What it does. Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer mechanisms (SCCs, BCRs, adequacy). Use when designing or auditing GDPR controls, building a DPIA, handling data subject access/erasure requests, or assessing cross-border data transfers. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-gdpr-data-protection-controls/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-gdpr-data-protection-controls, or copy the skill folder into ~/.claude/skills/implementing-gdpr-data-protection-controls/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gdpr-data-protection-controls/SKILL.md

SKILL.md (verbatim)

name: implementing-gdpr-data-protection-controls
description: Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer mechanisms (SCCs, BCRs, adequacy). Use when designing or auditing GDPR controls, building a DPIA, handling data subject access/erasure requests, or assessing cross-border data transfers.
domain: cybersecurity
subdomain: compliance-governance
tags:
- compliance
- governance
- gdpr
- privacy
- data-protection
- eu-regulation
nist_csf:
- GV.OC-02
- GV.PO-01
- PR.DS-01
- PR.AA-01
- ID.AM-02
version: '1.0'
author: mahipal
license: Apache-2.0
nist_ai_rmf:
- MEASURE-2.7
- MAP-5.1
- MANAGE-2.4
- MEASURE-2.8
- MEASURE-2.9
atlas_techniques:
- AML.T0070
- AML.T0066
- AML.T0082
mitre_attack:
- T1078
- T1530
- T1685.002

Implementing GDPR Data Protection Controls

Overview

The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill covers implementing the technical and organizational measures required by GDPR, including data protection by design and by default, Data Protection Impact Assessments (DPIAs), data subject rights management, breach notification procedures, and cross-border data transfer mechanisms.

When to Use

• When deploying or configuring implementing gdpr data protection controls capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Understanding of EU data protection law and its territorial scope
• Knowledge of personal data processing activities within the organization
• Familiarity with data architecture, databases, and application systems
• Understanding of data flows including cross-border transfers

Core Concepts

Key GDPR Articles for Technical Controls

Article	Requirement
Art. 5	Principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability
Art. 6	Lawful basis for processing (consent, contract, legal obligation, vital interests, public task, legitimate interest)
Art. 25	Data protection by design and by default
Art. 28	Processor obligations and contractual requirements
Art. 30	Records of processing activities (ROPA)
Art. 32	Security of processing (technical and organizational measures)
Art. 33	Breach notification to supervisory authority (72 hours)
Art. 34	Communication of breach to data subjects
Art. 35	Data Protection Impact Assessment (DPIA)
Art. 37-39	Data Protection Officer (DPO) appointment and role
Art. 44-49	Cross-border data transfers (adequacy, SCCs, BCRs)

Article 32 Security Measures

The regulation requires organizations to implement measures appropriate to the risk:

• Pseudonymization and encryption of personal data
• Confidentiality, integrity, availability, and resilience of processing systems
• Ability to restore availability and access to personal data in a timely manner
• Regular testing and evaluation of technical and organizational measures

Data Subject Rights (Articles 12-22)

Right	Article	Description
Right to be informed	13-14	Transparent information about processing
Right of access	15	Obtain copy of personal data
Right to rectification	16	Correct inaccurate data
Right to erasure	17	"Right to be forgotten"
Right to restrict processing	18	Limit processing of data
Right to data portability	20	Receive data in machine-readable format
Right to object	21	Object to processing (especially direct marketing)
Automated decision-making	22	Not be subject to solely automated decisions

Workflow

Phase 1: Data Mapping and Assessment (Weeks 1-6)

1. Create comprehensive data inventory:
   • What personal data is collected
   • From whom (data subjects)
   • Why (purposes and lawful bases)
   • Where it's stored (systems, locations, countries)
   • Who has access (internal and external)
   • How long it's retained
   • What security measures protect it
2. Document Records of Processing Activities (ROPA) per Article 30
3. Identify lawful basis for each processing activity
4. Map cross-border data transfers and transfer mechanisms
5. Identify processing activities requiring DPIA

Phase 2: Gap Analysis and Risk Assessment (Weeks 7-10)

1. Assess current state against GDPR requirements
2. Perform DPIAs for high-risk processing activities
3. Identify security gaps in Article 32 compliance
4. Evaluate data retention compliance
5. Assess data subject rights request handling capabilities

Phase 3: Technical Controls Implementation (Weeks 11-24)

