[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEF4F2W8PY7CZF99ZKA4EB":3,"skill-same:01M6AEF4F2W8PY7CZF99ZKA4EB":136},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":58,"updatedAt":59,"install":60,"resources":73},"01M6AEF4F2W8PY7CZF99ZKA4EB","audit-report-writing",null,"Guides privacy audit report writing including executive summary drafting, findings classification (critical, high, medium, low), evidence referencing, root cause analysis documentation, recommendation formulation, management response tracking, and report distribution protocols. Covers report structure from scope definition through appendices and sign-off. Keywords: audit report, findings documentation, executive summary, recommendations, report structure, privacy audit deliverables.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-report-writing\u002FSKILL.md",[18,23,28],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",[32,33,34,35,36,37,38,39,40,41],"writing","report","audit","audit report","audit report writing","documentation","root cause analysis","executive summary","protocols","privacy","2026-11-10 10:12:30",false,"---\nname: audit-report-writing\ndescription: >-\n  Guides privacy audit report writing including executive summary drafting,\n  findings classification (critical, high, medium, low), evidence referencing,\n  root cause analysis documentation, recommendation formulation, management\n  response tracking, and report distribution protocols. Covers report structure\n  from scope definition through appendices and sign-off. Keywords: audit report,\n  findings documentation, executive summary, recommendations, report structure,\n  privacy audit deliverables.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: privacy-audit-certification\n  tags: \"audit-report, findings-documentation, executive-summary, recommendations, report-structure\"\n---\n\n# Privacy Audit Report Writing\n\n## Overview\n\nPrivacy audit report writing is the discipline of translating audit fieldwork into a structured, defensible written deliverable that communicates audit objectives, methodology, findings, and recommendations to stakeholders. A well-crafted audit report serves as the primary vehicle for communicating the state of privacy compliance to governance bodies, management, regulators, and data protection authorities.\n\nUnder GDPR Article 39(1)(b), the Data Protection Officer must monitor compliance including audits, meaning audit reports are a key instrument of DPO oversight. ISO 19011:2018 (Guidelines for auditing management systems) Section 6.6 provides the international standard framework for audit report content and distribution.\n\n## Report Structure\n\n### Standard Sections\n\n| Section | Purpose | Typical Length |\n|---------|---------|---------------|\n| Cover Page | Report identification, classification, distribution list | 1 page |\n| Executive Summary | High-level findings, overall opinion, critical issues | 1-2 pages |\n| Table of Contents | Navigation aid | 1 page |\n| Audit Scope and Objectives | What was audited, boundaries, exclusions | 1-2 pages |\n| Methodology | Audit approach, sampling, tools used | 1-2 pages |\n| Findings and Observations | Detailed findings with evidence, risk rating, root cause | 5-20 pages |\n| Recommendations | Prioritised corrective actions | 2-5 pages |\n| Management Response | Auditee agreement\u002Fdisagreement, action plans, deadlines | 2-5 pages |\n| Appendices | Evidence references, sampling details, interview logs | Variable |\n\n## Findings Classification\n\n### Severity Ratings\n\n| Rating | Definition | Response Timeline |\n|--------|-----------|-------------------|\n| Critical | Material non-compliance creating immediate risk of regulatory enforcement, data breach, or significant harm to data subjects | Immediate remediation; board notification within 24 hours |\n| High | Significant control weakness or non-compliance that could lead to a breach or regulatory action if not addressed | Remediation plan within 14 days; completion within 60 days |\n| Medium | Control deficiency that does not currently pose immediate risk but could deteriorate | Remediation within 90 days |\n| Low | Opportunity for improvement; minor procedural gap | Remediation within 180 days or next audit cycle |\n| Observation | Good practice note or suggestion; not a formal finding | No mandatory action |\n\n## Finding Documentation Format\n\nEach finding should include:\n\n| Element | Description |\n|---------|-------------|\n| Finding ID | Unique identifier (e.g., AUDIT-2026-001) |\n| Title | Concise descriptive title |\n| Condition | What was observed (the current state) |\n| Criteria | What was expected (the standard, policy, or regulation) |\n| Cause | Root cause analysis (why the gap exists) |\n| Effect | Impact or potential impact of the finding |\n| Risk Rating | Critical \u002F High \u002F Medium \u002F Low |\n| Recommendation | Specific corrective action |\n| Management