implementing-gdpr-data-subject-access-request skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. 'Automates GDPR Data Subject Access Request (DSAR) workflows including Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/implementing-gdpr-data-subject-access-request/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-gdpr-data-subject-access-request, or copy the skill folder into ~/.claude/skills/implementing-gdpr-data-subject-access-request/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gdpr-data-subject-access-request/SKILL.md

SKILL.md (verbatim)

name: implementing-gdpr-data-subject-access-request
description: 'Automates GDPR Data Subject Access Request (DSAR) workflows including
  identity verification, PII discovery across databases and files using regex and
  NER, data mapping, response templating per Article 15 requirements, deadline tracking,
  and audit logging. Covers ICO/EDPB guidance compliance, exemption handling, and
  scalable batch processing. Use when building or auditing DSAR response capabilities
  under GDPR/UK GDPR.

  '
domain: cybersecurity
subdomain: privacy-compliance
tags:
- gdpr
- dsar
- privacy
- pii-discovery
- data-subject-rights
- compliance
- article-15
version: '1.0'
author: mukul975
license: Apache-2.0
nist_csf:
- GV.PO-01
- PR.DS-01
- GV.OC-05
mitre_attack:
- T1078
- T1190
- T1059

Implementing GDPR Data Subject Access Request (DSAR) Workflow

When to Use

  • When building automated DSAR processing pipelines for GDPR/UK GDPR compliance
  • When implementing PII discovery across structured and unstructured data sources
  • When creating response templates that satisfy Article 15 disclosure requirements
  • When auditing existing DSAR handling for regulatory compliance gaps
  • When scaling DSAR processing from manual to automated workflows

Prerequisites

  • Python 3.8+ with required dependencies (spacy, presidio-analyzer, jinja2)
  • Access to data sources where personal data resides (databases, file shares, logs)
  • Understanding of GDPR Article 15 requirements and ICO/EDPB guidance
  • Appropriate authorization and data protection officer (DPO) approval
  • Test environment with synthetic or anonymized data for validation

Background

GDPR Article 15 - Right of Access

Under GDPR Article 15, data subjects have the right to obtain from the controller:

  1. Confirmation that their personal data is being processed
  2. A copy of all personal data held about them
  3. Supplementary information including:
    • Purposes of processing
    • Categories of personal data
    • Recipients or categories of recipients
    • Retention periods or criteria to determine them
    • Right to rectification, erasure, restriction, or objection
    • Right to lodge a complaint with a supervisory authority
    • Source of the data (if not collected directly from the subject)
    • Existence of automated decision-making, including profiling

Timeline Requirements

  • Standard deadline: 1 calendar month from receipt of valid request
  • Complex extension: Up to 2 additional months (must notify within first month)
  • Clock pause: Permitted when identity verification or clarification is needed
  • Format: Electronic form if request made electronically (unless otherwise requested)
  • Cost: Free of charge (unless manifestly unfounded/excessive)

ICO/EDPB Guidance Key Points

  • No formal format required for DSARs - verbal, written, social media all valid
  • Request need not mention "subject access request" or cite Article 15
  • Identity verification must be proportionate to the risk
  • Exemptions exist for legal privilege, third-party data, trade secrets
  • EDPB coordinated enforcement actions cover right of access compliance

Instructions

Step 1: DSAR Intake and Verification

Implement a request intake system that captures the request through any channel, verifies the requester's identity, and starts the compliance clock.

from agent import DSARWorkflowEngine

engine = DSARWorkflowEngine(config_path="dsar_config.json")

# Register a new DSAR
request = engine.register_dsar(
    requester_name="Jane Smith",
    requester_email="jane.smith@example.com",
    request_channel="email",
    request_text="I would like a copy of all personal data you hold about me.",
    identity_docs=["passport_verified"],
)
print(f"DSAR ID: {request['dsar_id']}, Deadline: {request['deadline']}")

Step 2: PII Discovery Across Data Sources

Scan databases, files, and logs using regex patterns and NER to find all personal data associated with the data subject.

from agent import PIIDiscoveryEngine

pii_engine = PIIDiscoveryEngine()

# Scan structured data (database)
db_results = pii_engine.scan_database(
    connection_string="postgresql://user:pass@localhost/appdb",
    search_identifiers={"email": "jane.smith@example.com", "name": "Jane Smith"},
)

# Scan unstructured data (files, logs)
file_results = pii_engine.scan_files(
    directories=["/var/log/app", "/data/exports", "/data/documents"],
    search_identifiers={"email": "jane.smith@example.com", "name": "Jane Smith"},
)

