[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE6VMM5RPM3TBBSTWFK84C":3,"skill-same:01M6AE6VMM5RPM3TBBSTWFK84C":111},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":37,"publishedAt":53,"linkOnly":54,"markdownContent":55,"markdownBody":56,"frontMatter":57,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":6,"ownerHtmlUrl":67,"ownerBlogUrl":68,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M6AE6VMM5RPM3TBBSTWFK84C","continuous-compliance",null,"Guides continuous privacy compliance monitoring implementation including automated control testing, evidence collection automation, real-time compliance dashboards, alert-based remediation workflows, regulatory change integration, and deviation management. Covers GRC platform configuration, control framework mapping, and compliance-as-code approaches. Keywords: continuous compliance, automated monitoring, evidence collection, dashboard, regulatory change, compliance-as-code.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",337,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-audit-skills\u002Fskills\u002Fcontinuous-compliance\u002FSKILL.md",[18,23,26,29,34],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":27,"categoryName":28,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":35,"categoryName":36,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000037","律师与法务",[38,39,40,41,42,43,44,45,46,47,48,49,50,51,52],"compliance","continuous compliance","testing","dashboard","automation","workflows","change","code","framework","audit","integration","monitoring","privacy","evidence-collection","remediation","2026-11-10 10:12:30",false,"---\nname: continuous-compliance\ndescription: >-\n  Guides continuous privacy compliance monitoring implementation including automated\n  control testing, evidence collection automation, real-time compliance dashboards,\n  alert-based remediation workflows, regulatory change integration, and deviation\n  management. Covers GRC platform configuration, control framework mapping, and\n  compliance-as-code approaches. Keywords: continuous compliance, automated monitoring,\n  evidence collection, dashboard, regulatory change, compliance-as-code.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: privacy-audit-certification\n  tags: \"continuous-compliance, automated-monitoring, evidence-collection, dashboard, regulatory-change\"\n---\n\n# Continuous Privacy Compliance Monitoring\n\n## Overview\n\nContinuous compliance monitoring replaces the traditional point-in-time audit model with an ongoing, automated approach to verifying that privacy controls are operating effectively. Rather than discovering compliance gaps during annual audits, continuous monitoring provides real-time visibility into control performance, enabling immediate remediation before gaps become regulatory violations or data breaches.\n\nThe shift from periodic to continuous monitoring is driven by several factors: the increasing frequency of regulatory changes (GDPR enforcement guidance, new US state privacy laws, sector-specific regulations), the growing complexity of data ecosystems (cloud, SaaS, APIs, third-party integrations), and supervisory authority expectations for demonstrable accountability under Art. 5(2) GDPR.\n\nSentinel Compliance Group implemented continuous privacy compliance monitoring in 2023, reducing time-to-detect compliance deviations from an average of 94 days (quarterly audit cycle) to 2.3 days (automated monitoring with alert-based triage).\n\n## Architecture\n\n### Three-Layer Monitoring Architecture\n\n```\n┌─────────────────────────────────────────────────────┐\n│                 LAYER 3: REPORTING                   │\n│  Executive Dashboards │ Regulatory Reports │ Alerts  │\n├─────────────────────────────────────────────────────┤\n│               LAYER 2: ANALYSIS                      │\n│  Control Scoring │ Trend Analysis │ Risk Correlation │\n├─────────────────────────────────────────────────────┤\n│             LAYER 1: DATA COLLECTION                 │\n│  Automated Tests │ Evidence Harvest │ External Feeds │\n└─────────────────────────────────────────────────────┘\n```\n\n### Layer 1: Data Collection\n\n**Automated Control Tests** execute pre-defined checks against systems, configurations, and data:\n\n| Test Category | Data Source | Test Examples | Frequency |\n|---------------|-------------|---------------|-----------|\n| Configuration Compliance | Cloud APIs (AWS, Azure, GCP) | Encryption at rest enabled, access logging active, data residency verified | Daily |\n| Access Control | IAM systems (Okta, Azure AD) | Privileged access reviews current, terminated users deprovisioned, RBAC aligned with data classification | Daily |\n| Data Lifecycle | Database metadata, storage systems | Retention periods enforced, deletion jobs executing, backup encryption verified | Daily |\n| Consent Records | CMP platforms (OneTrust, Cookiebot) | Consent records complete, withdrawal honored, opt-out signals processed | Real-time |\n| DSAR Processing | DSAR management system | Open DSARs within SLA, response quality checks, identity verification completed | Daily |\n| Vendor Compliance | Vendor management platform | DPAs current, certifications valid, sub-processor lists updated | Weekly |\n| Training Compliance | LMS (Learning Management System) | Training completion rates, overdue assignments, content currency | Weekly |\n| Policy Currency | Document management system | Policy review dates, approval status, version control | Weekly |\n| Breach Readiness | Incident response tools | Response plan current, tabletop exercise conducted, contact lists updated | Monthly |\n| Transfer Safeguards | Contract management, TIA register | SCCs executed, TIAs current, adequacy decisions monitored | Weekly |\n\n**Evidence Harvesting** automatically collects and timestamps compliance artifacts:\n\n| Evidence Type | Collection Method | Storage | Retention |\n|---------------|-------------------|---------|-----------|\n| System screenshots | Automated screenshot capture via API | Evidence repository with hash verification | 3 years |\n| Configuration exports | API calls to target systems | Versioned configuration store | 3 years |\n| Log extracts | SIEM\u002Flog aggregator queries | Immutable audit log archive | Per regulatory requirement |\n| Consent records | CMP database export | Dedicated consent evidence store | Duration of processing + 5 years |\n| DSAR records | Workflow system export | DSAR archive with access controls | 3 years after request closure |\n| Training records | LMS completion export | HR evidence repository | Employment duration + 2 years |\n| Contract documents | Contract management system | Legal document repository | Contract duration + 6 years |\n\n**External Feeds** ingest regulatory and threat intelligence:\n\n| Feed Type | Source | Purpose |\n|-----------|--------|---------|\n| Regulatory changes | OneTrust DataGuidance, IAPP, Official Journals | Detect new laws, guidance, and enforcement actions |\n| Enforcement actions | Supervisory authority RSS feeds, GDPRhub | Learn from peer enforcement and adjust controls |\n| Vendor risk intelligence | BitSight, SecurityScorecard | Monitor vendor security posture changes |\n| Threat intelligence | CISA, ENISA, sector ISACs | Correlate privacy risks with emerging threats |\n\n### Layer 2: Analysis\n\n**Control Scoring Engine:**\n\nEach control is scored based on automated test results:\n\n| Score | Status | Definition |\n|-------|--------|------------|\n| 100 | Effective | All automated tests pass; evidence is current and complete |\n| 75-99 | Mostly Effective | Minor deviations detected; evidence gaps exist but are non-material |\n| 50-74 | Partially Effective | Material deviations detected; some evidence missing or outdated |\n| 25-49 | Largely Ineffective | Multiple failures; significant evidence gaps; control is not reliably operating |\n| 0-24 | Ineffective | Control is not operating; no evidence of implementation |\n\n**Aggregation Logic:**\n\n- **Control Level**: Average of all test results for that control (weighted by test criticality)\n- **Domain Level**: Weighted average of all control scores within the domain\n- **Regulation Level**: Weighted average of all controls mapped to a specific regulation\n- **Overall Compliance Score**: Weighted average of all domain scores\n\n**Trend Analysis:**\n\n- 7-day rolling average to smooth transient deviations\n- 30-day trend to identify systematic degradation\n- Quarter-over-quarter comparison for management reporting\n- Year-over-year comparison for board reporting\n\n**Risk Correlation:**\n\n- Cross-reference control failures with data sensitivity classifications\n- Correlate compliance deviations with recent system changes\n- Map control failures to regulatory exposure (which regulations are affected)\n- Identify compounding risks (multiple control failures in the same data flow)\n\n### Layer 3: Reporting\n\n**Real-Time Dashboards:**\n\n| Dashboard | Audience | Content | Refresh Rate |\n|-----------|----------|---------|--------------|\n| Privacy Operations | Privacy team | Control-level scores, open deviations, DSAR metrics, vendor status | Real-time |\n| Executive Privacy | CPO, CISO, CLO | Domain-level scores, trend analysis, top risks, regulatory exposure | Daily |\n| Board Privacy | Board\u002FAudit Committee | Overall compliance score, year-over-year trend, peer benchmarking, material incidents | Quarterly |\n| Regulatory | DPO, Legal | Regulation-specific scores, gap details, enforcement tracker | Weekly |\n| Vendor | Procurement, Third-Party Risk | Vendor compliance scores, DPA status, certification expiry | Weekly |\n\n## Automated Control Testing\n\n### Control Testing Framework\n\nFor each privacy control, define:\n\n```yaml\ncontrol_id: PCC-DSAR-001\ncontrol_name: DSAR Response Timeliness\nregulation_mapping:\n  - GDPR Art. 12(3)\n  - CCPA Section 1798.130(a)(2)\n  - LGPD Art. 18\ndomain: Data Subject Rights\ntest_definition:\n  test_type: data_query\n  data_source: dsar_management_system\n  query: |\n    SELECT request_id, received_date, response_date,\n           DATEDIFF(day, received_date, COALESCE(response_date, GETDATE())) as days_elapsed,\n           jurisdiction, status\n    FROM dsar_requests\n    WHERE status IN ('open', 'in_progress', 'completed')\n      AND received_date >= DATEADD(day, -90, GETDATE())\n  pass_criteria:\n    - field: days_elapsed\n      condition: less_than_or_equal\n      value: 30\n      filter: \"jurisdiction = 'GDPR' AND status != 'completed'\"\n    - field: days_elapsed\n      condition: less_than_or_equal\n      value: 45\n      filter: \"jurisdiction = 'CCPA' AND status != 'completed'\"\n    - field: days_elapsed\n      condition: less_than_or_equal\n      value: 30\n      filter: \"status = 'completed'\"\n      threshold: 0.95  # 95% of completed requests must meet deadline\n  frequency: daily\n  alert_threshold: 0.90  # Alert if pass rate drops below 90%\n  alert_recipients:\n    - privacy-operations@sentinelcompliance.com\n    - dpo@sentinelcompliance.com\n  evidence_collection:\n    - type: