[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE3QASQMSDF2V108M99Y3C":3,"skill-same:01M6AE3QASQMSDF2V108M99Y3C":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M6AE3QASQMSDF2V108M99Y3C","gdpr-prior-consultation",null,"Guides the GDPR Article 36 prior consultation process with supervisory authorities when a DPIA indicates high residual risk. Covers timeline requirements, documentation, and outcome handling. Activate when DPIA residual risk remains high or when preparing regulatory submissions. Keywords: prior consultation, Article 36, DPIA, high risk, supervisory authority.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-prior-consultation\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[29,30,31,32,33,34,35],"gdpr","gdpr prior consultation","documentation","compliance","privacy","dpia","supervisory-authority","2026-11-10 10:12:30",false,"---\nname: gdpr-prior-consultation\ndescription: >-\n  Guides the GDPR Article 36 prior consultation process with supervisory\n  authorities when a DPIA indicates high residual risk. Covers timeline\n  requirements, documentation, and outcome handling. Activate when DPIA residual\n  risk remains high or when preparing regulatory submissions. Keywords: prior\n  consultation, Article 36, DPIA, high risk, supervisory authority.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: gdpr-compliance\n  tags: \"gdpr, prior-consultation, article-36, dpia, high-risk, supervisory-authority\"\n---\n\n# Conducting Prior Consultation Process\n\n## Overview\n\nArticle 36 requires controllers to consult the supervisory authority prior to processing where a DPIA under Art. 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, and the controller is unable to sufficiently mitigate that risk.\n\n## When Prior Consultation Is Required\n\nPrior consultation is mandatory when all of the following conditions are met:\n1. A DPIA has been conducted under Art. 35.\n2. The DPIA identifies high risks to data subjects' rights and freedoms.\n3. All reasonably available mitigation measures have been applied.\n4. Residual risk remains high despite mitigation efforts.\n\n## Required Documentation (Art. 36(3))\n\nThe controller must provide:\n1. Respective responsibilities of controller, joint controllers, and processors\n2. Purposes and means of the intended processing\n3. Measures and safeguards to protect data subjects\n4. DPO contact details\n5. The completed DPIA under Art. 35\n6. Any other information the authority requests\n\n## Timeline\n\n| Phase | Duration | Reference |\n|-------|----------|-----------|\n| Authority initial response period | 8 weeks from receipt | Art. 36(2) |\n| Extension for complex cases | Up to 6 additional weeks | Art. 36(2) |\n| Maximum total period | 14 weeks | Art. 36(2) |\n| Processing commencement | Only after advice received or deadline expired | Art. 36(2) |\n\n## Consultation Process\n\n### Step 1: Pre-Submission Preparation\n1. Verify the DPIA is complete with all Art. 35(7) mandatory elements.\n2. Confirm all available mitigation measures have been documented.\n3. Document why residual risk remains high despite mitigation.\n4. Obtain DPO review and sign-off.\n5. Prepare the submission package with all Art. 36(3) documents.\n\n### Step 2: Submission\n1. Submit to the competent supervisory authority (lead authority for cross-border processing under Art. 56).\n2. Use the authority's prescribed format if available.\n3. Retain proof of submission with date stamp.\n\n### Step 3: Authority Engagement\n1. Respond promptly to requests for additional information.\n2. Track the 8-week deadline and any extension notifications.\n3. Do not commence processing until advice is received or deadline expires.\n\n### Step 4: Outcome Handling\n\n| Outcome | Action |\n|---------|--------|\n| Authority approves | Proceed subject to any conditions specified |\n| Authority provides recommendations | Implement recommendations, document compliance |\n| Authority objects or restricts | Do not proceed; revise processing design; resubmit if appropriate |\n| No response within deadline | Document that consultation was submitted and deadline expired; may proceed |\n\n## Member State Variations\n\nArt. 36(5) permits Member State law to require prior consultation for processing in the public interest, including social protection and public health. Controllers must check local implementing legislation.\n\n## Common Reasons for Triggering Prior Consultation\n\n- Large-scale biometric identification systems\n- Systematic public area surveillance with facial recognition\n- Processing of genetic data at population scale\n- Automated decision-making with legal or similarly significant effects where mitigation is insufficient\n- Novel technology processing with unpredictable risk profiles\n","# Conducting Prior Consultation Process\n\n## Overview\n\nArticle 36 requires controllers to consult the supervisory authority prior to processing where a DPIA under Art. 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk, and the controller is unable to sufficiently mitigate that risk.\n\n## When Prior Consultation Is Required\n\nPrior consultation is mandatory when all of the following conditions are met:\n1. A DPIA has been conducted under Art. 35.\n2. The DPIA identifies high risks to data subjects' rights and freedoms.\n3. All reasonably available mitigation measures have been applied.\n4. Residual risk remains high despite mitigation efforts.\n\n## Required Documentation (Art. 36(3))\n\nThe controller must provide:\n1. Respective responsibilities of controller, joint controllers, and processors\n2. Purposes and means of the intended processing\n3. Measures and safeguards to protect data subjects\n4. DPO contact details\n5. The completed DPIA under Art. 35\n6. Any other information the authority requests\n\n## Timeline\n\n| Phase | Duration | Reference |\n|-------|----------|-----------|\n| Authority initial response period | 8 weeks from receipt | Art. 36(2) |\n| Extension for complex cases | Up to 6 additional weeks | Art. 36(2) |\n| Maximum total period | 14 weeks | Art. 36(2) |\n| Processing commencement | Only after advice received or deadline expired | Art. 36(2) |\n\n## Consultation Process\n\n### Step 1: Pre-Submission Preparation\n1. Verify the DPIA is complete with all Art. 35(7) mandatory elements.