[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADQ3VY7ASHNSXBAF4MK5V4":3,"skill-same:01M6ADQ3VY7ASHNSXBAF4MK5V4":91},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":43,"repositoryHtmlUrl":44,"repositoryHomepageUrl":6,"ownerHtmlUrl":45,"ownerBlogUrl":46,"ownerDescription":47,"updatedAt":48,"install":49,"resources":62},"01M6ADQ3VY7ASHNSXBAF4MK5V4","ai-vendor-privacy-due",null,"Determines controller-processor relationships for AI services and conducts privacy due diligence. Covers SaaS AI (processor), embedded AI (joint controller), API-based AI (assessment framework), and vendor risk assessment. Keywords: AI vendor, controller-processor, due diligence, SaaS AI, joint controller, Art. 28.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",338,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fai-privacy-governance-skills\u002Fskills\u002Fai-vendor-privacy-due\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",[24,25,26,27,28,29,30],"privacy","ai vendor privacy due","governance","risk assessment","assessment","framework","services","2026-11-10 10:12:30",false,"---\nname: ai-vendor-privacy-due\ndescription: >-\n  Determines controller-processor relationships for AI services and conducts\n  privacy due diligence. Covers SaaS AI (processor), embedded AI (joint\n  controller), API-based AI (assessment framework), and vendor risk\n  assessment. Keywords: AI vendor, controller-processor, due diligence,\n  SaaS AI, joint controller, Art. 28.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: ai-privacy-governance\n  tags: \"ai-vendor, controller-processor, due-diligence, saas-ai, joint-controller, art-28\"\n---\n\n# AI Vendor Privacy Due Diligence\n\n## Overview\n\nAI services create complex controller-processor relationships that differ significantly from traditional data processing arrangements. Whether an AI vendor is a processor, joint controller, or independent controller depends on the degree of autonomy the vendor has over personal data processing — particularly regarding model training on customer data, data retention for model improvement, and the vendor's independent purposes for the data. This skill provides the framework for determining controller-processor roles in AI service relationships, conducting privacy due diligence on AI vendors, and establishing appropriate contractual protections.\n\n## Controller-Processor Determination for AI\n\n### Decision Framework\n\n| AI Service Model | Typical Role | Key Factors | GDPR Article |\n|-----------------|-------------|-------------|-------------|\n| **SaaS AI — Customer data processed per instructions** | Vendor = Processor | Vendor processes data solely on controller's instructions; no independent use | Art. 28 DPA required |\n| **SaaS AI — Customer data used for model training** | Vendor = Joint Controller or Independent Controller | Vendor uses customer data for own model improvement beyond contracted service | Art. 26 JCA or separate controller notice |\n| **Embedded AI — Pre-trained model in customer infrastructure** | Customer = Controller; Vendor = may be processor for support | Model runs in customer environment; vendor may access data for support\u002Fupdates | Art. 28 if vendor accesses data |\n| **API-based AI — Customer sends data for inference** | Vendor = Processor (if no data retention) or Joint Controller (if training on inputs) | Depends on whether vendor retains, uses, or trains on input data | Assessment required |\n| **AI Platform — Customer builds models on vendor platform** | Vendor = Processor for infrastructure; Controller for platform data | Vendor provides compute; customer controls data and model | Art. 28 DPA + audit rights |\n| **AI Marketplace — Pre-built models with customer data** | Depends on data flow | If customer data enters vendor model → joint controller assessment | Case-by-case |\n\n### Key Determination Questions\n\n1. **Who determines the purpose of processing?** — The entity deciding *why* personal data is processed\n2. **Who determines the means of processing?** — The entity deciding *how* data is processed (but \"non-essential means\" may be delegated to processor)\n3. **Does the vendor use data for its own purposes?** — Model training, benchmarking, product improvement using customer data\n4. **Does the vendor retain data beyond service delivery?** — Data kept after inference, stored for training, retained in logs\n5. **Does the vendor make independent decisions about the data?