]
DPO designated	☐ Yes ☐ No ☐ N/A	[Name: / Contact:]
DPO contact published	☐ Yes ☐ No ☐ N/A	[Privacy policy / website]
DPO independence ensured	☐ Yes ☐ No ☐ N/A	[No conflict of interest]
DPO involved in compliance matters	☐ Yes ☐ No ☐ N/A

Score: __/5 (or N/A if not required)

---

Overall Compliance Score

Category	Weight	Score	Weighted Score
Article 30 RoPA	20%	__%	__
Lawful Basis	15%	__%	__
Data Subject Rights	15%	__%	__
DPIAs	10%	__%	__
Breach Procedures	10%	__%	__
International Transfers	10%	__%	__
Security Measures (Art 32)	10%	__%	__
Processor Management	5%	__%	__
DPO (if required)	5%	__%	__
TOTAL	100%	-	__/100

Overall Assessment: 🔴 / 🟡 / 🟢

---

Priority Action Items

🔴 Critical (Immediate - 0-30 days)

1. [Item]
2. [Item]

🟡 High Priority (1-3 months)

1. [Item]
2. [Item]

🟠 Medium Priority (3-6 months)

1. [Item]
2. [Item]

---

Recommendations

1. Short-term (0-3 months):

   • [Recommendation]

2. Medium-term (3-6 months):

   • [Recommendation]

3. Long-term (6-12 months):

   • [Recommendation]

---

Sign-off

Assessed by: ________________________ Date: __________

Reviewed by (DPO): ________________________ Date: __________

Approved by (Senior Management): ________________________ Date: __________

---

This scorecard provides a snapshot of GDPR compliance status. It should be reviewed and updated at least annually or when significant changes occur in data processing activities.

references/api-reference.md (verbatim)

API Reference: GDPR Compliance Tools and Commands

Python GDPR Compliance Helper Commands

Article 30 Parser

# Parse DPAs and privacy policies for Article 30 fields
python scripts/article30_parser.py --input contracts/processors/ --output ropa.json

# Validate completeness against mandatory fields
python scripts/article30_validator.py --ropa ropa.json --check-retention --check-transfers

# Generate Article 30 register in supervisory authority format
python scripts/generate_ropa_report.py --input ropa.json --output Article30_Register.pdf

Data Subject Access Request (DSAR) Automation

Open Data Rights (ODR)

# Initialize ODR project
npm install @opendatarights/odr-core

# Submit DSAR programmatically
node scripts/submit_dsar.js --email user@example.com --company "Acme Corp"

# Check DSAR status
node scripts/check_dsar_status.js --request-id abc123

GDPR Compliance Scanning Tools

BigID Data Discovery

# Scan for personal data across data sources
bigid-cli scan --source "s3://company-bucket" --classification PII

# Generate data inventory report
bigid-cli report --format json --output data_inventory.json

OneTrust Cookie Consent API

# Verify cookie consent compliance
curl -H "Authorization: Bearer $TOKEN" \
  "https://api.onetrust.com/v1/consent/categories" | jq

# Check GDPR consent records
curl -H "Authorization: Bearer $TOKEN" \
  "https://api.onetrust.com/v1/consent/receipts?user=john@example.com"

Standard Contractual Clauses (SCCs) Templates

SCC Module	Use Case	Download
Module One	Controller to Controller	https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
Module Two	Controller to Processor	Same link (2021 version)
Module Three	Processor to Processor	Same link
Module Four	Processor to Controller	Same link

Data Processing Agreement (DPA) Checklist

Article 28 Requirement	DPA Clause Reference
Subject matter and duration	§ 1.1
Nature and purpose	§ 1.2
Type of personal data	§ 1.3, Annex A
Categories of data subjects	§ 1.4, Annex A
Controller obligations and rights	§ 2
Processor obligations	§ 3-8
Sub-processor approval	§ 9
Data subject rights assistance	§ 10
Security measures	§ 11, Annex B
Breach notification	§ 12
Deletion/return of data	§ 13
Audits	§ 14
Liability and indemnity	§ 15-16

DPIA (Data Protection Impact Assessment) Template Structure

# DPIA for [Processing Activity Name]
date: 2026-03-15
version: 1.0
assessor: [Name, Role]

1. Description of Processing:
  - purpose:
  - categories_of_data:
  - categories_of_subjects:
  - retention_period:
  - recipients:

2. Necessity and Proportionality:
  - necessity_justification:
  - proportionality_assessment:

3. Risks to Data Subject Rights:
  - risk_1:
      description:
      likelihood: [low/medium/high]
      severity: [low/medium/high]
      risk_level: [likelihood × severity]
  - risk_2: ...