1. Encryption:
   • Data at rest: AES-256 for databases, file systems, backups
   • Data in transit: TLS 1.2+ for all personal data transfers
   • Key management: secure key storage and rotation procedures
2. Pseudonymization:
   • Implement tokenization for sensitive identifiers
   • Separate pseudonymization keys from data stores
3. Access Controls:
   • Role-based access control (RBAC) for personal data
   • Principle of least privilege
   • MFA for systems processing personal data
   • Regular access reviews
4. Data Minimization:
   • Implement data collection limits at application layer
   • Default privacy settings (data protection by default)
   • Automated data retention enforcement
5. Erasure and Portability:
   • Build data deletion workflows across all systems
   • Implement data export in machine-readable formats (JSON, CSV)
   • Cascade deletion to backups and archives
6. Consent Management:
   • Implement granular consent collection mechanisms
   • Consent withdrawal functionality
   • Consent audit trail and versioning
7. Breach Detection:
   • SIEM for personal data access monitoring
   • Data loss prevention (DLP) controls
   • Anomalous access detection

Phase 4: Organizational Controls (Weeks 11-24)

1. Appoint Data Protection Officer (DPO) if required
2. Develop data protection policies and procedures
3. Create breach notification procedures (72-hour timeline)
4. Establish data subject request (DSR) handling procedures
5. Implement vendor management with Data Processing Agreements (DPAs)
6. Deploy privacy awareness training for all staff
7. Create data protection by design guidance for development teams

Phase 5: Documentation and Compliance Evidence (Weeks 25-30)

1. Finalize ROPA documentation
2. Document all DPIAs and outcomes
3. Create data protection policies
4. Document technical and organizational measures
5. Establish privacy notice and consent records
6. Create international transfer documentation (SCCs, TIAs)

Phase 6: Ongoing Compliance (Continuous)

1. Regular DPIA reviews for new processing activities
2. Annual data mapping refresh
3. Periodic security measure testing (Art. 32 requirement)
4. Data subject request tracking and SLA monitoring
5. Breach response readiness testing
6. Training refresh and awareness campaigns

Key Artifacts

• Records of Processing Activities (ROPA)
• Data Protection Impact Assessments (DPIAs)
• Data Processing Agreements (DPAs)
• Privacy Notices and Consent Records
• Breach Response Procedures and Register
• Data Subject Request Handling Procedures
• International Data Transfer Mechanisms (SCCs, BCRs)
• Technical and Organizational Measures Documentation

Common Pitfalls

• Treating GDPR as only a legal/compliance exercise without technical implementation
• Incomplete data mapping missing shadow IT or legacy systems
• Failing to maintain consent audit trails
• Not testing 72-hour breach notification capability
• Ignoring cross-border transfer requirements for cloud services
• Over-reliance on consent as lawful basis when legitimate interest applies

References

• GDPR Official Text: https://gdpr-info.eu/
• European Data Protection Board (EDPB) Guidelines
• ICO (UK) GDPR Guidance: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/
• CNIL (France) GDPR Compliance Toolkit
• Article 29 Working Party Guidelines on DPIAs

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

GDPR Compliance Audit Checklist

Organization Information

Field	Value
Organization Name
Role	Controller / Processor / Joint Controller
DPO Name and Contact
Lead Supervisory Authority
Assessment Date
Assessor

---

Article 5: Data Processing Principles

• Lawfulness: All processing has documented lawful basis (Art. 6)
• Fairness: Processing is fair and does not cause unjustified adverse effects
• Transparency: Privacy notices provided at point of collection (Art. 13/14)
• Purpose Limitation: Data collected for specified, explicit, and legitimate purposes
• Data Minimization: Only data necessary for the purpose is collected
• Accuracy: Processes exist to keep personal data accurate and up to date
• Storage Limitation: Retention periods defined and enforced for all data categories
• Integrity and Confidentiality: Technical and organizational security measures in place
• Accountability: Ability to demonstrate compliance with all principles

Article 6: Lawful Basis

• Lawful basis identified for each processing activity
• Consent is freely given, specific, informed, and unambiguous where used
• Consent withdrawal mechanism available and easy to use
• Legitimate interest assessments documented where Art. 6(1)(f) relied upon
• Legal bases recorded in ROPA

Articles 13-14: Transparency

• Privacy notice provided at time of data collection (Art. 13)
• Privacy notice provided when data obtained indirectly (Art. 14)
• Notices include: controller identity, purposes, lawful basis, recipients, retention, rights, DPO contact
• Notices are concise, transparent, intelligible, and in plain language
• Notices available in appropriate languages

