[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE2NKZ7H828S5XVCSPZB87":3,"skill-same:01M6AE2NKZ7H828S5XVCSPZB87":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6AE2NKZ7H828S5XVCSPZB87","gdpr-accountability",null,"Guides implementation of the GDPR accountability principle under Articles 5(2) and 24, including documentation requirements for policies, DPIAs, RoPA, training records, and breach logs. Activate when establishing or reviewing accountability measures, preparing evidence portfolios, or demonstrating compliance to supervisory authorities. Keywords: accountability, Article 5(2), Article 24, documentation, compliance evidence, governance.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-accountability\u002FSKILL.md",[18,23,28],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务",[32,33,34,35,36,37,38,39],"gdpr","gdpr accountability","documentation","governance","training","logs","compliance","privacy","2026-11-10 10:12:30",false,"---\nname: gdpr-accountability\ndescription: >-\n  Guides implementation of the GDPR accountability principle under Articles 5(2)\n  and 24, including documentation requirements for policies, DPIAs, RoPA, training\n  records, and breach logs. Activate when establishing or reviewing accountability\n  measures, preparing evidence portfolios, or demonstrating compliance to\n  supervisory authorities. Keywords: accountability, Article 5(2), Article 24,\n  documentation, compliance evidence, governance.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: gdpr-compliance\n  tags: \"gdpr, accountability, article-5, article-24, documentation, governance\"\n---\n\n# Implementing GDPR Accountability Framework\n\n## Overview\n\nThe accountability principle under Art. 5(2) requires controllers to not only comply with data protection principles but to demonstrate that compliance. Art. 24 operationalises this by requiring appropriate technical and organisational measures that can prove compliance, reviewed and updated where necessary. This skill provides a complete framework for building and maintaining the accountability evidence portfolio.\n\n## Accountability Documentation Inventory\n\n### Tier 1: Governance Documents\n\n| Document | GDPR Reference | Purpose |\n|----------|---------------|---------|\n| Data Protection Policy | Art. 24(2) | Top-level commitment to data protection principles, approved by senior management |\n| Data Protection Strategy | Art. 24(1) | Multi-year plan for embedding data protection across the organisation |\n| Data Protection Governance Charter | Art. 24(1), 38 | Defines roles, responsibilities, reporting lines, and decision-making authority |\n| DPO Appointment and Terms of Reference | Art. 37-39 | Formal appointment, independence, resources, and reporting line |\n| Data Protection Training Framework | Art. 39(1)(b) | Training curriculum, frequency, target audiences, and assessment criteria |\n\n### Tier 2: Operational Records\n\n| Document | GDPR Reference | Purpose |\n|----------|---------------|---------|\n| Records of Processing Activities (RoPA) | Art. 30 | Comprehensive record of all processing activities with mandatory fields |\n| Lawful Basis Register | Art. 6, 9 | Documented lawful basis assessment for each processing activity |\n| Data Protection Impact Assessments | Art. 35 | Risk assessments for high-risk processing with mitigation measures |\n| Legitimate Interest Assessments | Art. 6(1)(f) | Three-part test documentation for each LI-based processing activity |\n| Data Processing Agreements Register | Art. 28 | Inventory of all processor relationships with DPA status |\n| International Transfer Records | Art. 46-49 | Transfer mechanisms, TIAs, and safeguard documentation |\n| Consent Records | Art. 7 | Evidence of valid consent: who, when, what, and how |\n\n### Tier 3: Incident and Response Records\n\n| Document | GDPR Reference | Purpose |\n|----------|---------------|---------|\n| Personal Data Breach Register | Art. 33(5) | Log of all breaches including those not reported to the supervisory authority |\n| Breach Notification Records | Art. 33-34 | Records of notifications to supervisory authorities and data subjects |\n| Data Subject Rights Request Log | Art. 15-22 | Log of all DSARs with response timelines and outcomes |\n| Complaints Register | Art. 77 | Record of data subject complaints and resolutions |\n\n### Tier 4: Review and Assurance Records\n\n| Document | GDPR Reference | Purpose |\n|----------|---------------|---------|\n| Audit Reports | Art. 24(1) | Internal and external audit findings and remediation tracking |\n| Training Completion Records | Art. 39(1)(b) | Evidence that staff have completed required data protection training |\n| Policy Review Records | Art. 24(1) | Version history and approval records for all policies |\n| DPO Annual Reports | Art. 38(3), 39 | Annual report to board on data protection posture |\n| Risk Register | Art. 24(1), 32 | Data protection risks with likelihood, impact, and treatment plans |\n\n## Implementation Roadmap\n\n### Phase 1: Foundation (Months 1-3)\n\n1. Appoint or confirm the DPO with formal terms of reference and adequate resourcing.