query_result\n      description: Full DSAR status report with elapsed days\n    - type: screenshot\n      description: DSAR dashboard showing current queue status\n```\n\n### Common Automated Test Patterns\n\n#### Configuration Compliance Test\n\n```yaml\ncontrol_id: PCC-ENC-001\ncontrol_name: Database Encryption at Rest\ntest_type: api_check\ndata_source: aws_rds_api\ncheck:\n  api_call: describe_db_instances\n  assertion: StorageEncrypted == true\n  scope: all_instances\nfrequency: daily\nremediation_automation:\n  enabled: true\n  action: create_jira_ticket\n  priority: high\n  assignee: database-team\n```\n\n#### Evidence Currency Test\n\n```yaml\ncontrol_id: PCC-DPA-001\ncontrol_name: DPA Currency\ntest_type: data_query\ndata_source: contract_management_system\nquery: |\n  SELECT vendor_name, dpa_expiry_date,\n         DATEDIFF(day, GETDATE(), dpa_expiry_date) as days_until_expiry\n  FROM vendor_contracts\n  WHERE contract_type = 'DPA' AND status = 'active'\npass_criteria:\n  - field: days_until_expiry\n    condition: greater_than\n    value: 0\n    description: No expired DPAs\nalert_rules:\n  - condition: days_until_expiry \u003C= 30\n    severity: warning\n    message: \"DPA for {vendor_name} expires in {days_until_expiry} days\"\n  - condition: days_until_expiry \u003C= 0\n    severity: critical\n    message: \"DPA for {vendor_name} has expired\"\nfrequency: daily\n```\n\n#### Training Compliance Test\n\n```yaml\ncontrol_id: PCC-TRN-001\ncontrol_name: Privacy Training Completion\ntest_type: api_check\ndata_source: lms_api\ncheck:\n  api_call: get_course_completion\n  course_id: PRIV-001-ANNUAL\n  assertion: completion_rate >= 0.95\n  scope: all_active_employees\nfrequency: weekly\nalert_threshold: 0.90\nescalation:\n  - level: 1\n    condition: completion_rate \u003C 0.95\n    action: notify_manager\n  - level: 2\n    condition: completion_rate \u003C 0.90\n    action: notify_cpo\n  - level: 3\n    condition: completion_rate \u003C 0.80\n    action: notify_audit_committee\n```\n\n## Alert-Based Remediation\n\n### Alert Severity Classification\n\n| Severity | Criteria | Response SLA | Notification |\n|----------|----------|-------------|--------------|\n| Critical | Control failure affecting high-sensitivity data OR regulatory deadline at risk OR active data exposure | 4 hours | CPO, CISO, DPO, Privacy Ops lead — immediate notification via PagerDuty\u002FSlack |\n| High | Control failure affecting personal data OR compliance score below threshold OR vendor DPA expired | 24 hours | Privacy Ops team, control owner — email + Slack notification |\n| Medium | Control degradation (score decrease >10 points) OR evidence gap detected OR training overdue | 72 hours | Control owner — email notification |\n| Low | Minor deviation OR informational alert OR upcoming deadline | 1 week | Control owner — daily digest |\n\n### Remediation Workflow\n\n```\nAlert Triggered\n  ↓\nAuto-Triage (severity classification, deduplication, correlation)\n  ↓\nAlert Assigned to Control Owner\n  ↓\nControl Owner Acknowledges (within SLA)\n  ↓\nRoot Cause Analysis\n  ↓\nRemediation Plan Documented\n  ↓\nRemediation Executed\n  ↓\nAutomated Re-Test\n  ↓\nPass? → Alert Closed → Evidence Archived\n  ↓\nFail? → Escalate → Revised Remediation Plan\n```\n\n### Auto-Remediation\n\nFor specific control failures, automated remediation can be configured:\n\n| Control Failure | Auto-Remediation Action | Human Approval Required |\n|----------------|------------------------|------------------------|\n| Terminated user still has access | Disable account via IAM API | No (immediate) |\n| Encryption disabled on new resource | Enable encryption via cloud API | No (immediate) |\n| Expired DPA detected | Generate renewal notification to vendor manager | Yes (notification only) |\n| Training overdue > 30 days | Send automated reminder to employee and manager | No (notification) |\n| Consent record missing timestamp | Flag record for manual review | Yes (review required) |\n| DSAR approaching SLA deadline | Escalate to privacy operations lead | No (escalation only) |\n\n## Regulatory Change Integration\n\n### Regulatory Change Management Process\n\n```\nExternal Regulatory Feed\n  ↓\nChange Detection (new law, amendment, guidance, enforcement action)\n  ↓\nRelevance Assessment (automated keyword matching + manual review)\n  ↓\nImpact Analysis (which controls, processes, and systems are affected)\n  ↓\nGap Assessment (current compliance vs. new requirement)\n  ↓\nRemediation Planning (control updates, policy changes, system modifications)\n  ↓\nImplementation and Testing\n  ↓\nControl Framework Updated\n  ↓\nMonitoring Rules Adjusted\n```\n\n### Regulatory Change Categories\n\n| Category | Response Timeline | Example |\n|----------|------------------|---------|\n| New regulation enacted | Assessment within 30 days; implementation by effective date | New US state privacy law with 12-month implementation window |\n| Existing regulation amended | Assessment within 14 days; implementation per amendment effective date | GDPR delegated act modifying adequacy decision |\n| Supervisory authority guidance | Assessment within 30 days; implementation within 90 days | EDPB guidelines on consent for cookie walls |\n| Enforcement action (peer) | Lessons-learned review within 14 days; control gap check within 30 days | DPA fine for inadequate DSAR response process |\n| Court decision | Legal review within 14 days; impact assessment within 30 days | CJEU judgment invalidating transfer mechanism |\n\n### Control Framework