Articles 15-22: Data Subject Rights

• Process for receiving and handling DSRs documented
• Identity verification procedure before fulfilling requests
• Response within one month (extendable by two months for complex requests)
• Right of access (Art. 15): can provide copy of personal data
• Right to rectification (Art. 16): can correct inaccurate data
• Right to erasure (Art. 17): can delete data across all systems including backups
• Right to restriction (Art. 18): can restrict processing when contested
• Right to portability (Art. 20): can export data in machine-readable format
• Right to object (Art. 21): can cease processing when objected to
• Automated decision-making (Art. 22): safeguards for solely automated decisions

Article 25: Data Protection by Design and Default

• Privacy considerations integrated into system design processes
• Default settings are most privacy-protective
• Only personal data necessary for each purpose is processed by default
• Data protection integrated into development lifecycle

Article 28: Processors

• All processors identified and documented
• Data Processing Agreements (DPAs) in place with all processors
• DPAs include required Art. 28 provisions
• Processor security measures verified
• Sub-processor notification process in place

Article 30: Records of Processing Activities (ROPA)

• ROPA maintained and up to date
• All processing activities documented
• Controller details, purposes, data categories, recipients, transfers, retention, security measures recorded
• Available for supervisory authority on request

Article 32: Security of Processing

• Risk-appropriate technical measures:
  • Encryption of personal data (at rest and in transit)
  • Pseudonymization implemented where appropriate
  • Access controls and authentication
  • Logging and monitoring of access to personal data
  • Data loss prevention controls
• Risk-appropriate organizational measures:
  • Information security policies
  • Staff training on data protection
  • Confidentiality agreements
  • Access review processes
• Ability to restore availability and access after incident
• Regular testing and evaluation of security measures

Articles 33-34: Breach Notification

• Breach detection and assessment procedures documented
• 72-hour notification to supervisory authority process in place
• Data subject notification process for high-risk breaches
• Breach register maintained
• Breach response plan tested within last 12 months

Article 35: Data Protection Impact Assessment

• DPIA criteria documented (when DPIA is required)
• DPIA process documented
• DPIAs conducted for all high-risk processing
• DPO consulted on DPIAs
• DPIAs reviewed when processing changes

Articles 44-49: International Transfers

• All international transfers identified and documented
• Transfer mechanisms in place (adequacy, SCCs, BCRs)
• Transfer Impact Assessments conducted for non-adequate countries
• Supplementary measures implemented where required
• Standard Contractual Clauses (new 2021 modular version) executed

Articles 37-39: Data Protection Officer

• DPO appointed (if required: public authority, core activity large-scale monitoring, core activity special categories)
• DPO has expert knowledge of data protection law
• DPO involved in all data protection matters
• DPO reports to highest management level
• DPO contact details published and communicated to supervisory authority

---

Summary

GDPR Area	Items	Compliant	Non-Compliant	N/A
Principles (Art. 5)
Lawful Basis (Art. 6)
Transparency (Art. 13-14)
Data Subject Rights (Art. 15-22)
Privacy by Design (Art. 25)
Processors (Art. 28)
ROPA (Art. 30)
Security (Art. 32)
Breach Notification (Art. 33-34)
DPIA (Art. 35)
International Transfers (Art. 44-49)
DPO (Art. 37-39)
Total

Sign-off

Role	Name	Signature	Date
DPO
CISO
Legal Counsel
Senior Management

references/api-reference.md (verbatim)

API Reference: Implementing GDPR Data Protection Controls

Key GDPR Articles

Article	Requirement	Technical Control
Art 5	Processing principles	Data minimization, retention policies
Art 25	Privacy by design	Default privacy settings
Art 30	Records of processing	ROPA documentation system
Art 32	Security of processing	Encryption, access controls, testing
Art 33	Breach notification	72-hour DPA notification
Art 35	DPIA	Impact assessment for high-risk processing

Data Subject Rights (Art 12-22)

Right	Article	SLA
Access	Art 15	1 month
Rectification	Art 16	1 month
Erasure	Art 17	1 month
Portability	Art 20	1 month
Object	Art 21	Without undue delay

PII Detection Patterns

import re
patterns = {
    "email": r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b",
    "iban": r"\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b",
    "ip_address": r"\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b",
}

