[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF4XRWME260DKBZT1XPA29":3,"skill-same:01M6AF4XRWME260DKBZT1XPA29":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":43,"repositoryHtmlUrl":44,"repositoryHomepageUrl":6,"ownerHtmlUrl":45,"ownerBlogUrl":46,"ownerDescription":47,"updatedAt":48,"install":49,"resources":62},"01M6AF4XRWME260DKBZT1XPA29","south-africa-popia",null,"Implements compliance with South Africa's Protection of Personal Information Act (POPIA), Act No. 4 of 2013. Covers conditions for lawful processing, data subject rights, cross-border transfer restrictions, Information Regulator enforcement, and responsible party obligations. Keywords: POPIA, South Africa, Information Regulator, responsible party, operator, prior authorisation.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",337,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsouth-africa-popia\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30],"south africa popia","personal","operator","transfer","compliance","privacy","data","2026-11-10 10:12:30",false,"---\nname: south-africa-popia\ndescription: >-\n  Implements compliance with South Africa's Protection of Personal Information\n  Act (POPIA), Act No. 4 of 2013. Covers conditions for lawful processing,\n  data subject rights, cross-border transfer restrictions, Information Regulator\n  enforcement, and responsible party obligations. Keywords: POPIA, South Africa,\n  Information Regulator, responsible party, operator, prior authorisation.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: jurisdiction-compliance\n  tags: \"popia, south-africa, information-regulator, cross-border-transfer, responsible-party\"\n---\n\n# South Africa POPIA Compliance\n\n## Overview\n\nThe Protection of Personal Information Act (POPIA), Act No. 4 of 2013, is South Africa's comprehensive data protection law. It came into full effect on 1 July 2021 following a one-year grace period after commencement on 1 July 2020. POPIA is modelled broadly on EU data protection principles but is adapted to the South African constitutional framework, specifically Section 14 of the Constitution (right to privacy). The Information Regulator is the independent supervisory authority responsible for enforcement. POPIA applies to any responsible party (controller) domiciled in South Africa or that uses automated or non-automated means within South Africa to process personal information, unless those means are used only to forward information through the Republic.\n\n## Key Definitions\n\n| POPIA Term | GDPR Equivalent | Definition |\n|-----------|----------------|------------|\n| **Personal information** | Personal data | Information relating to an identifiable living natural person or identifiable existing juristic person (POPIA uniquely covers juristic persons) |\n| **Special personal information** | Special category data | Religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, criminal behaviour (Section 26) |\n| **Responsible party** | Controller | A public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing (Section 1) |\n| **Operator** | Processor | A person who processes personal information for a responsible party in terms of a contract or mandate (Section 1) |\n| **Data subject** | Data subject | The person to whom personal information relates (includes juristic persons) |\n| **Information Officer** | DPO | Head of organisation or designated person responsible for encouraging compliance (Section 55) |\n\n## Eight Conditions for Lawful Processing (Sections 8-25)\n\n### Condition 1: Accountability (Section 8)\nThe responsible party must ensure that all conditions for lawful processing are complied with at the time of determining the purpose and means of processing and during the processing itself.\n\n### Condition 2: Processing Limitation (Sections 9-12)\n- Personal information must be processed lawfully and in a reasonable manner that does not infringe the privacy of the data subject\n- Processing must be adequate, relevant, and not excessive (Section 10)\n- Consent must be voluntary, specific, and informed; may be withdrawn (Section 11)\n- Personal information may be collected directly from the data subject, with exceptions (Section 12)\n\n### Condition 3: Purpose Specification (Sections 13-14)\n- Personal information must be collected for a specific, explicitly defined, and lawful purpose related to a function or activity of the responsible party\n- Records must not be retained longer than necessary unless retention is required by law, reasonably necessary for a lawful purpose, or retention is required under a contract\n\n### Condition 4: Further Processing Limitation (Section 15)\nFurther processing must be compatible with the original purpose. Compatibility is assessed considering the relationship between purposes, nature of information, consequences for the data subject, manner of collection, and any contractual rights.