[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF3PDR90GRBNNAPSTK1F91":3,"skill-same:01M6AF3PDR90GRBNNAPSTK1F91":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":26,"linkOnly":27,"markdownContent":28,"markdownBody":29,"frontMatter":30,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":38,"repositoryHtmlUrl":39,"repositoryHomepageUrl":6,"ownerHtmlUrl":40,"ownerBlogUrl":41,"ownerDescription":42,"updatedAt":43,"install":44,"resources":57},"01M6AF3PDR90GRBNNAPSTK1F91","ropa-completeness-audit",null,"Audits Records of Processing Activities against supervisory authority templates from CNIL, ICO, and BfDI. Provides completeness scoring, gap identification, and remediation tracking. Activate for RoPA audit, completeness check, supervisory authority readiness, CNIL template, ICO template, BfDI template, gap analysis.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fropa-completeness-audit\u002FSKILL.md",[],[19,20,21,22,23,24,25],"audit","ropa completeness audit","gdpr","privacy","templates","remediation","ico","2026-11-10 10:12:30",false,"---\nname: ropa-completeness-audit\ndescription: >-\n  Audits Records of Processing Activities against supervisory authority\n  templates from CNIL, ICO, and BfDI. Provides completeness scoring, gap\n  identification, and remediation tracking. Activate for RoPA audit,\n  completeness check, supervisory authority readiness, CNIL template,\n  ICO template, BfDI template, gap analysis.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: records-of-processing\n  tags: \"gdpr, ropa, audit, completeness, cnil, ico, bfdi, gap-analysis, remediation\"\n---\n\n# RoPA Completeness Audit\n\n## Overview\n\nSupervisory authorities across the EEA publish RoPA templates and guidance that extend beyond the bare minimum Art. 30(1) requirements. While Art. 30(1) mandates seven fields, supervisory authorities such as CNIL, ICO, and BfDI expect additional information in practice. This skill provides a methodology for auditing RoPA entries against these expanded expectations, calculating completeness scores, identifying gaps, and tracking remediation to achieve supervisory authority readiness.\n\n## Supervisory Authority Template Comparison\n\n### CNIL (France) Template\n\nThe CNIL publishes the most structured RoPA template in the EU, available in both PDF and machine-readable (CSV\u002FJSON) format. The CNIL template requires the Art. 30 mandatory fields plus additional recommended fields:\n\n| Field | Art. 30 Mandatory | CNIL Required | CNIL Recommended |\n|-------|-------------------|---------------|------------------|\n| Controller identity and contact | Yes (a) | Yes | — |\n| Joint controller details | Yes (a) | Yes | — |\n| DPO contact | Yes (a) | Yes | — |\n| Processing activity name | — | Yes | — |\n| Purposes of processing | Yes (b) | Yes | — |\n| Lawful basis (Art. 6) | — | — | Yes |\n| Data subject categories | Yes (c) | Yes | — |\n| Personal data categories | Yes (c) | Yes | — |\n| Special category indication (Art. 9) | — | — | Yes |\n| Recipient categories | Yes (d) | Yes | — |\n| Processor details with DPA reference | — | — | Yes |\n| International transfers | Yes (e) | Yes | — |\n| Transfer safeguard mechanism | — | Yes | — |\n| Retention periods | Yes (f) | Yes | — |\n| Security measures | Yes (g) | Yes | — |\n| DPIA conducted (yes\u002Fno) | — | — | Yes |\n| DPIA reference | — | — | Yes |\n| Last review date | — | — | Yes |\n\n### ICO (United Kingdom) Template\n\nThe ICO template aligns with UK GDPR Art. 30 and includes guidance notes for each field:\n\n| Field | Art. 30 Mandatory | ICO Required | ICO Recommended |\n|-------|-------------------|-------------|-----------------|\n| Controller name and contact | Yes (a) | Yes | — |\n| DPO contact | Yes (a) | Yes | — |\n| Purposes of processing | Yes (b) | Yes | — |\n| Lawful basis | — | Yes | — |\n| Legitimate interest description (if