[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF0FRXJS9SWCBQSQJXX9TM":3,"skill-same:01M6AF0FRXJS9SWCBQSQJXX9TM":86},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":47,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M6AF0FRXJS9SWCBQSQJXX9TM","oregon-ocpa-compliance",null,"Oregon Consumer Privacy Act (OCPA) compliance. Unique provisions for de-identified data requirements, employee data partial exemption, nonprofit applicability, 14-day cure period, and consumer rights. Effective July 1, 2024. AG enforcement only.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Foregon-ocpa-compliance\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务",[27,28,29,30,31],"compliance","oregon ocpa compliance","state","privacy","data","2026-11-10 10:12:30",false,"---\nname: oregon-ocpa-compliance\ndescription: >-\n  Oregon Consumer Privacy Act (OCPA) compliance. Unique provisions for\n  de-identified data requirements, employee data partial exemption,\n  nonprofit applicability, 14-day cure period, and consumer rights.\n  Effective July 1, 2024. AG enforcement only.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: us-state-privacy-laws\n  tags: \"oregon-ocpa, deidentified-data, employee-exemption, nonprofit, cure-period\"\n---\n\n# Oregon Consumer Privacy Act (OCPA)\n\n## Overview\n\nThe Oregon Consumer Privacy Act (OCPA), codified as ORS §646A.570 through §646A.604, was signed into law on July 18, 2023 (SB 619), and became effective July 1, 2024. Oregon is notable for several unique provisions: it applies to nonprofit organizations (unlike most state privacy laws), has specific de-identified data compliance requirements, includes a partial exemption for employee data, and provides a 14-day cure period (the shortest of any state law with a cure period).\n\n## Applicability (§646A.572)\n\nThe OCPA applies to a person that conducts business in Oregon or provides products or services to Oregon residents AND during a calendar year:\n\n1. Controls or processes personal data of 100,000 or more Oregon consumers (excluding data processed solely for payment transactions); OR\n2. Controls or processes personal data of 25,000 or more Oregon consumers AND derives 25% or more of annual gross revenue from selling personal data.\n\n**Key unique features:**\n- **Nonprofit applicability**: Unlike Virginia, Colorado, Connecticut, and Texas, the OCPA applies to nonprofit organizations\n- **No revenue threshold alternative**: Like Virginia and Colorado, there is no standalone revenue threshold\n\n**Exemptions (§646A.572(2)):**\n- State and local government bodies\n- GLBA-covered financial institutions (entity-level)\n- HIPAA covered entities and business associates (entity-level)\n- Data governed by GLBA, HIPAA, FERPA, FCRA, DPPA, COPPA, Farm Credit Act\n- **Not exempt**: Nonprofit organizations (unique among state privacy laws)\n\n**Liberty Commerce Inc. Assessment:**\nLiberty Commerce Inc. processes personal data of approximately 72,000 Oregon consumers and derives 12% of revenue from data sale activities. It does not meet either threshold. However, Liberty Commerce Inc. implements OCPA compliance as part of its multi-state program for operational consistency.\n\n## Consumer Rights (§646A.578)\n\n### Six Consumer Rights\n\n1. **Right to Access** (§646A.578(1)(a)): Confirm processing and access personal data\n2. **Right to Correct** (§646A.578(1)(b)): Correct inaccuracies\n3. **Right to Delete** (§646A.578(1)(c)): Delete personal data\n4. **Right to Portability** (§646A.578(1)(d)): Obtain data in portable format\n5. **Right to Opt Out** (§646A.578(1)(e)):\n   - Targeted advertising\n   - Sale of personal data\n   - Profiling in furtherance of decisions producing legal or similarly significant effects\n6. **Right to Know Third Parties** (§646A.578(1)(f)): Obtain a list of specific third parties to whom the controller has disclosed the consumer's personal data\n\n**Note:** The Right to Know Third Parties is unique to Oregon — most other state laws only require disclosure of categories of third parties, not specific names.\n\n### Response Requirements (§646A.580)\n- Respond within 45 days\n- Extension: up to 45 additional days with notice\n- Appeal: controller must respond within 45 days (not 60 like other states)\n\n## De-Identified Data Requirements (§646A.574)\n\nOregon has the most detailed de-identified data requirements of any state privacy law:\n\n### Controller Obligations for De-Identified Data\n1. Take reasonable measures to ensure data cannot be associated with a natural person\n2. Publicly commit to maintain and use data only in de-identified form\n3. Contractually obligate recipients to comply with de-identification requirements\n4. Exercise reasonable oversight to monitor compliance with contractual obligations\n5. Take appropriate steps to address any breach of the contractual obligations\n\n### Technical Standards\n- Must use technical safeguards to prevent re-identification\n- Must implement organizational safeguards including access controls\n- Must conduct regular assessments of re-identification risk\n- Must delete or destroy data if de-identification can no longer be maintained\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. applies k-anonymity (k=5 minimum) and differential privacy techniques to de-identified datasets. A public commitment statement is posted at privacy.libertycommerce.com\u002Fdeidentification. All recipients of de-identified data sign agreements prohibiting re-identification attempts. Quarterly re-identification risk assessments are conducted by the data science team.