\n2. Confirm all available mitigation measures have been documented.\n3. Document why residual risk remains high despite mitigation.\n4. Obtain DPO review and sign-off.\n5. Prepare the submission package with all Art. 36(3) documents.\n\n### Step 2: Submission\n1. Submit to the competent supervisory authority (lead authority for cross-border processing under Art. 56).\n2. Use the authority's prescribed format if available.\n3. Retain proof of submission with date stamp.\n\n### Step 3: Authority Engagement\n1. Respond promptly to requests for additional information.\n2. Track the 8-week deadline and any extension notifications.\n3. Do not commence processing until advice is received or deadline expires.\n\n### Step 4: Outcome Handling\n\n| Outcome | Action |\n|---------|--------|\n| Authority approves | Proceed subject to any conditions specified |\n| Authority provides recommendations | Implement recommendations, document compliance |\n| Authority objects or restricts | Do not proceed; revise processing design; resubmit if appropriate |\n| No response within deadline | Document that consultation was submitted and deadline expired; may proceed |\n\n## Member State Variations\n\nArt. 36(5) permits Member State law to require prior consultation for processing in the public interest, including social protection and public health. Controllers must check local implementing legislation.\n\n## Common Reasons for Triggering Prior Consultation\n\n- Large-scale biometric identification systems\n- Systematic public area surveillance with facial recognition\n- Processing of genetic data at population scale\n- Automated decision-making with legal or similarly significant effects where mitigation is insufficient\n- Novel technology processing with unpredictable risk profiles\n",{"name":5,"license":15,"metadata":41,"description":7},{"tags":42,"author":9,"domain":33,"version":43,"subdomain":44},"gdpr, prior-consultation, article-36, dpia, high-risk, supervisory-authority","1.0","gdpr-compliance","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-prior-consultation",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill gdpr-prior-consultation",{"tool":60,"command":61},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill gdpr-prior-consultation",{"tool":63,"command":64},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill gdpr-prior-consultation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-prior-consultation\u002FSKILL.md",true,[68,74,80,84,88,92,96],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"assets\u002Ftemplate.md","ASSET","资产文件",3806,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-prior-consultation\u002Fassets\u002Ftemplate.md",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Flark-vc-notes.md","REFERENCE","参考文档",5950,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Flark-vc\u002Freferences\u002Flark-vc-notes.md",{"path":81,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Flark-vc-recording.md",5788,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Flark-vc\u002Freferences\u002Flark-vc-recording.md",{"path":85,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Flark-vc-search.md",9083,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Flark-vc\u002Freferences\u002Flark-vc-search.md",{"path":89,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fstandards.md",2215,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-prior-consultation\u002Freferences\u002Fstandards.md",{"path":93,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fworkflows.md",1658,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-prior-consultation\u002Freferences\u002Fworkflows.md",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fprocess.py","SCRIPT","脚本",4896,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fgdpr-compliance-skills\u002Fskills\u002Fgdpr-prior-consultation\u002Fscripts\u002Fprocess.py",[103,127,143,156,173,186],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":118,"publishedAt":36},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[109,112,115],{"categoryNo":110,"categoryName":111,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":116,"categoryName":117,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务",[119,120,33,32,121,122,123,124,125,126],"email","workplace email privacy","content","data","policy","testing","monitoring","metadata",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":137,"publishedAt":36},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[133,136],{"categoryNo":134,"categoryName":135,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":116,"categoryName":117,"taxonomyType":26,"taxonomyTypeDesc":27},[122,138,139,140,32,141,29,33,142],"whistleblower data","identity","reporting","data protection","prevention",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":36},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[149],{"categoryNo":134,"categoryName":135,"taxonomyType":26,"taxonomyTypeDesc":27},[122,151,152,153,154,29,33,155],"vendor termination data","planning","verification","extraction","certification",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":36},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[162],{"categoryNo":134,"categoryName":135,"taxonomyType":26,"taxonomyTypeDesc":27},[164,165,166,167,168,169,170,171,33,122,172],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":180,"publishedAt":36},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[179],{"categoryNo":116,"categoryName":117,"taxonomyType":26,"taxonomyTypeDesc":27},[33,181,29,182,169,183,184,122,172,165,155,185],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":195,"publishedAt":36},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[192,193,194],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},{"categoryNo":116,"categoryName":117,"taxonomyType":26,"taxonomyTypeDesc":27},[196,197,33,198,153,199,32,29,200,172,201,202,203,152],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]