applicable) | — | — | Yes |\n| Data subject categories | Yes (c) | Yes | — |\n| Personal data categories | Yes (c) | Yes | — |\n| Special category data and Art. 9 condition | — | Yes | — |\n| Recipients | Yes (d) | Yes | — |\n| International transfers with safeguards | Yes (e) | Yes | — |\n| Retention periods | Yes (f) | Yes | — |\n| Technical and organisational measures | Yes (g) | Yes | — |\n| Link to privacy notice | — | — | Yes |\n| DPIA reference | — | — | Yes |\n\n### BfDI (Germany) Template\n\nThe German Federal Commissioner for Data Protection (BfDI) publishes guidance (Hinweise zum Verzeichnis von Verarbeitungstaetigkeiten) with sector-specific requirements:\n\n| Field | Art. 30 Mandatory | BfDI Required | BfDI Recommended |\n|-------|-------------------|--------------|------------------|\n| Controller identity (Verantwortlicher) | Yes (a) | Yes | — |\n| DPO (Datenschutzbeauftragte\u002Fr) | Yes (a) | Yes | — |\n| Purpose (Zweck der Verarbeitung) | Yes (b) | Yes | — |\n| Lawful basis (Rechtsgrundlage) | — | Yes | — |\n| Data subject categories (Kategorien betroffener Personen) | Yes (c) | Yes | — |\n| Personal data categories (Kategorien personenbezogener Daten) | Yes (c) | Yes | — |\n| Recipients (Empfaenger) | Yes (d) | Yes | — |\n| Transfers to third countries (Uebermittlungen in Drittlaender) | Yes (e) | Yes | — |\n| Transfer safeguard with reference | — | Yes | — |\n| Retention periods (Loeschfristen) | Yes (f) | Yes | — |\n| Technical measures (Technische Massnahmen) | Yes (g) | Yes | — |\n| Organisational measures (Organisatorische Massnahmen) | — | Yes | — |\n| Responsible department (Verantwortliche Fachabteilung) | — | — | Yes |\n| IT systems used | — | — | Yes |\n\n## Completeness Scoring Methodology\n\n### Scoring Framework\n\nEach RoPA entry is scored against a three-tier assessment:\n\n1. **Tier 1 — Art. 30 Mandatory Compliance** (40% weight): Are all seven Art. 30(1) mandatory fields populated?\n2. **Tier 2 — Supervisory Authority Expectations** (35% weight): Does the entry meet the selected SA's expanded requirements?\n3. **Tier 3 — Quality Assessment** (25% weight): Are populated fields specific, accurate, and current?\n\n### Tier 1: Mandatory Field Scoring\n\n| Field | Present (1\u002F0) | Quality Score (0-3) |\n|-------|--------------|---------------------|\n| Art. 30(1)(a) Controller identity | [1\u002F0] | 0 = Missing, 1 = Partial, 2 = Complete, 3 = Excellent |\n| Art. 30(1)(b) Purposes | [1\u002F0] | 0-3 |\n| Art. 30(1)(c) Data subject categories | [1\u002F0] | 0-3 |\n| Art. 30(1)(c) Personal data categories | [1\u002F0] | 0-3 |\n| Art. 30(1)(d) Recipients | [1\u002F0] | 0-3 |\n| Art. 30(1)(e) International transfers | [1\u002F0] | 0-3 |\n| Art. 30(1)(f) Retention periods | [1\u002F0] | 0-3 |\n| Art. 30(1)(g) Security measures | [1\u002F0] | 0-3 |\n\n**Quality scoring criteria:**\n\n- **0 (Missing)**: Field is empty or contains only \"N\u002FA\" where substantive content is expected.\n- **1 (Partial)**: Field contains some content but is materially incomplete (e.g., \"employees\" without further granularity for data subjects).\n- **2 (Complete)**: Field satisfies the legal requirement with specific, substantive content.\n- **3 (Excellent)**: Field exceeds minimum requirements with cross-references, supporting detail, and regulatory alignment.\n\n### Tier 2: SA-Specific Field Scoring\n\nScore additional fields required or recommended by the target SA. Each SA template adds 3-6 fields beyond Art. 30 minimums.