\n\n### Condition 5: Information Quality (Section 16)\nThe responsible party must take reasonably practicable steps to ensure personal information is complete, accurate, not misleading, and updated where necessary.\n\n### Condition 6: Openness (Sections 17-18)\n- The responsible party must notify the Information Regulator before commencing processing (Section 17, not yet fully enforced)\n- Data subjects must be notified when their personal information is collected (Section 18)\n\n### Condition 7: Security Safeguards (Sections 19-22)\n- Appropriate technical and organisational measures must be in place to prevent loss, damage, unauthorised access (Section 19)\n- Operators must be bound by contract to establish and maintain security measures (Section 21)\n- Breach notification to the Information Regulator and data subjects is mandatory \"as soon as reasonably possible\" when there are reasonable grounds to believe a compromise has occurred (Section 22)\n\n### Condition 8: Data Subject Participation (Sections 23-25)\n- Data subjects have the right to request confirmation of processing, access to records, correction, and deletion\n- Requests must be fulfilled within a reasonable time period\n- Fees charged must not be excessive\n\n## Cross-Border Transfers (Section 72)\n\nTransfer of personal information outside South Africa is permitted only where:\n1. The recipient is subject to a law, binding corporate rules, or binding agreement providing an adequate level of protection substantially similar to POPIA\n2. The data subject consents after being informed of the risks\n3. Transfer is necessary for performance of a contract between the data subject and responsible party\n4. Transfer is necessary for implementation of pre-contractual measures taken in response to the data subject's request\n5. Transfer is for the benefit of the data subject and it is not reasonably practicable to obtain consent\n6. The information is contained in or derived from a public record\n\n## Enforcement and Penalties\n\nThe Information Regulator may:\n- Issue enforcement notices (Section 95)\n- Impose administrative fines up to ZAR 10 million (Section 109)\n- Refer matters for criminal prosecution, with imprisonment up to 10 years for certain offences (Section 107)\n- Conduct assessments (Section 89)\n- Issue codes of conduct (Section 60)\n\n## Key Enforcement Actions\n\n- **Department of Justice and Constitutional Development (2022)**: The Information Regulator issued an enforcement notice for failure to implement adequate security measures following a large-scale data breach affecting the Master of the High Court system.\n- **TransUnion South Africa (2022)**: Following a breach affecting 54 million records, the Information Regulator investigated and issued compliance directives regarding breach notification obligations and security safeguards.\n- **Department of Home Affairs (2023)**: Enforcement notice for non-compliance with data subject access requests and security safeguard conditions.\n\n## Integration Points\n\n- **breach-72h-notification**: POPIA Section 22 breach notification (note: POPIA uses \"as soon as reasonably possible\" not a fixed 72-hour clock)\n- **cross-border transfers**: Section 72 transfer restrictions apply alongside GDPR Chapter V where dual applicability exists\n- **vendor-privacy-due-diligence**: Operator agreements under Section 21 must include security obligation requirements\n- **data-inventory-mapping**: Section 17 notification to the Information Regulator requires comprehensive processing inventory\n","# South Africa POPIA Compliance\n\n## Overview\n\nThe Protection of Personal Information Act (POPIA), Act No. 4 of 2013, is South Africa's comprehensive data protection law. It came into full effect on 1 July 2021 following a one-year grace period after commencement on 1 July 2020. POPIA is modelled broadly on EU data protection principles but is adapted to the South African constitutional framework, specifically Section 14 of the Constitution (right to privacy). The Information Regulator is the independent supervisory authority responsible for enforcement. POPIA applies to any responsible party (controller) domiciled in South Africa or that uses automated or non-automated means within South Africa to process personal information, unless those means are used only to forward information through the Republic.