4. Mitigation Measures:
  - measure_1:
      description:
      effectiveness: [reduces risk to ...]
      responsibility: [who implements]
  - measure_2: ...

5. Residual Risk:
  - residual_risk_assessment:
  - supervisory_authority_consultation: [yes/no, if yes why]

6. Sign-off:
  - dpo_review_date:
  - dpo_approval:
  - controller_approval:

Breach Notification API (Supervisory Authority)

ICO Data Security Incident Reporting Tool

# UK: Report breach to ICO
# https://ico.org.uk/for-organisations/report-a-breach/

# EU Member State: Check your supervisory authority
# https://edpb.europa.eu/about-edpb/about-edpb/members_en

Breach Register Template

{
  "breach_id": "BR-2026-001",
  "discovered_date": "2026-03-10T14:30:00Z",
  "notification_date_authority": "2026-03-12T10:00:00Z",
  "72_hour_deadline": "2026-03-13T14:30:00Z",
  "within_deadline": true,
  "affected_data_subjects": 1500,
  "categories_of_data": ["email", "name", "payment_card_last4"],
  "likely_consequences": "Risk of phishing targeting affected users",
  "measures_taken": "Mandatory password reset, notification sent to all users, MFA enforced",
  "supervisory_authority": "ICO",
  "notification_reference": "ICO-BR-2026-12345"
}

GDPR-Compliant Logging Commands

Audit Log Retention Check

# Verify retention periods align with Article 30 documented periods
grep -r "retention" Article30_Register.json | jq

# Check if logs contain personal data (must be protected under Article 32)
grep -iE "(email|name|ip_address)" /var/log/app/*.log

Pseudonymization Example (Python)

import hashlib
import hmac

def pseudonymize(email, secret_key):
    """Pseudonymize email using HMAC-SHA256"""
    return hmac.new(
        secret_key.encode(),
        email.encode(),
        hashlib.sha256
    ).hexdigest()

# Usage
secret = "your-secret-key-store-securely"
pseudonym = pseudonymize("user@example.com", secret)
# Output: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

Data Subject Rights Verification

Right	Verification Check	Command/Tool
Right to Access (Art 15)	Can org deliver all data within 1 month?	Test DSAR workflow end-to-end
Right to Erasure (Art 17)	Can org delete across all systems?	python scripts/test_deletion.py --user-id 12345
Right to Portability (Art 20)	Can org export in machine-readable format?	Verify CSV/JSON export functionality
Right to Object (Art 21)	Can org stop direct marketing?	Test unsubscribe mechanism

International Transfer Checklist

# Identify all non-EU/EEA data flows
grep -r "transfer_destination" Article30_Register.json | grep -v "EU\|EEA"

# Verify safeguards for each transfer
for dest in $(jq -r '.transfers[].destination_country' Article30_Register.json); do
  echo "Transfer to: $dest"
  echo "Safeguard: $(jq -r ".transfers[] | select(.destination_country==\"$dest\") | .safeguard" Article30_Register.json)"
done

References

• ICO Self-Assessment Tool: https://ico.org.uk/for-organisations/sme-web-hub/checklists/self-assessment/
• EDPB Interactive Tool: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/how-my-personal-data-protected_en
• GDPR.eu Compliance Checklist: https://gdpr.eu/checklist/
• NIST Privacy Framework: https://www.nist.gov/privacy-framework

references/standards.md (verbatim)

Standards and References — Conducting GDPR Compliance Assessment

NIST Cybersecurity Framework 2.0

ID	Category	Rationale
GV.OC-02	Organizational Context: Legal, regulatory, and contractual requirements regarding cybersecurity are understood and managed	GDPR is a primary legal/regulatory requirement for organizations processing EU resident data; understanding its applicability (Article 3) and requirements is foundational to governance.
GV.PO-01	Policy: Organizational cybersecurity policy is established, communicated, and enforced	GDPR Article 5 accountability principle and Article 24 controller responsibilities require documented data protection policies aligned with GDPR principles.
GV.RM-04	Risk Management Strategy: Strategic direction that describes appropriate risk response options is established and communicated	DPIAs (Article 35) and controller accountability (Article 24) mandate risk-based approaches to data protection; risk tolerance must be documented and communicated.
PR.DS-01	Data Security: Data-at-rest is protected	Article 32 requires encryption and pseudonymization as technical measures appropriate to the risk; data-at-rest encryption directly implements this.
PR.DS-02	Data Security: Data-in-transit is protected	Article 32 confidentiality/integrity; TLS 1.2+ for all personal data transmission implements this security baseline.
ID.AM-05	Asset Management: Resources are prioritized based on classification, criticality, and business value	Article 30 records of processing categorize personal data by sensitivity (special category under Article 9 vs. general); this informs security prioritization.