\n\n### Tier 3: Quality Metrics\n\n| Metric | Scoring |\n|--------|---------|\n| Purpose specificity | 0-3 (penalise vague terms per EDPB guidance) |\n| Retention concreteness | 0-3 (penalise \"as long as necessary\" type terms) |\n| Transfer mechanism documentation | 0-3 (must identify specific mechanism, not just \"safeguards in place\") |\n| Review currency | 0-3 (reviewed within 12m = 3, 12-18m = 2, 18-24m = 1, >24m = 0) |\n| DPA cross-reference | 0-3 (all processors have DPA refs = 3) |\n\n### Overall Completeness Score Calculation\n\n```\nTier 1 Score = (fields present \u002F 8) * (avg quality \u002F 3) * 100\nTier 2 Score = (SA fields present \u002F SA total fields) * (avg quality \u002F 3) * 100\nTier 3 Score = (sum of quality metrics \u002F max possible) * 100\n\nOverall = (Tier 1 * 0.40) + (Tier 2 * 0.35) + (Tier 3 * 0.25)\n```\n\n**Readiness thresholds:**\n\n| Score | Rating | Interpretation |\n|-------|--------|---------------|\n| 95-100% | Excellent | Supervisory authority ready — no immediate action |\n| 85-94% | Good | Minor improvements recommended before SA interaction |\n| 70-84% | Acceptable | Material gaps exist — remediation plan required |\n| 50-69% | Poor | Significant non-compliance risk — urgent remediation |\n| Below 50% | Critical | RoPA fundamentally deficient — rebuild required |\n\n## Gap Identification Process\n\n### Step 1: Template Selection\n\nSelect the primary supervisory authority template based on:\n- The country where the controller is established (lead SA under one-stop-shop)\n- Any pending investigations or correspondence with a specific SA\n- Regulatory expectations in the primary market\n\n### Step 2: Field-by-Field Comparison\n\nFor each RoPA entry, compare every field against the selected SA template and classify:\n\n| Classification | Definition | Remediation Priority |\n|---------------|------------|---------------------|\n| Compliant | Field meets or exceeds SA expectations | None |\n| Gap — Missing | Required field is absent | High |\n| Gap — Incomplete | Field is present but does not meet SA expectations | Medium |\n| Gap — Stale | Field content is outdated | Medium |\n| Gap — Vague | Field content uses imprecise language | Medium |\n| Enhancement | SA-recommended field not present | Low |\n\n### Step 3: Gap Register\n\nCompile all identified gaps into a structured register:\n\n| Gap ID | Record ID | Processing Activity | Field | Classification | SA Template | Description | Severity | Remediation Owner | Target Date | Status |\n|--------|-----------|---------------------|-------|----------------|-------------|-------------|----------|------------------|-------------|--------|\n| GAP-001 | RPA-023 | Customer analytics | Art. 30(1)(f) | Missing | CNIL | Retention period field is empty | Critical | Stefan Richter | [Date] | Open |\n| GAP-002 | RPA-034 | Website analytics | Art. 30(1)(b) | Vague | CNIL | Purpose too broad (\"analytics\") | Major | Julia Richter | [Date] | Open |\n\n## Remediation Tracking\n\n### Remediation Workflow\n\n1. **Gap register creation**: Compile all gaps from the audit into the register.\n2. **Prioritisation**: Sort by severity (Critical > Major > Minor > Enhancement).\n3. **Owner assignment**: Assign each gap to the processing owner responsible for the affected entry.\n4. **Deadline setting**: Critical = 30 days, Major = 60 days, Minor = 90 days, Enhancement = next annual review.\n5. **Progress tracking**: Weekly status updates on Critical items, bi-weekly on Major items.\n6. **Verification**: DPO verifies each remediated gap before closing.\n7. **Re-scoring**: After remediation cycle, re-calculate completeness scores.\n\n### Remediation Status Dashboard\n\n| Severity | Total | Open | In Progress | Remediated | Verified |\n|----------|-------|------|-------------|------------|----------|\n| Critical | 3 | 0 | 1 | 1 | 1 |\n| Major | 11 | 2 | 4 | 3 | 2 |\n| Minor | 9 | 3 | 2 | 3 | 1 |\n| Enhancement | 8 | 5 | 1 | 2 | 0 |\n| **Total** | **31** | **10** | **8** | **9** | **4** |\n\n## Audit Frequency\n\n| Audit Type | Frequency | Scope |\n|------------|-----------|-------|\n| Full completeness audit | Annually | All RoPA entries against selected SA template |\n| Targeted audit (post-change) | As needed | Entries affected by organisational or regulatory change |\n| Pre-investigation