# Scan with NER for contextual PII detection
ner_results = pii_engine.scan_with_ner(
    text_corpus=file_results["raw_text_matches"],
    entity_types=["PERSON", "EMAIL", "PHONE_NUMBER", "LOCATION", "DATE_OF_BIRTH"],
)

all_pii = pii_engine.consolidate_results(db_results, file_results, ner_results)
print(f"Found {all_pii['total_records']} PII records across {all_pii['source_count']} sources")

Step 3: Data Mapping and Classification

Map discovered PII to processing purposes, legal bases, and retention periods as required by Article 15.

from agent import DataMapper

mapper = DataMapper(data_inventory_path="data_inventory.json")

# Map PII to Article 15 categories
mapped_data = mapper.map_to_article15(
    pii_records=all_pii,
    data_subject_id="jane.smith@example.com",
)

# Output includes processing purposes, recipients, retention for each data category
for category in mapped_data["categories"]:
    print(f"Category: {category['name']}")
    print(f"  Purpose: {category['processing_purpose']}")
    print(f"  Legal basis: {category['legal_basis']}")
    print(f"  Retention: {category['retention_period']}")
    print(f"  Recipients: {', '.join(category['recipients'])}")

Step 4: Exemption Review

Apply exemptions where lawful (third-party data, legal privilege, trade secrets) before compiling the response.

from agent import ExemptionReviewer

reviewer = ExemptionReviewer()

# Check for applicable exemptions
review_result = reviewer.review_exemptions(
    mapped_data=mapped_data,
    exemption_checks=[
        "third_party_data",
        "legal_professional_privilege",
        "trade_secrets",
        "crime_prevention",
        "management_forecasting",
    ],
)

# Apply redactions where exemptions apply
redacted_data = reviewer.apply_redactions(mapped_data, review_result["exemptions"])
print(f"Applied {review_result['exemption_count']} exemptions")

Step 5: Response Generation

Generate a compliant DSAR response package with cover letter, data export, and supplementary information document.

from agent import DSARResponseGenerator

generator = DSARResponseGenerator(template_dir="templates/")

# Generate complete response package
response = generator.generate_response(
    dsar_id=request["dsar_id"],
    data_subject="Jane Smith",
    mapped_data=redacted_data,
    format="pdf",  # or "json", "csv"
)

# Package includes: cover letter, data export, supplementary info, audit log
for doc in response["documents"]:
    print(f"Generated: {doc['filename']} ({doc['type']})")

Step 6: Audit Trail and Compliance Logging

Maintain complete audit trail of the DSAR lifecycle for accountability.

from agent import DSARAuditLogger

logger = DSARAuditLogger(log_path="dsar_audit_logs/")

# Log complete DSAR lifecycle
logger.log_event(request["dsar_id"], "request_received", {
    "channel": "email",
    "identity_verified": True,
})
logger.log_event(request["dsar_id"], "pii_discovery_complete", {
    "records_found": all_pii["total_records"],
    "sources_scanned": all_pii["source_count"],
})
logger.log_event(request["dsar_id"], "response_sent", {
    "format": "pdf",
    "documents_count": len(response["documents"]),
    "exemptions_applied": review_result["exemption_count"],
})

# Generate compliance report
compliance_report = logger.generate_compliance_report(request["dsar_id"])

Examples

Complete DSAR Processing Pipeline

from agent import DSARWorkflowEngine, PIIDiscoveryEngine, DSARResponseGenerator

# Full automated pipeline
engine = DSARWorkflowEngine(config_path="dsar_config.json")
pii = PIIDiscoveryEngine()
gen = DSARResponseGenerator(template_dir="templates/")

# 1. Intake
req = engine.register_dsar(
    requester_name="John Doe",
    requester_email="john.doe@example.com",
    request_channel="web_form",
    request_text="Please provide all my data under GDPR Article 15.",
    identity_docs=["email_verified", "account_match"],
)

# 2. Discover
results = pii.full_scan(
    search_identifiers={"email": "john.doe@example.com"},
    sources=["database", "files", "logs"],
)

# 3. Generate response
response = gen.generate_response(
    dsar_id=req["dsar_id"],
    data_subject="John Doe",
    mapped_data=results,
)

# 4. Track deadline
engine.update_status(req["dsar_id"], "response_sent")
print(f"DSAR {req['dsar_id']} completed, {engine.days_remaining(req['dsar_id'])} days remaining")

PII Regex Pattern Testing

from agent import PIIPatternMatcher

matcher = PIIPatternMatcher()

# Test individual patterns
test_text = "Contact jane.smith@example.com or call +44 20 7946 0958. SSN: 123-45-6789"
matches = matcher.scan_text(test_text)
for m in matches:
    print(f"  [{m['type']}] '{m['value']}' (confidence: {m['confidence']})")

References

Other files in this skill

references/api-reference.md (verbatim)

API Reference: GDPR DSAR Workflow Automation

PIIPatternMatcher

Scans text for PII using compiled regex patterns with confidence scoring and contextual boosting.