ROPA Required Fields (Art 30)

Field	Description
controller_name	Data controller identity
purposes	Processing purposes
data_categories	Types of personal data
data_subjects	Categories of data subjects
recipients	Data recipients
transfers	Cross-border transfers
retention_periods	Data retention schedules
security_measures	Art 32 controls

Cross-Border Transfer Mechanisms (Art 44-49)

Mechanism	Use Case
Adequacy Decision	Transfer to adequate countries (Art 45)
Standard Contractual Clauses (SCCs)	Most common mechanism (Art 46)
Binding Corporate Rules (BCRs)	Intra-group transfers (Art 47)
Derogations	Consent, contract necessity (Art 49)

References

• GDPR Official Text: https://gdpr-info.eu/
• EDPB Guidelines: https://edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en
• ICO GDPR Guide: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/

references/standards.md (verbatim)

GDPR Standards Reference

Primary Legislation

Regulation (EU) 2016/679 - General Data Protection Regulation

• Adopted: April 14, 2016
• Effective: May 25, 2018
• Scope: Applies to any organization processing personal data of EU/EEA residents
• Chapters: 11 chapters, 99 articles, 173 recitals
• Enforcement: Supervisory authorities in each EU member state
• Penalties: Up to EUR 20 million or 4% of annual global turnover (whichever is greater)

Key Articles Reference

Chapter II - Principles (Articles 5-11)

• Art. 5: Core processing principles (lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability)
• Art. 6: Six lawful bases for processing
• Art. 7: Conditions for consent
• Art. 8: Child's consent (minimum age varies by member state, 13-16)
• Art. 9: Special categories of data (health, biometric, genetic, racial/ethnic, political, religious, trade union, sexual orientation)
• Art. 10: Criminal conviction data

Chapter III - Rights of the Data Subject (Articles 12-23)

• Art. 12: Transparent communication (one month response deadline)
• Art. 13: Information for direct collection
• Art. 14: Information for indirect collection
• Art. 15: Right of access (copy of data, processing purposes, recipients, retention periods, safeguards for transfers)
• Art. 16: Right to rectification
• Art. 17: Right to erasure (applies when: consent withdrawn, purpose fulfilled, unlawful processing, legal obligation)
• Art. 18: Right to restriction of processing
• Art. 20: Right to data portability (structured, commonly used, machine-readable format)
• Art. 21: Right to object (especially direct marketing - absolute right)
• Art. 22: Automated individual decision-making including profiling

Chapter IV - Controller and Processor (Articles 24-43)

• Art. 24: Responsibility of the controller
• Art. 25: Data protection by design and by default
• Art. 26: Joint controllers
• Art. 28: Processor (DPA requirements: subject-matter, duration, nature/purpose, personal data types, data subject categories, controller obligations/rights)
• Art. 30: Records of processing activities
• Art. 32: Security of processing
• Art. 33: Notification to supervisory authority (72 hours)
• Art. 34: Communication to data subject (when high risk to rights and freedoms)
• Art. 35: Data Protection Impact Assessment (DPIA)
• Art. 36: Prior consultation with supervisory authority
• Art. 37-39: Data Protection Officer

Chapter V - International Transfers (Articles 44-49)

• Art. 45: Adequacy decision (EU Commission determines adequate countries)
• Art. 46: Appropriate safeguards (SCCs, BCRs, codes of conduct, certification)
• Art. 47: Binding Corporate Rules
• Art. 49: Derogations (explicit consent, contract, public interest)

Supporting Standards and Guidance

ISO/IEC 27701:2019

• Privacy Information Management System (PIMS) extension to ISO 27001
• Maps GDPR requirements to ISO management system controls
• Provides controller and processor-specific guidance

EDPB Guidelines

• Guidelines on Data Protection Impact Assessment (WP 248)
• Guidelines on Data Breach Notification (WP 250)
• Guidelines on Consent (updated 2020)
• Guidelines on International Data Transfers (post-Schrems II)
• Guidelines on Data Protection by Design and Default (04/2019)

Transfer Mechanisms Post-Schrems II

• Standard Contractual Clauses (SCCs): New modular SCCs adopted June 2021
  • Module 1: Controller to Controller
  • Module 2: Controller to Processor
  • Module 3: Processor to Processor
  • Module 4: Processor to Controller
• Transfer Impact Assessment (TIA): Required to supplement SCCs
• Supplementary Measures: Technical (encryption, pseudonymization), contractual, organizational
• EU-US Data Privacy Framework: Adequacy decision adopted July 2023