\n\n## Employee Data Partial Exemption (§646A.572(4))\n\n### Exemption Scope\nThe OCPA provides a **partial** exemption for employee data. Personal data processed in the context of employment is exempt from:\n- Consumer rights provisions (§646A.578) — access, correct, delete, portability, opt-out\n- Consumer request processing requirements (§646A.580)\n\n### Not Exempt\nEmployee data is NOT exempt from:\n- Controller obligations (§646A.576) — privacy notice, data minimization, security\n- Processor requirements (§646A.582)\n- De-identified data requirements (§646A.574)\n- Data protection assessment requirements (§646A.584)\n- Sensitive data consent requirements (§646A.576(8))\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. provides a privacy notice to Oregon employees covering all data processing activities. Sensitive employee data (health information for benefits, racial\u002Fethnic data for diversity reporting) is processed only with consent. DPIAs are conducted for employee profiling activities (performance scoring, promotion algorithms).\n\n## Nonprofit Applicability\n\nOregon is unique in applying its privacy law to nonprofit organizations. This has significant implications:\n\n| Organization Type | OCPA | VCDPA | CPA | CTDPA | TDPSA | CCPA\u002FCPRA |\n|------------------|------|-------|-----|-------|-------|-----------|\n| For-profit | Yes | Yes | Yes | Yes | Yes | Yes |\n| Nonprofit | Yes | No | No | No | No | No |\n\n**Implications for nonprofits:**\n- Must assess applicability against 100,000\u002F25,000 consumer thresholds\n- Must provide consumer rights if applicable\n- Must comply with controller obligations (privacy notice, minimization, security)\n- Must obtain consent for sensitive data processing\n- Must conduct DPIAs for targeted advertising, sale, profiling, and sensitive data\n\n## Sensitive Data (§646A.574(14))\n\n### Categories\n1. Racial or ethnic origin\n2. Religious beliefs\n3. Mental or physical health diagnosis\n4. Sexual orientation\n5. Citizenship or immigration status\n6. Genetic or biometric data for identification\n7. Personal data of a known child\n8. Precise geolocation data\n9. **Transgender or nonbinary status** (unique to Oregon)\n\n**Note:** Oregon is the first state to explicitly include transgender or nonbinary status as a sensitive data category.\n\n### Consent Requirement\nProcessing requires opt-in consent. Consent must be freely given, specific, informed, and unambiguous.\n\n## 14-Day Cure Period (§646A.600)\n\nOregon provides a 14-day cure period — the shortest among state privacy laws with cure provisions:\n\n| State | Cure Period | Duration |\n|-------|------------|----------|\n| Oregon | 14 days | Permanent |\n| Virginia | 30 days | Permanent |\n| Texas | 30 days | Permanent |\n| Colorado | 60 days | Expired January 1, 2025 |\n| Connecticut | 60 days | Expired January 1, 2025 |\n| California | None | Eliminated by CPRA |\n\n### Cure Process\n1. AG provides written notice of alleged violation\n2. Controller has 14 days to cure\n3. If cured and written statement provided: AG may not bring action\n4. If not cured: AG may proceed under Oregon Unlawful Trade Practices Act (ORS §646.607)\n\n## Key Regulatory References\n\n- ORS §646A.570 through §646A.604 (OCPA)\n- ORS §646.607 et seq. (Oregon Unlawful Trade Practices Act — enforcement)\n- NIST Special Publication 800-188 — De-Identification of Personal Information (reference standard)\n- Oregon AG Consumer Privacy Division guidance (as published)\n","# Oregon Consumer Privacy Act (OCPA)\n\n## Overview\n\nThe Oregon Consumer Privacy Act (OCPA), codified as ORS §646A.570 through §646A.604, was signed into law on July 18, 2023 (SB 619), and became effective July 1, 2024. Oregon is notable for several unique provisions: it applies to nonprofit organizations (unlike most state privacy laws), has specific de-identified data compliance requirements, includes a partial exemption for employee data, and provides a 14-day cure period (the shortest of any state law with a cure period).\n\n## Applicability (§646A.572)\n\nThe OCPA applies to a person that conducts business in Oregon or provides products or services to Oregon residents AND during a calendar year:\n\n1. Controls or processes personal data of 100,000 or more Oregon consumers (excluding data processed solely for payment transactions); OR\n2. Controls or processes personal data of 25,000 or more Oregon consumers AND derives 25% or more of annual gross revenue from selling personal data.