Versioning\n\nWhen regulatory changes require control updates:\n\n1. Document the regulatory change and its impact on existing controls\n2. Draft updated control definitions and test criteria\n3. Review and approve changes through the privacy governance committee\n4. Update automated test configurations\n5. Re-baseline compliance scores (distinguish between score changes due to new requirements vs. degradation)\n6. Communicate changes to control owners and affected stakeholders\n\n## Compliance-as-Code\n\n### Infrastructure Privacy Compliance\n\nEmbed privacy compliance checks into infrastructure-as-code (IaC) pipelines:\n\n```yaml\n# Example: Terraform compliance policy for data residency\npolicy \"data_residency_eu\" {\n  description = \"Ensure EU personal data is stored in EU regions only\"\n  enforcement_level = \"mandatory\"\n\n  rule \"storage_location\" {\n    condition = resource.aws_s3_bucket.region in [\"eu-west-1\", \"eu-central-1\", \"eu-north-1\"]\n    message   = \"S3 buckets containing EU personal data must be in EU regions\"\n  }\n\n  rule \"encryption_required\" {\n    condition = resource.aws_s3_bucket.server_side_encryption_configuration != null\n    message   = \"S3 buckets containing personal data must have encryption enabled\"\n  }\n\n  rule \"versioning_enabled\" {\n    condition = resource.aws_s3_bucket.versioning[0].enabled == true\n    message   = \"S3 buckets containing personal data must have versioning enabled for audit trail\"\n  }\n\n  rule \"public_access_blocked\" {\n    condition = resource.aws_s3_bucket_public_access_block.block_public_acls == true\n    message   = \"S3 buckets containing personal data must block public access\"\n  }\n}\n```\n\n### Application Privacy Compliance\n\nIntegrate privacy checks into CI\u002FCD pipelines:\n\n| Pipeline Stage | Privacy Check | Blocking? |\n|---------------|---------------|-----------|\n| Code Review | PII detection in code comments, logs, and test data | Yes |\n| Static Analysis | Privacy annotation verification (data classification, retention, purpose) | Yes |\n| Build | Dependency check for privacy-impacting libraries | Warning |\n| Integration Test | Consent enforcement verification, DSAR endpoint testing | Yes |\n| Pre-Deploy | Data residency verification, encryption verification | Yes |\n| Post-Deploy | Privacy header verification, cookie consent verification | Monitoring |\n\n## Dashboard Design\n\n### Executive Dashboard Components\n\n**Overall Compliance Score (large numeric display):**\n- Current score: 94.2%\n- 30-day trend: +1.3%\n- Target: 95%\n\n**Compliance by Regulation (horizontal bar chart):**\n```\nGDPR:         ████████████████████░  96%\nCCPA\u002FCPRA:    ███████████████████░░  93%\nLGPD:         ██████████████████░░░  91%\nPIPA:         ████████████████████░  97%\nUK GDPR:      ███████████████████░░  94%\n```\n\n**Open Deviations by Severity (donut chart):**\n- Critical: 0\n- High: 2\n- Medium: 8\n- Low: 15\n\n**Control Health Heatmap (10x grid, one cell per domain):**\n- Green (>90%): Privacy Governance, Risk Management, Incident Management, Training\n- Yellow (75-90%): Data Inventory, Regulatory, DSR, Consent, Third-Party\n- Red (\u003C75%): None\n- Grey: Privacy by Design (assessment in progress)\n\n**Top 5 Deviations Requiring Attention (table):**\n\n| ID | Control | Score | Days Open | Owner |\n|----|---------|-------|-----------|-------|\n| DEV-2025-089 | Vendor DPA Renewal (Vendor X) | 0 | 12 | Procurement |\n| DEV-2025-091 | DSAR Response SLA (LGPD) | 67 | 5 | Privacy Ops |\n| DEV-2025-088 | Training Completion (Engineering) | 88 | 21 | L&D |\n| DEV-2025-092 | Cookie Consent Banner (FR site) | 72 | 3 | Marketing |\n| DEV-2025-087 | Retention Job Failure (Archive DB) | 50 | 8 | Data Engineering |\n\n## Sentinel Compliance Group Implementation\n\n- **Platform**: OneTrust GRC for compliance management; custom Python automation layer for evidence harvesting; Grafana for dashboards\n- **Controls Monitored**: 312 privacy controls across 10 domains, mapped to GDPR, CCPA\u002FCPRA, LGPD, PIPA, and UK GDPR\n- **Automated Tests**: 478 automated test cases executing daily\u002Fweekly per schedule\n- **Evidence Collection**: 12,400 evidence artifacts automatically collected per quarter\n- **Alert Volume**: Average 23 alerts per week (2 high, 7 medium, 14 low); average resolution time: 2.3 days\n- **Overall Compliance Score**: 94.2% (December 2024), up from 87.1% at program launch (January 2024)\n- **Audit Impact**: External auditors (SOC 2 and ISO 27701) accepted continuous monitoring evidence, reducing audit fieldwork by 30%\n- **Regulatory Changes Processed**: 47 regulatory changes assessed in 2024; 12 required control updates; average time from change detection to control update: 18 days\n","# Continuous Privacy Compliance Monitoring\n\n## Overview\n\nContinuous compliance monitoring replaces the traditional point-in-time audit model with an ongoing, automated approach to verifying that privacy controls are operating effectively. Rather than discovering compliance gaps during annual audits, continuous monitoring provides real-time visibility into control performance, enabling immediate remediation before gaps become regulatory violations or data breaches.\n\nThe shift from periodic to continuous monitoring is driven by several factors: the increasing frequency of regulatory changes (GDPR enforcement guidance, new US state privacy laws, sector-specific regulations), the growing complexity of data ecosystems (cloud, SaaS, APIs, third-party integrations), and supervisory authority expectations for demonstrable accountability under Art. 5(2) GDPR.