** — Choosing to train models, sharing with sub-processors not instructed by customer\n\n### Common AI Vendor Patterns\n\n#### Pattern 1: Pure Inference API (Vendor = Processor)\n- Customer sends data; receives inference result\n- Vendor does not retain input data beyond processing\n- Vendor does not train on customer data\n- Vendor acts solely on customer's instructions\n- **Contractual**: Art. 28 DPA with clear scope\n\n#### Pattern 2: AI with Model Improvement (Vendor = Joint Controller)\n- Customer sends data; receives inference result\n- Vendor retains data to improve its models\n- Vendor determines that model training is a purpose\n- Both parties benefit from the model improvement\n- **Contractual**: Art. 26 Joint Controller Agreement\n\n#### Pattern 3: AI with Anonymised Analytics (Assessment Required)\n- Customer sends data; receives inference result\n- Vendor claims to anonymise data and use aggregated analytics\n- If anonymisation is effective: no personal data processing for analytics\n- If anonymisation is not effective (re-identification possible): vendor is controller for analytics\n- **Assessment**: Verify anonymisation effectiveness per WP216\n\n#### Pattern 4: Embedded AI with Telemetry (Vendor = Processor + may be Controller)\n- AI model runs in customer environment\n- Vendor collects telemetry data including model performance\n- If telemetry contains personal data: vendor may be controller for telemetry processing\n- **Contractual**: Art. 28 DPA for model support + separate arrangement for telemetry\n\n## Due Diligence Assessment Framework\n\n### Phase 1: Vendor AI Processing Inventory\n\nFor each AI vendor, document:\n\n| Element | Documentation Required |\n|---------|----------------------|\n| AI capabilities | What AI functions does the vendor provide? |\n| Personal data inputs | What personal data is sent to the vendor? |\n| Personal data outputs | What personal data does the vendor return? |\n| Data retention | Does the vendor retain input data? For how long? |\n| Model training | Does the vendor train on customer data? |\n| Sub-processors | Does the vendor use sub-processors for AI processing? Where? |\n| Data location | Where is AI processing performed? What jurisdictions? |\n| Security measures | What security controls protect data during AI processing? |\n| Human review | Does vendor personnel access customer data? |\n\n### Phase 2: Privacy Risk Assessment\n\n| Risk Factor | Assessment | Risk Level |\n|-------------|-----------|-----------|\n| Data sensitivity | Special category data sent to AI vendor? | |\n| Data volume | Volume of personal data processed by vendor | |\n| Vendor data use | Vendor uses customer data for own purposes? | |\n| International transfers | Data processed outside EU\u002FEEA? | |\n| Sub-processor chain | Number and location of sub-processors | |\n| Security posture | Certifications (ISO 27001, SOC 2)? | |\n| Incident history | Prior data breaches or enforcement actions? | |\n| AI-specific risks | Model memorization, output leakage, bias? | |\n\n### Phase 3: Contractual Assessment\n\n| Contractual Element | Required? | Status |\n|--------------------|-----------|--------|\n| Art. 28 DPA or Art. 26 JCA | Yes | |\n| Processing scope and purpose limitation | Yes | |\n| Prohibition on data use beyond instructions (if processor) | Yes | |\n| Model training opt-out | Yes (if vendor trains on data) | |\n| Sub-processor notification and approval | Yes | |\n| International transfer safeguards | If applicable | |\n| Data deletion on termination | Yes | |\n| Audit rights | Yes | |\n| Breach notification obligations | Yes | |\n| AI-specific: model privacy testing | Recommended | |\n| AI-specific: bias assessment obligations | Recommended for high-risk | |\n| AI-specific: output accuracy warranties | Recommended | |\n\n## AI-Specific Contractual Clauses\n\n### Model Training Restrictions\n\n```\nThe Processor shall not use Customer Data to train, improve, fine-tune, or\notherwise develop any machine learning model, algorithm, or AI system,\nwhether for the Customer's benefit or for any other purpose, without prior\nwritten consent from the Customer. Any consent granted shall specify the\nscope of permitted training, the data categories involved, and the privacy\nsafeguards to be applied.\n```\n\n### AI Output Accuracy\n\n```\nThe Provider acknowledges that AI system outputs about identifiable data\nsubjects must comply with the accuracy principle under Art. 5(1)(d) GDPR.\nThe Provider shall implement measures to minimise inaccurate outputs about\ndata subjects and shall promptly correct inaccurate outputs upon\nnotification.\n```\n\n### Model Privacy and Bias Obligations\n\n```\nThe Provider shall conduct periodic privacy audits of AI models processing\nCustomer Data, including membership inference testing and training data\nextraction testing, and shall make results available to the Customer upon\nrequest. The Provider shall monitor AI systems for discriminatory outcomes\nand shall implement bias mitigation measures as required.