\n\n**Key unique features:**\n- **Nonprofit applicability**: Unlike Virginia, Colorado, Connecticut, and Texas, the OCPA applies to nonprofit organizations\n- **No revenue threshold alternative**: Like Virginia and Colorado, there is no standalone revenue threshold\n\n**Exemptions (§646A.572(2)):**\n- State and local government bodies\n- GLBA-covered financial institutions (entity-level)\n- HIPAA covered entities and business associates (entity-level)\n- Data governed by GLBA, HIPAA, FERPA, FCRA, DPPA, COPPA, Farm Credit Act\n- **Not exempt**: Nonprofit organizations (unique among state privacy laws)\n\n**Liberty Commerce Inc. Assessment:**\nLiberty Commerce Inc. processes personal data of approximately 72,000 Oregon consumers and derives 12% of revenue from data sale activities. It does not meet either threshold. However, Liberty Commerce Inc. implements OCPA compliance as part of its multi-state program for operational consistency.\n\n## Consumer Rights (§646A.578)\n\n### Six Consumer Rights\n\n1. **Right to Access** (§646A.578(1)(a)): Confirm processing and access personal data\n2. **Right to Correct** (§646A.578(1)(b)): Correct inaccuracies\n3. **Right to Delete** (§646A.578(1)(c)): Delete personal data\n4. **Right to Portability** (§646A.578(1)(d)): Obtain data in portable format\n5. **Right to Opt Out** (§646A.578(1)(e)):\n   - Targeted advertising\n   - Sale of personal data\n   - Profiling in furtherance of decisions producing legal or similarly significant effects\n6. **Right to Know Third Parties** (§646A.578(1)(f)): Obtain a list of specific third parties to whom the controller has disclosed the consumer's personal data\n\n**Note:** The Right to Know Third Parties is unique to Oregon — most other state laws only require disclosure of categories of third parties, not specific names.\n\n### Response Requirements (§646A.580)\n- Respond within 45 days\n- Extension: up to 45 additional days with notice\n- Appeal: controller must respond within 45 days (not 60 like other states)\n\n## De-Identified Data Requirements (§646A.574)\n\nOregon has the most detailed de-identified data requirements of any state privacy law:\n\n### Controller Obligations for De-Identified Data\n1. Take reasonable measures to ensure data cannot be associated with a natural person\n2. Publicly commit to maintain and use data only in de-identified form\n3. Contractually obligate recipients to comply with de-identification requirements\n4. Exercise reasonable oversight to monitor compliance with contractual obligations\n5. Take appropriate steps to address any breach of the contractual obligations\n\n### Technical Standards\n- Must use technical safeguards to prevent re-identification\n- Must implement organizational safeguards including access controls\n- Must conduct regular assessments of re-identification risk\n- Must delete or destroy data if de-identification can no longer be maintained\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. applies k-anonymity (k=5 minimum) and differential privacy techniques to de-identified datasets. A public commitment statement is posted at privacy.libertycommerce.com\u002Fdeidentification. All recipients of de-identified data sign agreements prohibiting re-identification attempts. Quarterly re-identification risk assessments are conducted by the data science team.\n\n## Employee Data Partial Exemption (§646A.572(4))\n\n### Exemption Scope\nThe OCPA provides a **partial** exemption for employee data. Personal data processed in the context of employment is exempt from:\n- Consumer rights provisions (§646A.578) — access, correct, delete, portability, opt-out\n- Consumer request processing requirements (§646A.580)\n\n### Not Exempt\nEmployee data is NOT exempt from:\n- Controller obligations (§646A.576) — privacy notice, data minimization, security\n- Processor requirements (§646A.582)\n- De-identified data requirements (§646A.574)\n- Data protection assessment requirements (§646A.584)\n- Sensitive data consent requirements (§646A.576(8))\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. provides a privacy notice to Oregon employees covering all data processing activities. Sensitive employee data (health information for benefits, racial\u002Fethnic data for diversity reporting) is processed only with consent. DPIAs are conducted for employee profiling activities (performance scoring, promotion algorithms).\n\n## Nonprofit Applicability\n\nOregon is unique in applying its privacy law to nonprofit organizations. This has significant implications:\n\n| Organization Type | OCPA | VCDPA | CPA | CTDPA | TDPSA | CCPA\u002FCPRA |\n|------------------|------|-------|-----|-------|-------|-----------|\n| For-profit | Yes | Yes | Yes | Yes | Yes | Yes |\n| Nonprofit | Yes | No | No | No | No | No |\n\n**Implications for nonprofits:**\n- Must assess applicability against 100,000\u002F25,000 consumer thresholds\n- Must provide consumer rights if applicable\n- Must comply with controller obligations (privacy notice, minimization, security)\n- Must obtain consent for sensitive data processing\n- Must conduct DPIAs for targeted advertising, sale, profiling, and sensitive data\n\n## Sensitive Data (§646A.574(14))\n\n### Categories\n1. Racial or ethnic origin\n2. Religious beliefs\n3. Mental or physical health diagnosis\n4. Sexual orientation\n5. Citizenship or immigration status\n6. Genetic or biometric data for identification\n7. Personal data of a known child\n8. Precise geolocation data\n9. **Transgender or nonbinary status** (unique to Oregon)\n\n**Note:** Oregon is the first state to explicitly include transgender or nonbinary status as a sensitive data category.