MITRE ATT&CK

Technique ID	Name	Tactic	Rationale
T1530	Data from Cloud Storage Object	Collection	Unauthorized access to cloud-stored personal data represents a data breach under GDPR Article 4(12); assessing cloud security controls (access logs, IAM) validates Article 32 compliance.
T1567	Exfiltration Over Web Service	Exfiltration	Data exfiltration scenarios (T1567.002 to cloud, T1567.004 over encrypted channel) constitute personal data breaches; GDPR Article 33 breach notification and Article 32 exfiltration prevention controls directly address this.

GDPR Articles Mapped

Article	Title	Assessment Focus
Article 3	Territorial Scope	Determine applicability: establishment, offering goods/services, monitoring
Article 4	Definitions	Controller, processor, personal data, special category data, consent
Article 5	Principles	Lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability
Article 6	Lawfulness of Processing	Identify lawful basis for each processing activity (consent, contract, legal obligation, vital interests, public task, legitimate interest)
Article 7	Conditions for Consent	Verify consent is freely given, specific, informed, unambiguous; withdrawal mechanism
Article 9	Special Categories	Additional conditions for processing health, biometric, genetic, racial, political, religious, trade union, sex life data
Article 12-23	Data Subject Rights	Access (15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), automated decision-making (22)
Article 24	Controller Responsibility	Implement technical/organizational measures demonstrating compliance; accountability
Article 25	Privacy by Design	Data protection by design and by default
Article 28	Processor Obligations	Data Processing Agreement requirements, sub-processor rules
Article 30	Records of Processing	Written register of all processing activities (mandatory for orgs 250+ employees or high-risk)
Article 32	Security of Processing	Encryption, pseudonymization, confidentiality, integrity, availability, resilience, regular testing
Article 33	Breach Notification (Authority)	Notify supervisory authority within 72 hours unless unlikely to risk rights
Article 34	Breach Notification (Data Subject)	Notify individuals without undue delay if high risk to rights
Article 35	Data Protection Impact Assessment	Mandatory for systematic large-scale processing, special categories, monitoring public areas
Article 37-39	Data Protection Officer	Designation criteria, tasks, independence
Articles 44-50	International Transfers	Chapter V: adequacy decisions, SCCs, BCRs, derogations

Supporting Standards

• ISO/IEC 27701:2019 — Privacy Information Management System (PIMS); extension to ISO 27001 for GDPR-style privacy
• ISO/IEC 29134:2017 — Privacy Impact Assessment (PIA) methodology; aligns with GDPR Article 35 DPIA
• NIST Privacy Framework 1.0 — Risk-based approach to privacy; complements GDPR compliance programs
• EDPB Guidelines — European Data Protection Board authoritative guidance on GDPR interpretation

Official Resources

• GDPR Full Text: https://gdpr.eu/tag/gdpr/
• ICO GDPR Guidance (UK Supervisory Authority): https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
• EDPB Guidelines: https://edpb.europa.eu/our-work-tools/general-guidance_en
• Standard Contractual Clauses (2021): https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
• Article 29 Working Party Opinions (superseded by EDPB but still referenced): https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/index_en.htm
• Data (Use and Access) Act 2025 (UK, Royal Assent 19 June 2025): https://www.legislation.gov.uk/ukpga/2025/18

Enforcement Statistics (2024-2026)

• Total fines issued: €4.8 billion (2024-2025 period)
• Largest fine: €1.2 billion (Meta Ireland, data transfer violations)
• Most common violations: Insufficient legal basis (28%), inadequate security (Article 32, 22%), failure to implement data subject rights (18%)
• Average DSAR response time: 18 days (requirement: within 1 month, Article 15)
• Breach notification compliance: 41% of controllers notified ICO within 72 hours (2025 ICO report)

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.