\n```\n\n## Enforcement Relevance\n\n- **EDPB Guidelines 07\u002F2020 on Controller-Processor**: Determination depends on factual circumstances, not contractual labels. A vendor labelled \"processor\" that uses data for its own purposes is factually a controller.\n- **Garante v. OpenAI (2023)**: OpenAI's role as controller for ChatGPT training data confirmed — processing personal data for model training is an independent controller purpose.\n- **CJEU C-40\u002F17 (Fashion ID)**: Joint controller status can arise when a party has influence over the purpose and means of processing, even without access to the data.\n- **DPC v. Meta (WhatsApp, 2023)**: EUR 5.5M fine — processor-controller determination must reflect actual data use, not just contractual terms.\n\n## Integration Points\n\n- **ai-dpia**: Vendor AI processing must be included in DPIA scope\n- **ai-training-lawfulness**: Vendor training on customer data requires lawful basis assessment\n- **ai-transparency-reqs**: Data subjects must be informed about AI vendor processing\n- **ai-deployment-checklist**: Vendor due diligence is a pre-deployment checklist item\n","# AI Vendor Privacy Due Diligence\n\n## Overview\n\nAI services create complex controller-processor relationships that differ significantly from traditional data processing arrangements. Whether an AI vendor is a processor, joint controller, or independent controller depends on the degree of autonomy the vendor has over personal data processing — particularly regarding model training on customer data, data retention for model improvement, and the vendor's independent purposes for the data. This skill provides the framework for determining controller-processor roles in AI service relationships, conducting privacy due diligence on AI vendors, and establishing appropriate contractual protections.\n\n## Controller-Processor Determination for AI\n\n### Decision Framework\n\n| AI Service Model | Typical Role | Key Factors | GDPR Article |\n|-----------------|-------------|-------------|-------------|\n| **SaaS AI — Customer data processed per instructions** | Vendor = Processor | Vendor processes data solely on controller's instructions; no independent use | Art. 28 DPA required |\n| **SaaS AI — Customer data used for model training** | Vendor = Joint Controller or Independent Controller | Vendor uses customer data for own model improvement beyond contracted service | Art. 26 JCA or separate controller notice |\n| **Embedded AI — Pre-trained model in customer infrastructure** | Customer = Controller; Vendor = may be processor for support | Model runs in customer environment; vendor may access data for support\u002Fupdates | Art. 28 if vendor accesses data |\n| **API-based AI — Customer sends data for inference** | Vendor = Processor (if no data retention) or Joint Controller (if training on inputs) | Depends on whether vendor retains, uses, or trains on input data | Assessment required |\n| **AI Platform — Customer builds models on vendor platform** | Vendor = Processor for infrastructure; Controller for platform data | Vendor provides compute; customer controls data and model | Art. 28 DPA + audit rights |\n| **AI Marketplace — Pre-built models with customer data** | Depends on data flow | If customer data enters vendor model → joint controller assessment | Case-by-case |\n\n### Key Determination Questions\n\n1. **Who determines the purpose of processing?** — The entity deciding *why* personal data is processed\n2. **Who determines the means of processing?** — The entity deciding *how* data is processed (but \"non-essential means\" may be delegated to processor)\n3. **Does the vendor use data for its own purposes?** — Model training, benchmarking, product improvement using customer data\n4. **Does the vendor retain data beyond service delivery?** — Data kept after inference, stored for training, retained in logs\n5. **Does the vendor make independent decisions about the data?** — Choosing to train models, sharing with sub-processors not instructed by customer\n\n### Common AI Vendor Patterns\n\n#### Pattern 1: Pure Inference API (Vendor = Processor)\n- Customer sends data; receives inference result\n- Vendor does not retain input data beyond processing\n- Vendor does not train on customer data\n- Vendor acts solely on customer's instructions\n- **Contractual**: Art. 28 DPA with clear scope\n\n#### Pattern 2: AI with Model Improvement (Vendor = Joint Controller)\n- Customer sends data; receives inference result\n- Vendor retains data to improve its models\n- Vendor determines that model training is a purpose\n- Both parties benefit from the model improvement\n- **Contractual**: Art. 26 Joint Controller Agreement\n\n#### Pattern 3: AI with Anonymised Analytics (Assessment Required)\n- Customer sends data; receives inference result\n- Vendor claims to anonymise data and use aggregated analytics\n- If anonymisation is effective: no personal data processing for