Response | Auditee's response, action plan, responsible owner, deadline |\n| Evidence Reference | Document IDs, screenshots, interview notes |\n\n## Executive Summary Writing\n\nThe executive summary must:\n1. State the audit scope, period, and objectives in one paragraph\n2. Provide an overall compliance opinion (satisfactory, needs improvement, unsatisfactory)\n3. Summarise the distribution of findings by severity\n4. Highlight any critical or high findings requiring immediate attention\n5. Note positive observations and areas of strong compliance\n6. Conclude with the overall risk posture assessment\n\n## Evidence Referencing\n\n### Evidence Types\n\n| Type | Example | Reference Format |\n|------|---------|-----------------|\n| Documentary | Policy documents, procedures, records | DOC-001: \"Data Retention Policy v3.2, dated 15-Jan-2026\" |\n| Testimonial | Interviews, walkthroughs | INT-001: \"Interview with DPO, 10-Mar-2026, 14:00-15:00\" |\n| Analytical | Data analysis, sampling results | ANA-001: \"DSAR response time analysis, Q4 2025\" |\n| Observational | System screenshots, process observation | OBS-001: \"Screenshot of consent banner, captured 12-Mar-2026\" |\n\n## Report Quality Criteria\n\n| Criterion | Standard |\n|-----------|----------|\n| Accuracy | All findings supported by verified evidence; factual errors corrected before issuance |\n| Objectivity | Balanced presentation; positive observations included alongside findings |\n| Clarity | Plain language; technical terms defined; avoid jargon |\n| Completeness | All scope areas addressed; no material omissions |\n| Constructiveness | Recommendations are actionable, specific, and proportionate |\n| Timeliness | Draft report issued within 10 business days of fieldwork completion |\n| Conciseness | No unnecessary repetition; findings are distinct |\n\n## Distribution and Confidentiality\n\n| Classification | Recipients |\n|----------------|-----------|\n| Full Report | Chief Privacy Officer, DPO, Internal Audit Director, auditee management |\n| Executive Summary Only | Board Audit Committee, C-suite |\n| Redacted Version | External regulators (on request), external auditors |\n| Finding-Specific Extracts | Individual finding owners for remediation tracking |\n\n## GDPR and Regulatory Context\n\n| Regulation | Audit Report Relevance |\n|-----------|----------------------|\n| GDPR Article 5(2) | Accountability principle — audit reports demonstrate compliance monitoring |\n| GDPR Article 24 | Controller must implement appropriate measures and be able to demonstrate compliance |\n| GDPR Article 28(3)(h) | Processor must allow and contribute to audits conducted by the controller |\n| GDPR Article 39(1)(b) | DPO must monitor compliance including assignments of responsibilities, awareness-raising, training, and related audits |\n| GDPR Article 47(2)(j) | BCRs must include audit mechanisms |\n| ISO 27701:2019 Section 5.2 | PIMS-specific audit requirements |\n| ISO 19011:2018 Section 6.6 | Preparing and distributing the audit report |\n","# Privacy Audit Report Writing\n\n## Overview\n\nPrivacy audit report writing is the discipline of translating audit fieldwork into a structured, defensible written deliverable that communicates audit objectives, methodology, findings, and recommendations to stakeholders. A well-crafted audit report serves as the primary vehicle for communicating the state of privacy compliance to governance bodies, management, regulators, and data protection authorities.\n\nUnder GDPR Article 39(1)(b), the Data Protection Officer must monitor compliance including audits, meaning audit reports are a key instrument of DPO oversight. ISO 19011:2018 (Guidelines for auditing management systems) Section 6.6 provides the international standard framework for audit report content and distribution.\n\n## Report Structure\n\n### Standard Sections\n\n| Section | Purpose | Typical Length |\n|---------|---------|---------------|\n| Cover Page | Report identification, classification, distribution list | 1 page |\n| Executive Summary | High-level findings, overall opinion, critical issues | 1-2 pages |\n| Table of Contents | Navigation aid | 1 page |\n| Audit Scope and Objectives | What was audited, boundaries, exclusions | 1-2 pages |\n| Methodology | Audit approach, sampling, tools used | 1-2 pages |\n| Findings and Observations | Detailed findings with evidence, risk rating, root cause | 5-20 pages |\n| Recommendations | Prioritised corrective actions | 2-5 pages |\n| Management Response | Auditee agreement\u002Fdisagreement, action plans, deadlines | 2-5 pages |\n| Appendices | Evidence references, sampling details, interview logs | Variable |\n\n## Findings Classification\n\n### Severity Ratings\n\n| Rating | Definition | Response Timeline |\n|--------|-----------|-------------------|\n| Critical | Material non-compliance creating immediate risk of regulatory enforcement, data breach, or significant harm to data subjects | Immediate