DPIA Criteria (Article 35(3) and EDPB)

DPIA required when processing involves:

1. Systematic and extensive evaluation of personal aspects (profiling)
2. Large-scale processing of special categories or criminal data
3. Systematic monitoring of publicly accessible areas
4. New technologies with potential high risk
5. Large-scale data processing
6. Matching or combining datasets
7. Data concerning vulnerable subjects
8. Innovative use of biometric data
9. Data transfers outside EU without adequacy
10. Processing that prevents data subjects from exercising rights

Supervisory Authorities

Country	Authority	Website
EU-wide	European Data Protection Board (EDPB)	edpb.europa.eu
France	CNIL	cnil.fr
Germany	BfDI (Federal), State DPAs	bfdi.bund.de
Ireland	DPC	dataprotection.ie
Netherlands	Autoriteit Persoonsgegevens	autoriteitpersoonsgegevens.nl
Spain	AEPD	aepd.es
Italy	Garante	garanteprivacy.it
UK	ICO (UK GDPR post-Brexit)	ico.org.uk

Key Enforcement Decisions (Benchmark)

• Meta (Ireland DPC, 2023): EUR 1.2 billion - Transfers to US without adequate safeguards
• Amazon (Luxembourg CNPD, 2021): EUR 746 million - Advertising targeting
• WhatsApp (Ireland DPC, 2021): EUR 225 million - Transparency failures
• Google (CNIL, 2022): EUR 150 million - Cookie consent
• H&M (Hamburg DPA, 2020): EUR 35.3 million - Employee surveillance

references/workflows.md (verbatim)

GDPR Data Protection Control Workflows

Workflow 1: Data Subject Request (DSR) Handling

Start
  |
  v
[Receive DSR from Data Subject]
  - Via email, web form, phone, in-person
  - Record receipt timestamp (30-day clock starts)
  |
  v
[Verify Identity of Requestor]
  - Request additional identification if needed
  - Clock pauses until identity verified
  |
  v
[Classify Request Type]
  |
  +--> Access Request (Art. 15) --> Locate all personal data
  +--> Rectification (Art. 16) --> Identify incorrect data
  +--> Erasure (Art. 17) --> Verify grounds for erasure
  +--> Restriction (Art. 18) --> Flag data for restriction
  +--> Portability (Art. 20) --> Export in machine-readable format
  +--> Objection (Art. 21) --> Assess processing basis
  |
  v
[Check for Exemptions]
  - Legal obligation to retain
  - Freedom of expression
  - Public health
  - Archiving in public interest
  - Legal claims
  |
  v
[Execute Request Across All Systems]
  - Production databases
  - Backups and archives
  - Third-party processors
  - Cloud services
  - Analytics platforms
  |
  v
[Document Action Taken]
  |
  v
[Respond to Data Subject within 30 days]
  - Extension to 60 additional days if complex (notify subject)
  |
  v
End

Workflow 2: Data Breach Notification (Art. 33-34)

Start
  |
  v
[Breach Detected or Reported]
  - Technical detection (SIEM, DLP, IDS)
  - Employee report
  - External notification
  - Third-party processor notification
  |
  v
[72-hour Clock Starts]
  |
  v
[Assess Breach Severity]
  - Number of data subjects affected
  - Types of personal data compromised
  - Special categories involved?
  - Risk to rights and freedoms
  |
  v
[Determine Notification Requirements]
  |
  +--> [Risk to Rights and Freedoms?]
        |
        +--> No Risk --> Document in breach register only
        |
        +--> Risk exists --> Notify Supervisory Authority (72 hours)
        |                    |
        |                    v
        +--> High Risk --> Notify Supervisory Authority (72 hours)
                           AND notify affected data subjects
  |
  v
[Prepare Supervisory Authority Notification]
  - Nature of the breach
  - Categories and approximate number of data subjects
  - Categories and approximate number of records
  - Name and contact details of DPO
  - Likely consequences of the breach
  - Measures taken or proposed to address the breach
  |
  v
[Submit Notification to Lead Supervisory Authority]
  |
  v
[If High Risk: Notify Data Subjects]
  - Clear and plain language
  - Description of breach
  - DPO contact information
  - Likely consequences
  - Measures taken to mitigate
  |
  v
[Conduct Post-Breach Review]
  - Root cause analysis
  - Control improvements
  - Update breach register
  |
  v
End