analytics\n- If anonymisation is not effective (re-identification possible): vendor is controller for analytics\n- **Assessment**: Verify anonymisation effectiveness per WP216\n\n#### Pattern 4: Embedded AI with Telemetry (Vendor = Processor + may be Controller)\n- AI model runs in customer environment\n- Vendor collects telemetry data including model performance\n- If telemetry contains personal data: vendor may be controller for telemetry processing\n- **Contractual**: Art. 28 DPA for model support + separate arrangement for telemetry\n\n## Due Diligence Assessment Framework\n\n### Phase 1: Vendor AI Processing Inventory\n\nFor each AI vendor, document:\n\n| Element | Documentation Required |\n|---------|----------------------|\n| AI capabilities | What AI functions does the vendor provide? |\n| Personal data inputs | What personal data is sent to the vendor? |\n| Personal data outputs | What personal data does the vendor return? |\n| Data retention | Does the vendor retain input data? For how long? |\n| Model training | Does the vendor train on customer data? |\n| Sub-processors | Does the vendor use sub-processors for AI processing? Where? |\n| Data location | Where is AI processing performed? What jurisdictions? |\n| Security measures | What security controls protect data during AI processing? |\n| Human review | Does vendor personnel access customer data? |\n\n### Phase 2: Privacy Risk Assessment\n\n| Risk Factor | Assessment | Risk Level |\n|-------------|-----------|-----------|\n| Data sensitivity | Special category data sent to AI vendor? | |\n| Data volume | Volume of personal data processed by vendor | |\n| Vendor data use | Vendor uses customer data for own purposes? | |\n| International transfers | Data processed outside EU\u002FEEA? | |\n| Sub-processor chain | Number and location of sub-processors | |\n| Security posture | Certifications (ISO 27001, SOC 2)? | |\n| Incident history | Prior data breaches or enforcement actions? | |\n| AI-specific risks | Model memorization, output leakage, bias? | |\n\n### Phase 3: Contractual Assessment\n\n| Contractual Element | Required? | Status |\n|--------------------|-----------|--------|\n| Art. 28 DPA or Art. 26 JCA | Yes | |\n| Processing scope and purpose limitation | Yes | |\n| Prohibition on data use beyond instructions (if processor) | Yes | |\n| Model training opt-out | Yes (if vendor trains on data) | |\n| Sub-processor notification and approval | Yes | |\n| International transfer safeguards | If applicable | |\n| Data deletion on termination | Yes | |\n| Audit rights | Yes | |\n| Breach notification obligations | Yes | |\n| AI-specific: model privacy testing | Recommended | |\n| AI-specific: bias assessment obligations | Recommended for high-risk | |\n| AI-specific: output accuracy warranties | Recommended | |\n\n## AI-Specific Contractual Clauses\n\n### Model Training Restrictions\n\n```\nThe Processor shall not use Customer Data to train, improve, fine-tune, or\notherwise develop any machine learning model, algorithm, or AI system,\nwhether for the Customer's benefit or for any other purpose, without prior\nwritten consent from the Customer. Any consent granted shall specify the\nscope of permitted training, the data categories involved, and the privacy\nsafeguards to be applied.\n```\n\n### AI Output Accuracy\n\n```\nThe Provider acknowledges that AI system outputs about identifiable data\nsubjects must comply with the accuracy principle under Art. 5(1)(d) GDPR.\nThe Provider shall implement measures to minimise inaccurate outputs about\ndata subjects and shall promptly correct inaccurate outputs upon\nnotification.\n```\n\n### Model Privacy and Bias Obligations\n\n```\nThe Provider shall conduct periodic privacy audits of AI models processing\nCustomer Data, including membership inference testing and training data\nextraction testing, and shall make results available to the Customer upon\nrequest. The Provider shall monitor AI systems for discriminatory outcomes\nand shall implement bias mitigation measures as required.\n```\n\n## Enforcement Relevance\n\n- **EDPB Guidelines 07\u002F2020 on Controller-Processor**: Determination depends on factual circumstances, not contractual labels. A vendor labelled \"processor\" that uses data for its own purposes is factually a controller.\n- **Garante v. OpenAI (2023)**: OpenAI's role as controller for ChatGPT training data confirmed — processing personal data for model training is an independent controller purpose.\n- **CJEU C-40\u002F17 (Fashion ID)**: Joint controller status can arise when a party has influence over the purpose and means of processing, even without access to the data.\n- **DPC v. Meta (WhatsApp, 2023)**: EUR 5.5M fine — processor-controller determination must reflect actual data use, not just contractual terms.