remediation; board notification within 24 hours |\n| High | Significant control weakness or non-compliance that could lead to a breach or regulatory action if not addressed | Remediation plan within 14 days; completion within 60 days |\n| Medium | Control deficiency that does not currently pose immediate risk but could deteriorate | Remediation within 90 days |\n| Low | Opportunity for improvement; minor procedural gap | Remediation within 180 days or next audit cycle |\n| Observation | Good practice note or suggestion; not a formal finding | No mandatory action |\n\n## Finding Documentation Format\n\nEach finding should include:\n\n| Element | Description |\n|---------|-------------|\n| Finding ID | Unique identifier (e.g., AUDIT-2026-001) |\n| Title | Concise descriptive title |\n| Condition | What was observed (the current state) |\n| Criteria | What was expected (the standard, policy, or regulation) |\n| Cause | Root cause analysis (why the gap exists) |\n| Effect | Impact or potential impact of the finding |\n| Risk Rating | Critical \u002F High \u002F Medium \u002F Low |\n| Recommendation | Specific corrective action |\n| Management Response | Auditee's response, action plan, responsible owner, deadline |\n| Evidence Reference | Document IDs, screenshots, interview notes |\n\n## Executive Summary Writing\n\nThe executive summary must:\n1. State the audit scope, period, and objectives in one paragraph\n2. Provide an overall compliance opinion (satisfactory, needs improvement, unsatisfactory)\n3. Summarise the distribution of findings by severity\n4. Highlight any critical or high findings requiring immediate attention\n5. Note positive observations and areas of strong compliance\n6. Conclude with the overall risk posture assessment\n\n## Evidence Referencing\n\n### Evidence Types\n\n| Type | Example | Reference Format |\n|------|---------|-----------------|\n| Documentary | Policy documents, procedures, records | DOC-001: \"Data Retention Policy v3.2, dated 15-Jan-2026\" |\n| Testimonial | Interviews, walkthroughs | INT-001: \"Interview with DPO, 10-Mar-2026, 14:00-15:00\" |\n| Analytical | Data analysis, sampling results | ANA-001: \"DSAR response time analysis, Q4 2025\" |\n| Observational | System screenshots, process observation | OBS-001: \"Screenshot of consent banner, captured 12-Mar-2026\" |\n\n## Report Quality Criteria\n\n| Criterion | Standard |\n|-----------|----------|\n| Accuracy | All findings supported by verified evidence; factual errors corrected before issuance |\n| Objectivity | Balanced presentation; positive observations included alongside findings |\n| Clarity | Plain language; technical terms defined; avoid jargon |\n| Completeness | All scope areas addressed; no material omissions |\n| Constructiveness | Recommendations are actionable, specific, and proportionate |\n| Timeliness | Draft report issued within 10 business days of fieldwork completion |\n| Conciseness | No unnecessary repetition; findings are distinct |\n\n## Distribution and Confidentiality\n\n| Classification | Recipients |\n|----------------|-----------|\n| Full Report | Chief Privacy Officer, DPO, Internal Audit Director, auditee management |\n| Executive Summary Only | Board Audit Committee, C-suite |\n| Redacted Version | External regulators (on request), external auditors |\n| Finding-Specific Extracts | Individual finding owners for remediation tracking |\n\n## GDPR and Regulatory Context\n\n| Regulation | Audit Report Relevance |\n|-----------|----------------------|\n| GDPR Article 5(2) | Accountability principle — audit reports demonstrate compliance monitoring |\n| GDPR Article 24 | Controller must implement appropriate measures and be able to demonstrate compliance |\n| GDPR Article 28(3)(h) | Processor must allow and contribute to audits conducted by the controller |\n| GDPR Article 39(1)(b) | DPO must monitor compliance including assignments of responsibilities, awareness-raising, training, and related audits |\n| GDPR Article 47(2)(j) | BCRs must include audit mechanisms |\n| ISO 27701:2019 Section 5.2 | PIMS-specific audit requirements |\n| ISO 19011:2018 Section 6.6 | Preparing and distributing the audit report |\n",{"name":5,"license":15,"metadata":47,"description":7},{"tags":48,"author":9,"domain":41,"version":49,"subdomain":50},"audit-report, findings-documentation, executive-summary, recommendations, report-structure","1.0","privacy-audit-certification","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-report-writing",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill audit-report-writing",{"tool":66,"command":67},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill audit-report-writing",{"tool":69,"command":70},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill audit-report-writing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-report-writing\u002FSKILL.md",true,[74,80,86,90,94,98,104,108,112,116,120,124,128,132],{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"assets\u002Ftemplate.md","ASSET","资产文件",6177,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-report-writing\u002Fassets\u002Ftemplate.md",{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"examples.md","REFERENCE","参考文档",4518,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplanning-with-files\u002Fexamples.md",{"path":87,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":88,"sourceHtmlUrl":89},"reference.md",8066,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplanning-with-files\u002Freference.md",{"path":91,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fstandards.md",2784,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-report-writing\u002Freferences\u002Fstandards.md",{"path":95,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fworkflows.md",5158,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-report-writing\u002Freferences\u002Fworkflows.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fcheck-complete.ps1","SCRIPT","脚本",1797,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplanning-with-files\u002Fscripts\u002Fcheck-complete.ps1",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fcheck-complete.sh",1737,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplanning-with-files\u002Fscripts\u002Fcheck-complete.sh",{"path":109,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Finit-session.ps1",2431,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplanning-with-files\u002Fscripts\u002Finit-session.ps1",{"path":113,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":114,"sourceHtmlUrl":115},"scripts\u002Finit-session.sh",2254,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplanning-with-files\u002Fscripts\u002Finit-session.sh",{"path":117,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":118,"sourceHtmlUrl":119},"scripts\u002Fprocess.py",8176,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Faudit-report-writing\u002Fscripts\u002Fprocess.py",{"path":121,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fsession-catchup.py",9363,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplanning-with-files\u002Fscripts\u002Fsession-catchup.py",{"path":125,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":126,"sourceHtmlUrl":127},"templates\u002Ffindings.md",3561,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplanning-with-files\u002Ftemplates\u002Ffindings.md",{"path":129,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":130,"sourceHtmlUrl":131},"templates\u002Fprogress.md",4001,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplanning-with-files\u002Ftemplates\u002Fprogress.md",{"path":133,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":134,"sourceHtmlUrl":135},"templates\u002Ftask_plan.md",4613,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fplanning-with-files\u002Ftemplates\u002Ftask_plan.md",[137,162,179,192,209,222],{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":152,"publishedAt":42},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[143,146,149],{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":147,"categoryName":148,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":150,"categoryName":151,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务",[153,154,41,155,156,157,158,159,160,161],"email","workplace email privacy","compliance","content","data","policy","testing","monitoring","metadata",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":172,"publishedAt":42},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[168,171],{"categoryNo":169,"categoryName":170,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":150,"categoryName":151,"taxonomyType":26,"taxonomyTypeDesc":27},[157,173,174,175,155,176,177,41,178],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":42},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[185],{"categoryNo":169,"categoryName":170,"taxonomyType":26,"taxonomyTypeDesc":27},[157,187,188,189,190,177,41,191],"vendor termination data","planning","verification","extraction","certification",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":199,"publishedAt":42},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[198],{"categoryNo":169,"categoryName":170,"taxonomyType":26,"taxonomyTypeDesc":27},[200,201,202,203,204,205,206,207,41,157,208],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":42},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[215],{"categoryNo":150,"categoryName":151,"taxonomyType":26,"taxonomyTypeDesc":27},[41,217,177,218,205,219,220,157,208,201,191,221],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":231,"publishedAt":42},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[228,229,230],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},{"categoryNo":150,"categoryName":151,"taxonomyType":26,"taxonomyTypeDesc":27},[232,34,41,33,189,35,155,177,233,208,234,235,236,188],"vendor privacy audit","remediation","collection","remediation-tracking","classification"]