\n\n### Consent Requirement\nProcessing requires opt-in consent. Consent must be freely given, specific, informed, and unambiguous.\n\n## 14-Day Cure Period (§646A.600)\n\nOregon provides a 14-day cure period — the shortest among state privacy laws with cure provisions:\n\n| State | Cure Period | Duration |\n|-------|------------|----------|\n| Oregon | 14 days | Permanent |\n| Virginia | 30 days | Permanent |\n| Texas | 30 days | Permanent |\n| Colorado | 60 days | Expired January 1, 2025 |\n| Connecticut | 60 days | Expired January 1, 2025 |\n| California | None | Eliminated by CPRA |\n\n### Cure Process\n1. AG provides written notice of alleged violation\n2. Controller has 14 days to cure\n3. If cured and written statement provided: AG may not bring action\n4. If not cured: AG may proceed under Oregon Unlawful Trade Practices Act (ORS §646.607)\n\n## Key Regulatory References\n\n- ORS §646A.570 through §646A.604 (OCPA)\n- ORS §646.607 et seq. (Oregon Unlawful Trade Practices Act — enforcement)\n- NIST Special Publication 800-188 — De-Identification of Personal Information (reference standard)\n- Oregon AG Consumer Privacy Division guidance (as published)\n",{"name":5,"license":15,"metadata":37,"description":7},{"tags":38,"author":9,"domain":30,"version":39,"subdomain":40},"oregon-ocpa, deidentified-data, employee-exemption, nonprofit, cure-period","1.0","us-state-privacy-laws","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Foregon-ocpa-compliance",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill oregon-ocpa-compliance",{"tool":56,"command":57},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill oregon-ocpa-compliance",{"tool":59,"command":60},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill oregon-ocpa-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Foregon-ocpa-compliance\u002FSKILL.md",true,[64,70,76,80],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"assets\u002Ftemplate.md","ASSET","资产文件",1504,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Foregon-ocpa-compliance\u002Fassets\u002Ftemplate.md",{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Fstandards.md","REFERENCE","参考文档",3071,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Foregon-ocpa-compliance\u002Freferences\u002Fstandards.md",{"path":77,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fworkflows.md",4198,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Foregon-ocpa-compliance\u002Freferences\u002Fworkflows.md",{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"scripts\u002Fprocess.py","SCRIPT","脚本",10138,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Foregon-ocpa-compliance\u002Fscripts\u002Fprocess.py",[87,110,125,138,155,168],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":102,"publishedAt":32},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[93,98,101],{"categoryNo":94,"categoryName":95,"taxonomyType":96,"taxonomyTypeDesc":97},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":99,"categoryName":100,"taxonomyType":96,"taxonomyTypeDesc":97},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[103,104,30,27,105,31,106,107,108,109],"email","workplace email privacy","content","policy","testing","monitoring","metadata",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":118,"publishedAt":32},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[116,117],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[31,119,120,121,27,122,123,30,124],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":32},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[131],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[31,133,134,135,136,123,30,137],"vendor termination data","planning","verification","extraction","certification",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":32},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[144],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,147,148,149,150,151,152,153,30,31,154],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":32},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[161],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[30,163,123,164,151,165,166,31,154,147,137,167],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":181,"publishedAt":32},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[174,177,180],{"categoryNo":175,"categoryName":176,"taxonomyType":96,"taxonomyTypeDesc":97},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":178,"categoryName":179,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[182,183,30,184,135,185,27,123,186,154,187,188,189,134],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]