\n2. Draft and obtain board approval for the top-level Data Protection Policy.\n3. Establish the Data Protection Governance Charter with defined roles (DPO, steering committee, processing owners, data champions).\n4. Conduct an initial processing activity inventory to populate the RoPA.\n5. Implement a secure document management system for accountability records.\n\n### Phase 2: Operational Documentation (Months 3-6)\n\n1. Complete the RoPA with all Art. 30(1) mandatory fields for each processing activity.\n2. Conduct lawful basis assessments for all processing activities and populate the lawful basis register.\n3. Identify high-risk processing and initiate DPIAs per Art. 35.\n4. Audit all processor relationships and execute Art. 28(3) compliant DPAs.\n5. Document international transfer mechanisms and conduct Transfer Impact Assessments.\n6. Implement consent management with auditable consent records.\n\n### Phase 3: Procedures and Training (Months 6-9)\n\n1. Develop operational procedures for: breach notification, DSAR handling, DPIA process, consent management, data retention enforcement.\n2. Design and deploy the data protection training programme with role-specific modules.\n3. Establish the personal data breach register and incident response procedure.\n4. Create the data subject rights request handling process with SLA tracking.\n5. Test all procedures through tabletop exercises.\n\n### Phase 4: Continuous Compliance (Month 9 onwards)\n\n1. Schedule the first annual data protection audit.\n2. Produce the first DPO annual report for the board.\n3. Implement ongoing monitoring: quarterly RoPA reviews, monthly DSAR metrics, weekly breach register review.\n4. Feed audit findings and incident learnings into policy and procedure updates.\n5. Track regulatory developments and update the framework as required.\n\n## Evidence Portfolio Structure\n\nOrganise accountability evidence in a centralised repository:\n\n```\nAccountability Portfolio\u002F\n├── 01-Governance\u002F\n│   ├── data-protection-policy-v3.2.pdf\n│   ├── governance-charter.pdf\n│   ├── dpo-appointment-letter.pdf\n│   └── board-minutes-dp-reporting.pdf\n├── 02-Processing-Records\u002F\n│   ├── ropa-export-2026-01.xlsx\n│   ├── lawful-basis-register.xlsx\n│   └── consent-records\u002F\n├── 03-Risk-Assessments\u002F\n│   ├── dpias\u002F\n│   ├── lias\u002F\n│   └── transfer-impact-assessments\u002F\n├── 04-Processor-Management\u002F\n│   ├── dpa-register.xlsx\n│   ├── due-diligence-reports\u002F\n│   └── signed-dpas\u002F\n├── 05-Incidents\u002F\n│   ├── breach-register.xlsx\n│   ├── breach-notification-records\u002F\n│   └── dsar-log.xlsx\n├── 06-Training\u002F\n│   ├── training-programme.pdf\n│   └── completion-records\u002F\n├── 07-Audits\u002F\n│   ├── audit-reports\u002F\n│   └── remediation-tracker.xlsx\n└── 08-Annual-Reports\u002F\n    └── dpo-annual-report-2025.pdf\n```\n\n## Maturity Assessment\n\nAssess accountability maturity across five levels:\n\n| Level | Description | Indicators |\n|-------|-------------|-----------|\n| 1 — Ad Hoc | No systematic accountability | Policies absent, no RoPA, no DPO, no training |\n| 2 — Reactive | Basic compliance efforts triggered by incidents or complaints | Some policies exist, RoPA incomplete, training ad hoc |\n| 3 — Defined | Systematic framework established with documented procedures | All Tier 1-2 documents exist, DPO appointed, annual training |\n| 4 — Managed | Framework actively maintained with metrics and monitoring | Regular audits, DSAR tracking, breach register maintained, board reporting |\n| 5 — Optimised | Continuous improvement with proactive risk management | Privacy by design embedded, automated monitoring, predictive risk assessment |\n","# Implementing GDPR Accountability Framework\n\n## Overview\n\nThe accountability principle under Art. 5(2) requires controllers to not only comply with data protection principles but to demonstrate that compliance. Art. 24 operationalises this by requiring appropriate technical and organisational measures that can prove compliance, reviewed and updated where necessary. This skill provides a complete framework for building and maintaining the accountability evidence portfolio.