\n\n## Integration Points\n\n- **ai-dpia**: Vendor AI processing must be included in DPIA scope\n- **ai-training-lawfulness**: Vendor training on customer data requires lawful basis assessment\n- **ai-transparency-reqs**: Data subjects must be informed about AI vendor processing\n- **ai-deployment-checklist**: Vendor due diligence is a pre-deployment checklist item\n",{"name":5,"license":15,"metadata":36,"description":7},{"tags":37,"author":9,"domain":24,"version":38,"subdomain":39},"ai-vendor, controller-processor, due-diligence, saas-ai, joint-controller, art-28","1.0","ai-privacy-governance","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fai-privacy-governance-skills\u002Fskills\u002Fai-vendor-privacy-due",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ai-vendor-privacy-due",{"tool":55,"command":56},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ai-vendor-privacy-due",{"tool":58,"command":59},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ai-vendor-privacy-due","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fai-privacy-governance-skills\u002Fskills\u002Fai-vendor-privacy-due\u002FSKILL.md",true,[63,69,75,79,85],{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"assets\u002Ftemplate.md","ASSET","资产文件",1329,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fai-privacy-governance-skills\u002Fskills\u002Fai-vendor-privacy-due\u002Fassets\u002Ftemplate.md",{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fstandards.md","REFERENCE","参考文档",1621,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fai-privacy-governance-skills\u002Fskills\u002Fai-vendor-privacy-due\u002Freferences\u002Fstandards.md",{"path":76,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fworkflows.md",2959,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fai-privacy-governance-skills\u002Fskills\u002Fai-vendor-privacy-due\u002Freferences\u002Fworkflows.md",{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"scripts\u002Fprocess.py","SCRIPT","脚本",8057,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fai-privacy-governance-skills\u002Fskills\u002Fai-vendor-privacy-due\u002Fscripts\u002Fprocess.py",{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"SKILL.md.tmpl","OTHER","其他",11561,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Finvestigate\u002FSKILL.md.tmpl",[92,119,136,149,165,178],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":109,"publishedAt":31},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[98,101,104],{"categoryNo":99,"categoryName":100,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":102,"categoryName":103,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":105,"categoryName":106,"taxonomyType":107,"taxonomyTypeDesc":108},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[110,111,24,112,113,114,115,116,117,118],"email","workplace email privacy","compliance","content","data","policy","testing","monitoring","metadata",{"skillNo":120,"name":121,"nameZh":6,"description":122,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":123,"categories":124,"keywords":129,"publishedAt":31},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[125,128],{"categoryNo":126,"categoryName":127,"taxonomyType":107,"taxonomyTypeDesc":108},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":105,"categoryName":106,"taxonomyType":107,"taxonomyTypeDesc":108},[114,130,131,132,112,133,134,24,135],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":143,"publishedAt":31},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[142],{"categoryNo":126,"categoryName":127,"taxonomyType":107,"taxonomyTypeDesc":108},[114,144,145,146,147,134,24,148],"vendor termination data","planning","verification","extraction","certification",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":31},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[155],{"categoryNo":126,"categoryName":127,"taxonomyType":107,"taxonomyTypeDesc":108},[157,158,159,160,161,28,162,163,24,114,164],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","transfer","certifications","processor",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":31},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[171],{"categoryNo":105,"categoryName":106,"taxonomyType":107,"taxonomyTypeDesc":108},[24,173,134,174,28,175,176,114,164,158,148,177],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":191,"publishedAt":31},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[184,187,190],{"categoryNo":185,"categoryName":186,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":188,"categoryName":189,"taxonomyType":107,"taxonomyTypeDesc":108},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":105,"categoryName":106,"taxonomyType":107,"taxonomyTypeDesc":108},[192,193,24,194,146,195,112,134,196,164,197,198,199,145],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]