\n\nSentinel Compliance Group implemented continuous privacy compliance monitoring in 2023, reducing time-to-detect compliance deviations from an average of 94 days (quarterly audit cycle) to 2.3 days (automated monitoring with alert-based triage).\n\n## Architecture\n\n### Three-Layer Monitoring Architecture\n\n```\n┌─────────────────────────────────────────────────────┐\n│                 LAYER 3: REPORTING                   │\n│  Executive Dashboards │ Regulatory Reports │ Alerts  │\n├─────────────────────────────────────────────────────┤\n│               LAYER 2: ANALYSIS                      │\n│  Control Scoring │ Trend Analysis │ Risk Correlation │\n├─────────────────────────────────────────────────────┤\n│             LAYER 1: DATA COLLECTION                 │\n│  Automated Tests │ Evidence Harvest │ External Feeds │\n└─────────────────────────────────────────────────────┘\n```\n\n### Layer 1: Data Collection\n\n**Automated Control Tests** execute pre-defined checks against systems, configurations, and data:\n\n| Test Category | Data Source | Test Examples | Frequency |\n|---------------|-------------|---------------|-----------|\n| Configuration Compliance | Cloud APIs (AWS, Azure, GCP) | Encryption at rest enabled, access logging active, data residency verified | Daily |\n| Access Control | IAM systems (Okta, Azure AD) | Privileged access reviews current, terminated users deprovisioned, RBAC aligned with data classification | Daily |\n| Data Lifecycle | Database metadata, storage systems | Retention periods enforced, deletion jobs executing, backup encryption verified | Daily |\n| Consent Records | CMP platforms (OneTrust, Cookiebot) | Consent records complete, withdrawal honored, opt-out signals processed | Real-time |\n| DSAR Processing | DSAR management system | Open DSARs within SLA, response quality checks, identity verification completed | Daily |\n| Vendor Compliance | Vendor management platform | DPAs current, certifications valid, sub-processor lists updated | Weekly |\n| Training Compliance | LMS (Learning Management System) | Training completion rates, overdue assignments, content currency | Weekly |\n| Policy Currency | Document management system | Policy review dates, approval status, version control | Weekly |\n| Breach Readiness | Incident response tools | Response plan current, tabletop exercise conducted, contact lists updated | Monthly |\n| Transfer Safeguards | Contract management, TIA register | SCCs executed, TIAs current, adequacy decisions monitored | Weekly |\n\n**Evidence Harvesting** automatically collects and timestamps compliance artifacts:\n\n| Evidence Type | Collection Method | Storage | Retention |\n|---------------|-------------------|---------|-----------|\n| System screenshots | Automated screenshot capture via API | Evidence repository with hash verification | 3 years |\n| Configuration exports | API calls to target systems | Versioned configuration store | 3 years |\n| Log extracts | SIEM\u002Flog aggregator queries | Immutable audit log archive | Per regulatory requirement |\n| Consent records | CMP database export | Dedicated consent evidence store | Duration of processing + 5 years |\n| DSAR records | Workflow system export | DSAR archive with access controls | 3 years after request closure |\n| Training records | LMS completion export | HR evidence repository | Employment duration + 2 years |\n| Contract documents | Contract management system | Legal document repository | Contract duration + 6 years |\n\n**External Feeds** ingest regulatory and threat intelligence:\n\n| Feed Type | Source | Purpose |\n|-----------|--------|---------|\n| Regulatory changes | OneTrust DataGuidance, IAPP, Official Journals | Detect new laws, guidance, and enforcement actions |\n| Enforcement actions | Supervisory authority RSS feeds, GDPRhub | Learn from peer enforcement and adjust controls |\n| Vendor risk intelligence | BitSight, SecurityScorecard | Monitor vendor security posture changes |\n| Threat intelligence | CISA, ENISA, sector ISACs | Correlate privacy risks with emerging threats |\n\n### Layer 2: Analysis\n\n**Control Scoring Engine:**\n\nEach control is scored based on automated test results:\n\n| Score | Status | Definition |\n|-------|--------|------------|\n| 100 | Effective | All automated tests pass; evidence is current and complete |\n| 75-99 | Mostly Effective | Minor deviations detected; evidence gaps exist but are non-material |\n| 50-74 | Partially Effective | Material deviations detected; some evidence missing or outdated |\n| 25-49 | Largely Ineffective | Multiple failures; significant evidence gaps; control is not reliably operating |\n| 0-24 | Ineffective | Control is not operating; no evidence of implementation |\n\n**Aggregation Logic:**\n\n- **Control Level**: Average of all test results for that control (weighted by test criticality)\n- **Domain Level**: Weighted average of all control scores within the domain\n- **Regulation Level**: Weighted average of all controls mapped to a specific regulation\n- **Overall Compliance Score**: Weighted average of all domain scores\n\n**Trend Analysis:**\n\n- 7-day rolling average to smooth transient deviations\n- 30-day trend to identify systematic degradation\n- Quarter-over-quarter comparison for management reporting\n- Year-over-year comparison for board reporting\n\n**Risk Correlation:**\n\n- Cross-reference control failures with data sensitivity classifications\n- Correlate compliance deviations