Workflow 3: Data Protection Impact Assessment (DPIA)

Start
  |
  v
[Identify Processing Activity]
  |
  v
[Screen Against DPIA Criteria]
  - Profiling or automated decision-making?
  - Large-scale special category data?
  - Systematic monitoring of public areas?
  - New technology application?
  - Cross-border data transfer?
  - Vulnerable data subjects?
  |
  +--> [No DPIA triggers] --> Document screening decision --> End
  |
  +--> [DPIA required]
        |
        v
[Describe Processing Operation]
  - Purpose and scope
  - Data elements collected
  - Data subjects categories
  - Recipients and transfers
  - Retention period
  - Technology used
  |
  v
[Assess Necessity and Proportionality]
  - Is processing necessary for the purpose?
  - Could purpose be achieved with less data?
  - Is lawful basis appropriate?
  - Are data subject rights supported?
  |
  v
[Identify and Assess Risks]
  - Risks to confidentiality
  - Risks to integrity
  - Risks to availability
  - Risks to rights and freedoms
  - Likelihood and severity of each risk
  |
  v
[Identify Mitigation Measures]
  - Technical measures (encryption, pseudonymization, access controls)
  - Organizational measures (policies, training, DPO oversight)
  - Contractual measures (DPAs, SCCs)
  |
  v
[Determine Residual Risk]
  |
  +--> [Residual Risk Acceptable] --> Approve and proceed
  |
  +--> [Residual Risk High] --> Consult DPO
  |                             |
  |                             +--> [Can mitigate further] --> Add measures
  |                             |
  |                             +--> [Cannot mitigate] --> Prior consultation
  |                                    with Supervisory Authority (Art. 36)
  |
  v
[Document DPIA]
  - Keep under review
  - Reassess when processing changes
  |
  v
End

Workflow 4: International Data Transfer Assessment

Start
  |
  v
[Identify Cross-Border Transfer]
  - Data flowing outside EEA
  - Cloud services in non-EEA regions
  - Group company data sharing
  - Vendor/processor locations
  |
  v
[Check Adequacy Decision]
  - Is destination country on EU adequacy list?
  - (Andorra, Argentina, Canada, Faroe Islands, Guernsey,
     Israel, Isle of Man, Japan, Jersey, New Zealand, Republic
     of Korea, Switzerland, UK, Uruguay, US under DPF)
  |
  +--> [Adequate] --> Document and proceed
  |
  +--> [Not Adequate]
        |
        v
      [Select Transfer Mechanism]
        |
        +--> Standard Contractual Clauses (SCCs)
        +--> Binding Corporate Rules (BCRs)
        +--> Approved Code of Conduct
        +--> Certification Mechanism
        +--> Derogations (Art. 49) - limited circumstances
        |
        v
      [Conduct Transfer Impact Assessment (TIA)]
        - Laws of destination country
        - Government surveillance powers
        - Data protection standards
        - Access by public authorities
        |
        v
      [Identify Supplementary Measures]
        - Technical: encryption with EEA-held keys
        - Contractual: additional processor obligations
        - Organizational: policies limiting access
        |
        v
      [Document Transfer Mechanism]
        - Signed SCCs with correct module
        - TIA findings and conclusions
        - Supplementary measures implemented
  |
  v
End

Workflow 5: Records of Processing Activities (ROPA)

Start
  |
  v
[Identify All Processing Activities]
  - Interview business units
  - Review system inventory
  - Analyze data flows
  - Check vendor agreements
  |
  v
[For Each Processing Activity Document:]
  |
  v
[Controller Record (Art. 30(1))]
  - Name and contact details of controller (and DPO)
  - Purposes of processing
  - Categories of data subjects
  - Categories of personal data
  - Categories of recipients
  - Transfers to third countries (safeguards)
  - Retention periods
  - Technical and organizational security measures
  |
  v
[Processor Record (Art. 30(2))]
  - Name and contact details of processor and controller
  - Categories of processing carried out
  - Transfers to third countries (safeguards)
  - Technical and organizational security measures
  |
  v
[Maintain and Update ROPA]
  - Review quarterly or when processing changes
  - Update for new systems, vendors, purposes
  - Make available to supervisory authority on request
  |
  v
End

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.