Constructor

PIIPatternMatcher(custom_patterns=None)
Parameter Type Description
custom_patterns dict or None Additional regex patterns to include in scanning

Methods

scan_text(text, min_confidence=0.5)

Scan a string for PII matches.

Parameter Type Default Description
text str required Text to scan for PII
min_confidence float 0.5 Minimum confidence threshold (0.0-1.0)

Returns: list[dict] -- Each match contains type, value, description, confidence, gdpr_category, position.

scan_file(file_path, min_confidence=0.5)

Scan a file on disk for PII matches.

Parameter Type Default Description
file_path str required Absolute path to the file
min_confidence float 0.5 Minimum confidence threshold

Returns: dict with file, size_bytes, matches, match_count, pii_types_found.

Built-in PII Patterns

Pattern Name Description Confidence GDPR Category
email Email address 0.95 contact_information
phone_international International phone number 0.70 contact_information
uk_phone UK phone number 0.80 contact_information
ssn_us US Social Security Number 0.85 government_id
nino_uk UK National Insurance Number 0.90 government_id
credit_card Credit/debit card number 0.85 financial_data
iban International Bank Account Number 0.80 financial_data
ipv4 IPv4 address 0.60 online_identifier
date_of_birth Date of birth (DD/MM/YYYY) 0.65 demographic_data
uk_postcode UK postcode 0.75 location_data
passport_uk UK passport number (9 digits) 0.40 government_id
eu_vat EU VAT number 0.50 financial_data

PIIDiscoveryEngine

Discovers PII across structured (database) and unstructured (files) data sources.

Constructor

PIIDiscoveryEngine(custom_patterns=None)

Methods

scan_database(connection_string, search_identifiers, tables=None)

Generate parameterized SQL queries for PII discovery in databases.

Parameter Type Default Description
connection_string str required Database connection string (redacted in output)
search_identifiers dict required Key-value pairs to search for (e.g., {"email": "user@example.com"})
tables list[str] or None auto Tables to scan; defaults to common tables

Returns: dict with source_type, connection, tables_scanned, queries_generated, queries.

scan_files(directories, search_identifiers, file_extensions=None, max_file_size_mb=50)

Scan files in directories for PII matching identifiers.

Parameter Type Default Description
directories list[str] required Directory paths to scan
search_identifiers dict required Identifiers to search for
file_extensions list[str] or None common types File extensions to include
max_file_size_mb int 50 Skip files larger than this

Returns: dict with files_scanned, files_with_matches, matches, raw_text_matches.

scan_with_ner(text_corpus, entity_types=None, confidence_threshold=0.7)

Scan text using Named Entity Recognition (spaCy NER with regex fallback).

Parameter Type Default Description
text_corpus list[str] required List of file paths to scan
entity_types list[str] or None common types NER entity types to detect
confidence_threshold float 0.7 Minimum confidence for results

Supported Entity Types: PERSON, EMAIL, PHONE_NUMBER, LOCATION, DATE_OF_BIRTH, ORG, GPE

Returns: dict with files_processed, total_entities, results, model_used.

consolidate_results(*result_sets)

Merge results from database, file, and NER scans into a unified record set.

Returns: dict with total_records, source_count, sources, records.

full_scan(search_identifiers, sources=None, db_connection="", directories=None)

Run a complete PII discovery scan across all source types.

Returns: Consolidated dict from all scans.

DataMapper

Maps discovered PII to GDPR Article 15 disclosure categories.

Constructor

DataMapper(data_inventory_path=None)
Parameter Type Description
data_inventory_path str or None Path to JSON data inventory for overrides

Methods

map_to_article15(pii_records, data_subject_id)

Map PII records to Article 15 required categories including processing purposes, legal basis, retention periods, and recipients.

Returns: dict with categories, supplementary_info, article_15_reference.

Article 15 Categories Mapped

Category Article Reference Contents
Processing Purposes Art. 15(1)(a) Why data is processed
Data Categories Art. 15(1)(b) Types of personal data
Recipients Art. 15(1)(c) Who receives the data
Retention Period Art. 15(1)(d) How long data is kept
Data Subject Rights Art. 15(1)(e-f) Rights to rectify, erase, restrict, object
Data Source Art. 15(1)(g) Where data was collected from
Automated Decisions Art. 15(1)(h) Profiling and automated decision-making
International Transfers Art. 15(2) Safeguards for cross-border transfers

ExemptionReviewer

Reviews DSAR data against applicable GDPR/UK GDPR exemptions.