\n\n## Accountability Documentation Inventory\n\n### Tier 1: Governance Documents\n\n| Document | GDPR Reference | Purpose |\n|----------|---------------|---------|\n| Data Protection Policy | Art. 24(2) | Top-level commitment to data protection principles, approved by senior management |\n| Data Protection Strategy | Art. 24(1) | Multi-year plan for embedding data protection across the organisation |\n| Data Protection Governance Charter | Art. 24(1), 38 | Defines roles, responsibilities, reporting lines, and decision-making authority |\n| DPO Appointment and Terms of Reference | Art. 37-39 | Formal appointment, independence, resources, and reporting line |\n| Data Protection Training Framework | Art. 39(1)(b) | Training curriculum, frequency, target audiences, and assessment criteria |\n\n### Tier 2: Operational Records\n\n| Document | GDPR Reference | Purpose |\n|----------|---------------|---------|\n| Records of Processing Activities (RoPA) | Art. 30 | Comprehensive record of all processing activities with mandatory fields |\n| Lawful Basis Register | Art. 6, 9 | Documented lawful basis assessment for each processing activity |\n| Data Protection Impact Assessments | Art. 35 | Risk assessments for high-risk processing with mitigation measures |\n| Legitimate Interest Assessments | Art. 6(1)(f) | Three-part test documentation for each LI-based processing activity |\n| Data Processing Agreements Register | Art. 28 | Inventory of all processor relationships with DPA status |\n| International Transfer Records | Art. 46-49 | Transfer mechanisms, TIAs, and safeguard documentation |\n| Consent Records | Art. 7 | Evidence of valid consent: who, when, what, and how |\n\n### Tier 3: Incident and Response Records\n\n| Document | GDPR Reference | Purpose |\n|----------|---------------|---------|\n| Personal Data Breach Register | Art. 33(5) | Log of all breaches including those not reported to the supervisory authority |\n| Breach Notification Records | Art. 33-34 | Records of notifications to supervisory authorities and data subjects |\n| Data Subject Rights Request Log | Art. 15-22 | Log of all DSARs with response timelines and outcomes |\n| Complaints Register | Art. 77 | Record of data subject complaints and resolutions |\n\n### Tier 4: Review and Assurance Records\n\n| Document | GDPR Reference | Purpose |\n|----------|---------------|---------|\n| Audit Reports | Art. 24(1) | Internal and external audit findings and remediation tracking |\n| Training Completion Records | Art. 39(1)(b) | Evidence that staff have completed required data protection training |\n| Policy Review Records | Art. 24(1) | Version history and approval records for all policies |\n| DPO Annual Reports | Art. 38(3), 39 | Annual report to board on data protection posture |\n| Risk Register | Art. 24(1), 32 | Data protection risks with likelihood, impact, and treatment plans |\n\n## Implementation Roadmap\n\n### Phase 1: Foundation (Months 1-3)\n\n1. Appoint or confirm the DPO with formal terms of reference and adequate resourcing.\n2. Draft and obtain board approval for the top-level Data Protection Policy.\n3. Establish the Data Protection Governance Charter with defined roles (DPO, steering committee, processing owners, data champions).\n4. Conduct an initial processing activity inventory to populate the RoPA.\n5. Implement a secure document management system for accountability records.\n\n### Phase 2: Operational Documentation (Months 3-6)\n\n1. Complete the RoPA with all Art. 30(1) mandatory fields for each processing activity.\n2. Conduct lawful basis assessments for all processing activities and populate the lawful basis register.\n3. Identify high-risk processing and initiate DPIAs per Art. 35.\n4. Audit all processor relationships and execute Art. 28(3) compliant DPAs.\n5. Document international transfer mechanisms and conduct Transfer Impact Assessments.\n6. Implement consent management with auditable consent records.\n\n### Phase 3: Procedures and Training (Months 6-9)\n\n1. Develop operational procedures for: breach notification, DSAR handling, DPIA process, consent management, data retention enforcement.\n2. Design and deploy the data protection training programme with role-specific modules.\n3. Establish the personal data breach register and incident response procedure.\n4. Create the data subject rights request handling process with SLA tracking.\n5. Test all procedures through tabletop exercises.\n\n### Phase 4: Continuous Compliance (Month 9 onwards)\n\n1. Schedule the first annual data protection audit.\n2. Produce the first DPO annual report for the board.\n3. Implement ongoing monitoring: quarterly RoPA reviews, monthly DSAR metrics, weekly breach register review.\n4. Feed audit findings and incident learnings into policy and procedure updates.\n5. Track regulatory developments and update the framework as required.