readiness check | On demand | Full RoPA in preparation for SA investigation or inquiry |\n| Automated completeness scan | Monthly | All entries — field presence and vague term detection only |\n","# RoPA Completeness Audit\n\n## Overview\n\nSupervisory authorities across the EEA publish RoPA templates and guidance that extend beyond the bare minimum Art. 30(1) requirements. While Art. 30(1) mandates seven fields, supervisory authorities such as CNIL, ICO, and BfDI expect additional information in practice. This skill provides a methodology for auditing RoPA entries against these expanded expectations, calculating completeness scores, identifying gaps, and tracking remediation to achieve supervisory authority readiness.\n\n## Supervisory Authority Template Comparison\n\n### CNIL (France) Template\n\nThe CNIL publishes the most structured RoPA template in the EU, available in both PDF and machine-readable (CSV\u002FJSON) format. The CNIL template requires the Art. 30 mandatory fields plus additional recommended fields:\n\n| Field | Art. 30 Mandatory | CNIL Required | CNIL Recommended |\n|-------|-------------------|---------------|------------------|\n| Controller identity and contact | Yes (a) | Yes | — |\n| Joint controller details | Yes (a) | Yes | — |\n| DPO contact | Yes (a) | Yes | — |\n| Processing activity name | — | Yes | — |\n| Purposes of processing | Yes (b) | Yes | — |\n| Lawful basis (Art. 6) | — | — | Yes |\n| Data subject categories | Yes (c) | Yes | — |\n| Personal data categories | Yes (c) | Yes | — |\n| Special category indication (Art. 9) | — | — | Yes |\n| Recipient categories | Yes (d) | Yes | — |\n| Processor details with DPA reference | — | — | Yes |\n| International transfers | Yes (e) | Yes | — |\n| Transfer safeguard mechanism | — | Yes | — |\n| Retention periods | Yes (f) | Yes | — |\n| Security measures | Yes (g) | Yes | — |\n| DPIA conducted (yes\u002Fno) | — | — | Yes |\n| DPIA reference | — | — | Yes |\n| Last review date | — | — | Yes |\n\n### ICO (United Kingdom) Template\n\nThe ICO template aligns with UK GDPR Art. 30 and includes guidance notes for each field:\n\n| Field | Art. 30 Mandatory | ICO Required | ICO Recommended |\n|-------|-------------------|-------------|-----------------|\n| Controller name and contact | Yes (a) | Yes | — |\n| DPO contact | Yes (a) | Yes | — |\n| Purposes of processing | Yes (b) | Yes | — |\n| Lawful basis | — | Yes | — |\n| Legitimate interest description (if applicable) | — | — | Yes |\n| Data subject categories | Yes (c) | Yes | — |\n| Personal data categories | Yes (c) | Yes | — |\n| Special category data and Art. 9 condition | — | Yes | — |\n| Recipients | Yes (d) | Yes | — |\n| International transfers with safeguards | Yes (e) | Yes | — |\n| Retention periods | Yes (f) | Yes | — |\n| Technical and organisational measures | Yes (g) | Yes | — |\n| Link to privacy notice | — | — | Yes |\n| DPIA reference | — | — | Yes |\n\n### BfDI (Germany) Template\n\nThe German Federal Commissioner for Data Protection (BfDI) publishes guidance (Hinweise zum Verzeichnis von Verarbeitungstaetigkeiten) with sector-specific requirements:\n\n| Field | Art. 30 Mandatory | BfDI Required | BfDI Recommended |\n|-------|-------------------|--------------|------------------|\n| Controller identity (Verantwortlicher) | Yes (a) | Yes | — |\n| DPO (Datenschutzbeauftragte\u002Fr) | Yes (a) | Yes | — |\n| Purpose (Zweck der Verarbeitung) | Yes (b) | Yes | — |\n| Lawful basis (Rechtsgrundlage) | — | Yes | — |\n| Data subject categories (Kategorien betroffener Personen) | Yes (c) | Yes | — |\n| Personal data categories (Kategorien personenbezogener Daten) | Yes (c) | Yes | — |\n| Recipients (Empfaenger) | Yes (d) | Yes | — |\n| Transfers to third countries (Uebermittlungen in Drittlaender) | Yes (e) | Yes | — |\n| Transfer safeguard with reference | — | Yes | — |\n| Retention periods (Loeschfristen) | Yes (f) | Yes | — |\n| Technical measures (Technische Massnahmen) | Yes (g) | Yes | — |\n| Organisational measures (Organisatorische Massnahmen) | — | Yes | — |\n| Responsible department (Verantwortliche Fachabteilung) | — | — | Yes |\n| IT systems used | — | — | Yes |\n\n## Completeness Scoring Methodology\n\n### Scoring Framework\n\nEach RoPA entry is scored against a three-tier assessment:\n\n1. **Tier 1 — Art. 30 Mandatory Compliance** (40% weight): Are all seven Art. 30(1) mandatory fields populated?