with recent system changes\n- Map control failures to regulatory exposure (which regulations are affected)\n- Identify compounding risks (multiple control failures in the same data flow)\n\n### Layer 3: Reporting\n\n**Real-Time Dashboards:**\n\n| Dashboard | Audience | Content | Refresh Rate |\n|-----------|----------|---------|--------------|\n| Privacy Operations | Privacy team | Control-level scores, open deviations, DSAR metrics, vendor status | Real-time |\n| Executive Privacy | CPO, CISO, CLO | Domain-level scores, trend analysis, top risks, regulatory exposure | Daily |\n| Board Privacy | Board\u002FAudit Committee | Overall compliance score, year-over-year trend, peer benchmarking, material incidents | Quarterly |\n| Regulatory | DPO, Legal | Regulation-specific scores, gap details, enforcement tracker | Weekly |\n| Vendor | Procurement, Third-Party Risk | Vendor compliance scores, DPA status, certification expiry | Weekly |\n\n## Automated Control Testing\n\n### Control Testing Framework\n\nFor each privacy control, define:\n\n```yaml\ncontrol_id: PCC-DSAR-001\ncontrol_name: DSAR Response Timeliness\nregulation_mapping:\n  - GDPR Art. 12(3)\n  - CCPA Section 1798.130(a)(2)\n  - LGPD Art. 18\ndomain: Data Subject Rights\ntest_definition:\n  test_type: data_query\n  data_source: dsar_management_system\n  query: |\n    SELECT request_id, received_date, response_date,\n           DATEDIFF(day, received_date, COALESCE(response_date, GETDATE())) as days_elapsed,\n           jurisdiction, status\n    FROM dsar_requests\n    WHERE status IN ('open', 'in_progress', 'completed')\n      AND received_date >= DATEADD(day, -90, GETDATE())\n  pass_criteria:\n    - field: days_elapsed\n      condition: less_than_or_equal\n      value: 30\n      filter: \"jurisdiction = 'GDPR' AND status != 'completed'\"\n    - field: days_elapsed\n      condition: less_than_or_equal\n      value: 45\n      filter: \"jurisdiction = 'CCPA' AND status != 'completed'\"\n    - field: days_elapsed\n      condition: less_than_or_equal\n      value: 30\n      filter: \"status = 'completed'\"\n      threshold: 0.95  # 95% of completed requests must meet deadline\n  frequency: daily\n  alert_threshold: 0.90  # Alert if pass rate drops below 90%\n  alert_recipients:\n    - privacy-operations@sentinelcompliance.com\n    - dpo@sentinelcompliance.com\n  evidence_collection:\n    - type: query_result\n      description: Full DSAR status report with elapsed days\n    - type: screenshot\n      description: DSAR dashboard showing current queue status\n```\n\n### Common Automated Test Patterns\n\n#### Configuration Compliance Test\n\n```yaml\ncontrol_id: PCC-ENC-001\ncontrol_name: Database Encryption at Rest\ntest_type: api_check\ndata_source: aws_rds_api\ncheck:\n  api_call: describe_db_instances\n  assertion: StorageEncrypted == true\n  scope: all_instances\nfrequency: daily\nremediation_automation:\n  enabled: true\n  action: create_jira_ticket\n  priority: high\n  assignee: database-team\n```\n\n#### Evidence Currency Test\n\n```yaml\ncontrol_id: PCC-DPA-001\ncontrol_name: DPA Currency\ntest_type: data_query\ndata_source: contract_management_system\nquery: |\n  SELECT vendor_name, dpa_expiry_date,\n         DATEDIFF(day, GETDATE(), dpa_expiry_date) as days_until_expiry\n  FROM vendor_contracts\n  WHERE contract_type = 'DPA' AND status = 'active'\npass_criteria:\n  - field: days_until_expiry\n    condition: greater_than\n    value: 0\n    description: No expired DPAs\nalert_rules:\n  - condition: days_until_expiry \u003C= 30\n    severity: warning\n    message: \"DPA for {vendor_name} expires in {days_until_expiry} days\"\n  - condition: days_until_expiry \u003C= 0\n    severity: critical\n    message: \"DPA for {vendor_name} has expired\"\nfrequency: daily\n```\n\n#### Training Compliance Test\n\n```yaml\ncontrol_id: PCC-TRN-001\ncontrol_name: Privacy Training Completion\ntest_type: api_check\ndata_source: lms_api\ncheck:\n  api_call: get_course_completion\n  course_id: PRIV-001-ANNUAL\n  assertion: completion_rate >= 0.95\n  scope: all_active_employees\nfrequency: weekly\nalert_threshold: 0.90\nescalation:\n  - level: 1\n    condition: completion_rate \u003C 0.95\n    action: notify_manager\n  - level: 2\n    condition: completion_rate \u003C 0.90\n    action: notify_cpo\n  - level: 3\n    condition: completion_rate \u003C 0.80\n    action: notify_audit_committee\n```\n\n## Alert-Based Remediation\n\n### Alert Severity Classification\n\n| Severity | Criteria | Response SLA | Notification |\n|----------|----------|-------------|--------------|\n| Critical | Control failure affecting high-sensitivity data OR regulatory deadline at risk OR active data exposure | 4 hours | CPO, CISO, DPO, Privacy Ops lead — immediate notification via PagerDuty\u002FSlack |\n| High | Control failure affecting personal data OR compliance score below threshold OR vendor DPA expired | 24 hours | Privacy Ops team, control owner — email + Slack notification |\n| Medium | Control degradation (score decrease >10 points) OR evidence gap detected OR training overdue | 72 hours | Control owner — email notification |\n| Low | Minor deviation OR informational alert OR upcoming deadline | 1 week | Control owner — daily digest |\n\n### Remediation Workflow\n\n```\nAlert Triggered\n  ↓\nAuto-Triage (severity classification, deduplication, correlation)\n  ↓\nAlert Assigned to Control Owner\n  ↓\nControl Owner Acknowledges (within SLA)\n  ↓\nRoot Cause Analysis\n  ↓\nRemediation Plan Documented\n  ↓\nRemediation Executed\n  ↓\nAutomated Re-Test\n  ↓\nPass? → Alert Closed → Evidence Archived\n  ↓\nFail? → Escalate → Revised Remediation Plan\n```\n\n### Auto-Remediation\n\nFor specific control failures, automated remediation can be configured:\n\n| Control Failure | Auto-Remediation Action | Human Approval Required |\n|----------------|------------------------|------------------------|\n| Terminated user still has access | Disable account via IAM API | No (immediate) |\n| Encryption disabled on new resource | Enable encryption via cloud API | No (immediate) |\n| Expired DPA detected | Generate renewal notification to vendor manager | Yes (notification only) |\n| Training overdue > 30 days | Send automated reminder to employee and manager | No (notification) |\n| Consent record missing timestamp | Flag record for manual review | Yes (review required) |\n| DSAR approaching SLA deadline | Escalate to privacy operations lead | No (escalation only) |\n\n## Regulatory Change Integration\n\n### Regulatory Change Management Process\n\n```\nExternal Regulatory Feed\n  ↓\nChange Detection (new law, amendment, guidance, enforcement action)\n  ↓\nRelevance Assessment (automated keyword matching + manual review)\n  ↓\nImpact Analysis (which controls, processes, and systems are affected)\n  ↓\nGap Assessment (current compliance vs. new requirement)\n  ↓\nRemediation Planning (control updates, policy changes, system modifications)\n  ↓\nImplementation and Testing\n  ↓\nControl Framework Updated\n  ↓\nMonitoring Rules Adjusted\n```\n\n### Regulatory Change Categories\n\n| Category | Response Timeline | Example |\n|----------|------------------|---------|\n| New regulation enacted | Assessment within 30 days; implementation by effective date | New US state privacy law with 12-month implementation window |\n| Existing regulation amended | Assessment within 14 days; implementation per amendment effective date | GDPR delegated act modifying adequacy decision |\n| Supervisory authority guidance | Assessment within 30 days; implementation within 90 days | EDPB guidelines on consent for cookie walls |\n| Enforcement action (peer) | Lessons-learned review within 14 days; control gap check within 30 days | DPA fine for inadequate DSAR response process |\n| Court decision | Legal review within 14 days; impact assessment within 30 days | CJEU judgment invalidating transfer mechanism |\n\n### Control Framework Versioning\n\nWhen regulatory changes require control updates:\n\n1. Document the regulatory change and its impact on existing controls\n2. Draft updated control definitions and test criteria\n3. Review and approve changes through the privacy governance committee\n4. Update automated test configurations\n5. Re-baseline compliance scores (distinguish between score changes due to new requirements vs. degradation)\n6. Communicate changes to control owners and affected stakeholders\n\n## Compliance-as-Code\n\n### Infrastructure Privacy Compliance\n\nEmbed privacy compliance checks into infrastructure-as-code (IaC) pipelines:\n\n```yaml\n# Example: Terraform compliance policy for data residency\npolicy \"data_residency_eu\" {\n  description = \"Ensure EU personal data is stored in EU regions only\"\n  enforcement_level = \"mandatory\"\n\n  rule \"storage_location\" {\n    condition = resource.aws_s3_bucket.region in [\"eu-west-1\", \"eu-central-1\", \"eu-north-1\"]\n    message   = \"S3 buckets containing EU personal data must be in EU regions\"\n  }\n\n  rule \"encryption_required\" {\n    condition = resource.aws_s3_bucket.server_side_encryption_configuration != null\n    message   = \"S3 buckets containing personal data must have encryption enabled\"\n  }\n\n  rule \"versioning_enabled\" {\n    condition = resource.aws_s3_bucket.versioning[0].enabled == true\n    message   = \"S3 buckets containing personal data must have versioning enabled for audit trail\"\n  }\n\n  rule \"public_access_blocked\" {\n    condition = resource.aws_s3_bucket_public_access_block.block_public_acls == true\n    message   = \"S3 buckets containing personal data must block public access\"\n  }\n}\n```\n\n### Application Privacy Compliance\n\nIntegrate privacy checks into CI\u002FCD pipelines:\n\n| Pipeline Stage | Privacy Check | Blocking? |\n|---------------|---------------|-----------|\n| Code Review | PII detection in code comments, logs, and test data | Yes |\n| Static Analysis | Privacy annotation verification (data classification, retention, purpose) | Yes |\n| Build | Dependency check for privacy-impacting libraries | Warning |\n| Integration Test | Consent enforcement verification, DSAR endpoint testing | Yes |\n| Pre-Deploy | Data residency verification, encryption verification | Yes |\n| Post-Deploy | Privacy header verification, cookie consent verification | Monitoring |\n\n## Dashboard Design\n\n### Executive Dashboard Components\n\n**Overall Compliance Score (large numeric display):**\n- Current score: 94.2%\n- 30-day trend: +1.3%\n- Target: 95%\n\n**Compliance by Regulation (horizontal bar chart):**\n```\nGDPR:         ████████████████████░  96%\nCCPA\u002FCPRA:    ███████████████████░░  93%\nLGPD:         ██████████████████░░░  91%\nPIPA:         ████████████████████░  97%\nUK GDPR:      ███████████████████░░  94%\n```\n\n**Open Deviations by Severity (donut chart):**\n- Critical: 0\n- High: 2\n- Medium: 8\n- Low: 15\n\n**Control Health Heatmap (10x grid, one cell per domain):**\n- Green (>90%): Privacy Governance, Risk Management, Incident Management, Training\n- Yellow (75-90%): Data Inventory, Regulatory, DSR, Consent, Third-Party\n- Red (\u003C75%): None\n- Grey: Privacy by Design (assessment in progress)\n\n**Top 5 Deviations Requiring Attention (table):**\n\n| ID | Control | Score | Days Open | Owner |\n|----|---------|-------|-----------|-------|\n| DEV-2025-089 | Vendor DPA Renewal (Vendor X) | 0 | 12 | Procurement |\n| DEV-2025-091 | DSAR Response SLA (LGPD) | 67 | 5 | Privacy Ops |\n| DEV-2025-088 | Training Completion (Engineering) | 88 | 21 | L&D |\n| DEV-2025-092 | Cookie Consent Banner (FR site) | 72 | 3 | Marketing |\n| DEV-2025-087 | Retention Job Failure (Archive DB) | 50 | 8 | Data Engineering |\n\n## Sentinel Compliance Group Implementation\n\n- **Platform**: OneTrust GRC for compliance management; custom Python automation layer for evidence harvesting; Grafana for dashboards\n- **Controls Monitored**: 312 privacy controls across 10 domains, mapped to GDPR, CCPA\u002FCPRA, LGPD, PIPA, and UK GDPR\n- **Automated Tests**: 478 automated test cases executing daily\u002Fweekly per schedule\n- **Evidence Collection**: 12,400 evidence artifacts automatically collected per quarter\n- **Alert Volume**: Average 23 alerts per week (2 high, 7 medium, 14 low); average resolution time: 2.3 days\n- **Overall Compliance Score**: 94.2% (December 2024), up from 87.1% at program launch (January 2024)\n- **Audit Impact**: External auditors (SOC 2 and ISO 27701) accepted continuous monitoring evidence, reducing audit fieldwork by 30%\n- **Regulatory Changes Processed**: 47 regulatory changes assessed in 2024; 12 required control updates; average time from change detection to control update: 18 days\n",{"name":5,"license":15,"metadata":58,"description":7},{"tags":59,"author":9,"domain":50,"version":60,"subdomain":61},"continuous-compliance, automated-monitoring, evidence-collection, dashboard, regulatory-change","1.0","privacy-audit-certification","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-audit-skills\u002Fskills\u002Fcontinuous-compliance",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill continuous-compliance",{"tool":77,"command":78},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill continuous-compliance",{"tool":80,"command":81},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill continuous-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-audit-skills\u002Fskills\u002Fcontinuous-compliance\u002FSKILL.md",true,[85,91,97,101,105],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"assets\u002Ftemplate.md","ASSET","资产文件",1585,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-audit-skills\u002Fskills\u002Fcontinuous-compliance\u002Fassets\u002Ftemplate.md",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fexample.md","REFERENCE","参考文档",2197,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fpre-mortem\u002Freferences\u002Fexample.md",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fstandards.md",1771,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-audit-skills\u002Fskills\u002Fcontinuous-compliance\u002Freferences\u002Fstandards.md",{"path":102,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fworkflows.md",2615,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-audit-skills\u002Fskills\u002Fcontinuous-compliance\u002Freferences\u002Fworkflows.md",{"path":106,"resourceType":107,"resourceTypeDesc":108,"sizeBytes":109,"sourceHtmlUrl":110},"scripts\u002Fprocess.py","SCRIPT","脚本",8311,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-audit-skills\u002Fskills\u002Fcontinuous-compliance\u002Fscripts\u002Fprocess.py",[112,130,145,158,175,188],{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":123,"publishedAt":53},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[118,121,122],{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":35,"categoryName":36,"taxonomyType":32,"taxonomyTypeDesc":33},[124,125,50,38,126,127,128,40,49,129],"email","workplace email privacy","content","data","policy","metadata",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":138,"publishedAt":53},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[136,137],{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},{"categoryNo":35,"categoryName":36,"taxonomyType":32,"taxonomyTypeDesc":33},[127,139,140,141,38,142,143,50,144],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":53},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[151],{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},[127,153,154,155,156,143,50,157],"vendor termination data","planning","verification","extraction","certification",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":53},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[164],{"categoryNo":30,"categoryName":31,"taxonomyType":32,"taxonomyTypeDesc":33},[166,167,168,169,170,171,172,173,50,127,174],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":182,"publishedAt":53},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[181],{"categoryNo":35,"categoryName":36,"taxonomyType":32,"taxonomyTypeDesc":33},[50,183,143,184,171,185,186,127,174,167,157,187],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":201,"publishedAt":53},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[194,197,200],{"categoryNo":195,"categoryName":196,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":198,"categoryName":199,"taxonomyType":32,"taxonomyTypeDesc":33},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":35,"categoryName":36,"taxonomyType":32,"taxonomyTypeDesc":33},[202,47,50,203,155,204,38,143,52,174,205,206,207,154],"vendor privacy audit","report","audit report","collection","remediation-tracking","classification"]