\n\n## Evidence Portfolio Structure\n\nOrganise accountability evidence in a centralised repository:\n\n```\nAccountability Portfolio\u002F\n├── 01-Governance\u002F\n│   ├── data-protection-policy-v3.2.pdf\n│   ├── governance-charter.pdf\n│   ├── dpo-appointment-letter.pdf\n│   └── board-minutes-dp-reporting.pdf\n├── 02-Processing-Records\u002F\n│   ├── ropa-export-2026-01.xlsx\n│   ├── lawful-basis-register.xlsx\n│   └── consent-records\u002F\n├── 03-Risk-Assessments\u002F\n│   ├── dpias\u002F\n│   ├── lias\u002F\n│   └── transfer-impact-assessments\u002F\n├── 04-Processor-Management\u002F\n│   ├── dpa-register.xlsx\n│   ├── due-diligence-reports\u002F\n│   └── signed-dpas\u002F\n├── 05-Incidents\u002F\n│   ├── breach-register.xlsx\n│   ├── breach-notification-records\u002F\n│   └── dsar-log.xlsx\n├── 06-Training\u002F\n│   ├── training-programme.pdf\n│   └── completion-records\u002F\n├── 07-Audits\u002F\n│   ├── audit-reports\u002F\n│   └── remediation-tracker.xlsx\n└── 08-Annual-Reports\u002F\n    └── dpo-annual-report-2025.pdf\n```\n\n## Maturity Assessment\n\nAssess accountability maturity across five levels:\n\n| Level | Description | Indicators |\n|-------|-------------|-----------|\n| 1 — Ad Hoc | No systematic accountability | Policies absent, no RoPA, no DPO, no training |\n| 2 — Reactive | Basic compliance efforts triggered by incidents or complaints | Some policies exist, RoPA incomplete, training ad hoc |\n| 3 — Defined | Systematic framework established with documented procedures | All Tier 1-2 documents exist, DPO appointed, annual training |\n| 4 — Managed | Framework actively maintained with metrics and monitoring | Regular audits, DSAR tracking, breach register maintained, board reporting |\n| 5 — Optimised | Continuous improvement with proactive risk management | Privacy by design embedded, automated monitoring, predictive risk assessment |\n",{"name":5,"license":15,"metadata":45,"description":7},{"tags":46,"author":9,"domain":39,"version":47,"subdomain":48},"gdpr, accountability, article-5, article-24, documentation, governance","1.0","gdpr-compliance","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-accountability",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill gdpr-accountability",{"tool":64,"command":65},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill gdpr-accountability",{"tool":67,"command":68},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill gdpr-accountability","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-accountability\u002FSKILL.md",true,[72,78,84,88],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"assets\u002Ftemplate.md","ASSET","资产文件",4963,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-accountability\u002Fassets\u002Ftemplate.md",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fstandards.md","REFERENCE","参考文档",4232,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-accountability\u002Freferences\u002Fstandards.md",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fworkflows.md",4269,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-accountability\u002Freferences\u002Fworkflows.md",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fprocess.py","SCRIPT","脚本",7967,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-accountability\u002Fscripts\u002Fprocess.py",[95,117,133,146,163,176],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":108,"publishedAt":40},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[101,104,107],{"categoryNo":102,"categoryName":103,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},[109,110,39,38,111,112,113,114,115,116],"email","workplace email privacy","content","data","policy","testing","monitoring","metadata",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":127,"publishedAt":40},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[123,126],{"categoryNo":124,"categoryName":125,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},[112,128,129,130,38,131,32,39,132],"whistleblower data","identity","reporting","data protection","prevention",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":40},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[139],{"categoryNo":124,"categoryName":125,"taxonomyType":26,"taxonomyTypeDesc":27},[112,141,142,143,144,32,39,145],"vendor termination data","planning","verification","extraction","certification",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":40},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[152],{"categoryNo":124,"categoryName":125,"taxonomyType":26,"taxonomyTypeDesc":27},[154,155,156,157,158,159,160,161,39,112,162],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":170,"publishedAt":40},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[169],{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},[39,171,32,172,159,173,174,112,162,155,145,175],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":185,"publishedAt":40},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[182,183,184],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},[186,187,39,188,143,189,38,32,190,162,191,192,193,142],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]