\n2. **Tier 2 — Supervisory Authority Expectations** (35% weight): Does the entry meet the selected SA's expanded requirements?\n3. **Tier 3 — Quality Assessment** (25% weight): Are populated fields specific, accurate, and current?\n\n### Tier 1: Mandatory Field Scoring\n\n| Field | Present (1\u002F0) | Quality Score (0-3) |\n|-------|--------------|---------------------|\n| Art. 30(1)(a) Controller identity | [1\u002F0] | 0 = Missing, 1 = Partial, 2 = Complete, 3 = Excellent |\n| Art. 30(1)(b) Purposes | [1\u002F0] | 0-3 |\n| Art. 30(1)(c) Data subject categories | [1\u002F0] | 0-3 |\n| Art. 30(1)(c) Personal data categories | [1\u002F0] | 0-3 |\n| Art. 30(1)(d) Recipients | [1\u002F0] | 0-3 |\n| Art. 30(1)(e) International transfers | [1\u002F0] | 0-3 |\n| Art. 30(1)(f) Retention periods | [1\u002F0] | 0-3 |\n| Art. 30(1)(g) Security measures | [1\u002F0] | 0-3 |\n\n**Quality scoring criteria:**\n\n- **0 (Missing)**: Field is empty or contains only \"N\u002FA\" where substantive content is expected.\n- **1 (Partial)**: Field contains some content but is materially incomplete (e.g., \"employees\" without further granularity for data subjects).\n- **2 (Complete)**: Field satisfies the legal requirement with specific, substantive content.\n- **3 (Excellent)**: Field exceeds minimum requirements with cross-references, supporting detail, and regulatory alignment.\n\n### Tier 2: SA-Specific Field Scoring\n\nScore additional fields required or recommended by the target SA. Each SA template adds 3-6 fields beyond Art. 30 minimums.\n\n### Tier 3: Quality Metrics\n\n| Metric | Scoring |\n|--------|---------|\n| Purpose specificity | 0-3 (penalise vague terms per EDPB guidance) |\n| Retention concreteness | 0-3 (penalise \"as long as necessary\" type terms) |\n| Transfer mechanism documentation | 0-3 (must identify specific mechanism, not just \"safeguards in place\") |\n| Review currency | 0-3 (reviewed within 12m = 3, 12-18m = 2, 18-24m = 1, >24m = 0) |\n| DPA cross-reference | 0-3 (all processors have DPA refs = 3) |\n\n### Overall Completeness Score Calculation\n\n```\nTier 1 Score = (fields present \u002F 8) * (avg quality \u002F 3) * 100\nTier 2 Score = (SA fields present \u002F SA total fields) * (avg quality \u002F 3) * 100\nTier 3 Score = (sum of quality metrics \u002F max possible) * 100\n\nOverall = (Tier 1 * 0.40) + (Tier 2 * 0.35) + (Tier 3 * 0.25)\n```\n\n**Readiness thresholds:**\n\n| Score | Rating | Interpretation |\n|-------|--------|---------------|\n| 95-100% | Excellent | Supervisory authority ready — no immediate action |\n| 85-94% | Good | Minor improvements recommended before SA interaction |\n| 70-84% | Acceptable | Material gaps exist — remediation plan required |\n| 50-69% | Poor | Significant non-compliance risk — urgent remediation |\n| Below 50% | Critical | RoPA fundamentally deficient — rebuild required |\n\n## Gap Identification Process\n\n### Step 1: Template Selection\n\nSelect the primary supervisory authority template based on:\n- The country where the controller is established (lead SA under one-stop-shop)\n- Any pending investigations or correspondence with a specific SA\n- Regulatory expectations in the primary market\n\n### Step 2: Field-by-Field Comparison\n\nFor each RoPA entry, compare every field against the selected SA template and classify:\n\n| Classification | Definition | Remediation Priority |\n|---------------|------------|---------------------|\n| Compliant | Field meets or exceeds SA expectations | None |\n| Gap — Missing | Required field is absent | High |\n| Gap — Incomplete | Field is present but does not meet SA expectations | Medium |\n| Gap — Stale | Field content is outdated | Medium |\n| Gap — Vague | Field content uses imprecise language | Medium |\n| Enhancement | SA-recommended field not present | Low |\n\n### Step 3: Gap Register\n\nCompile all identified gaps into a structured register:\n\n| Gap ID | Record ID | Processing Activity | Field | Classification | SA Template | Description | Severity | Remediation Owner | Target Date | Status |\n|--------|-----------|---------------------|-------|----------------|-------------|-------------|----------|------------------|-------------|--------|\n| GAP-001 | RPA-023 | Customer analytics | Art. 30(1)(f) | Missing | CNIL | Retention period field is empty | Critical | Stefan Richter | [Date] | Open |\n| GAP-002 | RPA-034 | Website analytics | Art. 30(1)(b) | Vague | CNIL | Purpose too broad (\"analytics\") | Major | Julia Richter | [Date] | Open |\n\n## Remediation Tracking\n\n### Remediation Workflow\n\n1. **Gap register creation**: Compile all gaps from the audit into the register.\n2. **Prioritisation**: Sort by severity (Critical > Major > Minor > Enhancement).\n3. **Owner assignment**: Assign each gap to the processing owner responsible for the affected entry.\n4. **Deadline setting**: Critical = 30 days, Major = 60 days, Minor = 90 days, Enhancement = next annual review.\n5. **Progress tracking**: Weekly status updates on Critical items, bi-weekly on Major items.\n6. **Verification**: DPO verifies each remediated gap before closing.\n7. **Re-scoring**: After remediation cycle, re-calculate completeness scores.\n\n### Remediation Status Dashboard\n\n| Severity | Total | Open | In Progress | Remediated | Verified |\n|----------|-------|------|-------------|------------|----------|\n| Critical | 3 | 0 | 1 | 1 | 1 |\n| Major | 11 | 2 | 4 | 3 | 2 |\n| Minor | 9 | 3 | 2 | 3 | 1 |\n| Enhancement | 8 | 5 | 1 | 2 | 0 |\n| **Total** | **31** | **10** | **8** | **9** | **4** |\n\n## Audit Frequency\n\n| Audit Type | Frequency | Scope |\n|------------|-----------|-------|\n| Full completeness audit | Annually | All RoPA entries against selected SA template |\n| Targeted audit (post-change) | As needed | Entries affected by organisational or regulatory change |\n| Pre-investigation readiness check | On demand | Full RoPA in preparation for SA investigation or inquiry |\n| Automated completeness scan | Monthly | All entries — field presence and vague term detection only |\n",{"name":5,"license":15,"metadata":31,"description":7},{"tags":32,"author":9,"domain":22,"version":33,"subdomain":34},"gdpr, ropa, audit, completeness, cnil, ico, bfdi, gap-analysis, remediation","1.0","records-of-processing","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Fropa-completeness-audit",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ropa-completeness-audit",{"tool":50,"command":51},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ropa-completeness-audit",{"tool":53,"command":54},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill ropa-completeness-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fropa-completeness-audit\u002FSKILL.md",true,[58,64,70,74,78,82,86,92,96,99],{"path":59,"resourceType":60,"resourceTypeDesc":61,"sizeBytes":62,"sourceHtmlUrl":63},"assets\u002Ftemplate.md","ASSET","资产文件",6978,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fropa-completeness-audit\u002Fassets\u002Ftemplate.md",{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"references\u002Ffrontend_best_practices.md","REFERENCE","参考文档",1618,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-frontend\u002Freferences\u002Ffrontend_best_practices.md",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