Methods

review_exemptions(mapped_data, exemption_checks=None)

Flag applicable exemptions for DPO review.

Returns: dict with exemption_count, exemptions, review_status.

apply_redactions(mapped_data, approved_exemptions)

Apply approved exemption redactions to the mapped data.

Returns: Redacted dict with redaction_log.

Supported Exemption Types

Type Legal Basis Action
third_party_data Art. 15(4) / DPA 2018 Sch. 2 Para 16 redact
legal_professional_privilege DPA 2018 Sch. 2 Para 19 withhold
trade_secrets Recital 63 GDPR redact
crime_prevention DPA 2018 Sch. 2 Para 2 withhold
management_forecasting DPA 2018 Sch. 2 Para 22 withhold
negotiations DPA 2018 Sch. 2 Para 24 withhold
regulatory_function DPA 2018 Sch. 2 Para 20 withhold

DSARResponseGenerator

Generates compliant DSAR response packages per GDPR Article 15.

Constructor

DSARResponseGenerator(template_dir=None, organization_name="Organization",
                      dpo_email="dpo@organization.com", controller_name="Data Protection Officer")

Methods

generate_response(dsar_id, data_subject, mapped_data, format="json", request_date=None)

Generate a complete response package with cover letter, data export, supplementary info, and audit metadata.

Parameter Type Default Description
dsar_id str required DSAR reference ID
data_subject str required Name of the data subject
mapped_data dict required Output from DataMapper/ExemptionReviewer
format str "json" Export format: json or csv
request_date str or None today Date the request was received

Returns: dict with documents list containing filename, type, and content for each document.

save_response_package(response, output_dir)

Save all response documents to disk.

Returns: list[str] of saved file paths.

DSARWorkflowEngine

Manages the complete DSAR lifecycle: intake, tracking, deadlines, and compliance.

Constructor

DSARWorkflowEngine(config_path=None)

Methods

register_dsar(requester_name, requester_email, request_channel, request_text, identity_docs=None)

Register a new DSAR and start the 30-day compliance clock.

Returns: dict with dsar_id, deadline, status, identity_verified.

update_status(dsar_id, new_status, notes="")

Update DSAR processing status.

Valid Statuses: received, identity_verification, verification_failed, in_progress, pii_discovery, exemption_review, dpo_review, response_generation, response_sent, closed, refused.

apply_extension(dsar_id, reason)

Apply a 2-month extension for complex requests per Art. 12(3).

pause_clock(dsar_id, reason)

Pause the response clock (e.g., awaiting identity verification).

days_remaining(dsar_id)

Calculate remaining days until DSAR deadline. Returns: int.

get_overdue_dsars()

Get all DSARs past their deadline. Returns: list[dict].

generate_dashboard()

Generate a DSAR processing dashboard summary. Returns: dict with status breakdown and overdue info.

DSARAuditLogger

Maintains JSONL audit trails for DSAR processing lifecycle.

Constructor

DSARAuditLogger(log_path="dsar_audit_logs")

Methods

log_event(dsar_id, event_type, details=None)

Log a DSAR processing event to the JSONL audit file.

get_audit_trail(dsar_id)

Retrieve the complete audit trail. Returns: list[dict].

generate_compliance_report(dsar_id)

Generate a compliance report with pass/fail checks for all processing steps.

Returns: dict with compliance_checks, timeline, overall_compliance (COMPLIANT or REVIEW_REQUIRED).

CLI Usage

# Full automated pipeline
python agent.py --action full_pipeline \
    --requester-name "Jane Smith" \
    --requester-email "jane.smith@example.com" \
    --scan-dirs /var/log/app /data/exports \
    --db-connection "postgresql://user:pass@localhost/appdb" \
    --output-dir dsar_output \
    --format json

# Scan text for PII
python agent.py --action scan_pii \
    --scan-text "Contact jane@example.com or call +44 20 7946 0958"

# Scan files only
python agent.py --action scan_files \
    --scan-dirs /data/exports /var/log \
    --requester-email "jane@example.com"

# Generate dashboard
python agent.py --action dashboard

CLI Arguments

Argument Default Description
--action full_pipeline Action to perform
--requester-name Test Subject Data subject name
--requester-email test@example.com Data subject email
--request-channel email Request channel
--scan-dirs [] Directories to scan
--db-connection "" Database connection string
--output-dir dsar_output Output directory
--config dsar_config.json Configuration file path
--format json Output format (json or csv)
--min-confidence 0.5 Minimum PII confidence threshold
--scan-text "" Direct text to scan for PII

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.