":72,"sourceHtmlUrl":73},"references\u002Fnextjs_optimization_guide.md",1620,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-frontend\u002Freferences\u002Fnextjs_optimization_guide.md",{"path":75,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Freact_patterns.md",1609,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-frontend\u002Freferences\u002Freact_patterns.md",{"path":79,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fstandards.md",4398,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fropa-completeness-audit\u002Freferences\u002Fstandards.md",{"path":83,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fworkflows.md",5519,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fropa-completeness-audit\u002Freferences\u002Fworkflows.md",{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"scripts\u002Fbundle_analyzer.py","SCRIPT","脚本",3125,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-frontend\u002Fscripts\u002Fbundle_analyzer.py",{"path":93,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":94,"sourceHtmlUrl":95},"scripts\u002Fcomponent_generator.py",3145,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-frontend\u002Fscripts\u002Fcomponent_generator.py",{"path":97,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":94,"sourceHtmlUrl":98},"scripts\u002Ffrontend_scaffolder.py","https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fengineering-team\u002Fsenior-frontend\u002Fscripts\u002Ffrontend_scaffolder.py",{"path":100,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fprocess.py",14683,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fropa-completeness-audit\u002Fscripts\u002Fprocess.py",[104,133,149,162,179,192],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":123,"publishedAt":26},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[110,115,118],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":116,"categoryName":117,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[124,125,22,126,127,128,129,130,131,132],"email","workplace email privacy","compliance","content","data","policy","testing","monitoring","metadata",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":143,"publishedAt":26},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[139,142],{"categoryNo":140,"categoryName":141,"taxonomyType":121,"taxonomyTypeDesc":122},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},[128,144,145,146,126,147,21,22,148],"whistleblower data","identity","reporting","data protection","prevention",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":26},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[155],{"categoryNo":140,"categoryName":141,"taxonomyType":121,"taxonomyTypeDesc":122},[128,157,158,159,160,21,22,161],"vendor termination data","planning","verification","extraction","certification",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":169,"publishedAt":26},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[168],{"categoryNo":140,"categoryName":141,"taxonomyType":121,"taxonomyTypeDesc":122},[170,171,172,173,174,175,176,177,22,128,178],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":26},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[185],{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},[22,187,21,188,175,189,190,128,178,171,161,191],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":205,"publishedAt":26},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[198,201,204],{"categoryNo":199,"categoryName":200,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":202,"categoryName":203,"taxonomyType":121,"taxonomyTypeDesc":122},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":119,"categoryName":120,"taxonomyType":121,"taxonomyTypeDesc":122},[206,19,22,207,159,208,126,21,24,178,209,210,211,158],"vendor privacy audit","report","audit report","collection","remediation-tracking","classification"]