\n\n## Key Definitions\n\n| POPIA Term | GDPR Equivalent | Definition |\n|-----------|----------------|------------|\n| **Personal information** | Personal data | Information relating to an identifiable living natural person or identifiable existing juristic person (POPIA uniquely covers juristic persons) |\n| **Special personal information** | Special category data | Religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health, sex life, biometric information, criminal behaviour (Section 26) |\n| **Responsible party** | Controller | A public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing (Section 1) |\n| **Operator** | Processor | A person who processes personal information for a responsible party in terms of a contract or mandate (Section 1) |\n| **Data subject** | Data subject | The person to whom personal information relates (includes juristic persons) |\n| **Information Officer** | DPO | Head of organisation or designated person responsible for encouraging compliance (Section 55) |\n\n## Eight Conditions for Lawful Processing (Sections 8-25)\n\n### Condition 1: Accountability (Section 8)\nThe responsible party must ensure that all conditions for lawful processing are complied with at the time of determining the purpose and means of processing and during the processing itself.\n\n### Condition 2: Processing Limitation (Sections 9-12)\n- Personal information must be processed lawfully and in a reasonable manner that does not infringe the privacy of the data subject\n- Processing must be adequate, relevant, and not excessive (Section 10)\n- Consent must be voluntary, specific, and informed; may be withdrawn (Section 11)\n- Personal information may be collected directly from the data subject, with exceptions (Section 12)\n\n### Condition 3: Purpose Specification (Sections 13-14)\n- Personal information must be collected for a specific, explicitly defined, and lawful purpose related to a function or activity of the responsible party\n- Records must not be retained longer than necessary unless retention is required by law, reasonably necessary for a lawful purpose, or retention is required under a contract\n\n### Condition 4: Further Processing Limitation (Section 15)\nFurther processing must be compatible with the original purpose. Compatibility is assessed considering the relationship between purposes, nature of information, consequences for the data subject, manner of collection, and any contractual rights.\n\n### Condition 5: Information Quality (Section 16)\nThe responsible party must take reasonably practicable steps to ensure personal information is complete, accurate, not misleading, and updated where necessary.\n\n### Condition 6: Openness (Sections 17-18)\n- The responsible party must notify the Information Regulator before commencing processing (Section 17, not yet fully enforced)\n- Data subjects must be notified when their personal information is collected (Section 18)\n\n### Condition 7: Security Safeguards (Sections 19-22)\n- Appropriate technical and organisational measures must be in place to prevent loss, damage, unauthorised access (Section 19)\n- Operators must be bound by contract to establish and maintain security measures (Section 21)\n- Breach notification to the Information Regulator and data subjects is mandatory \"as soon as reasonably possible\" when there are reasonable grounds to believe a compromise has occurred (Section 22)\n\n### Condition 8: Data Subject Participation (Sections 23-25)\n- Data subjects have the right to request confirmation of processing, access to records, correction, and deletion\n- Requests must be fulfilled within a reasonable time period\n- Fees charged must not be excessive\n\n## Cross-Border Transfers (Section 72)\n\nTransfer of personal information outside South Africa is permitted only where:\n1. The recipient is subject to a law, binding corporate rules, or binding agreement providing an adequate level of protection substantially similar to POPIA\n2. The data subject consents after being informed of the risks\n3. Transfer is necessary for performance of a contract between the data subject and responsible party\n4. Transfer is necessary for implementation of pre-contractual measures taken in response to the data subject's request\n5. Transfer is for the benefit of the data subject and it is not reasonably practicable to obtain consent\n6. The information is contained in or derived from a public record\n\n## Enforcement and Penalties\n\nThe Information Regulator may:\n- Issue enforcement notices (Section 95)\n- Impose administrative fines up to ZAR 10 million (Section 109)\n- Refer matters for criminal prosecution, with imprisonment up to 10 years for certain offences (Section 107)\n- Conduct assessments (Section 89)\n- Issue codes of conduct (Section 60)\n\n## Key Enforcement Actions\n\n- **Department of Justice and Constitutional Development (2022)**: The Information Regulator issued an enforcement notice for failure to implement adequate security measures following a large-scale data breach affecting the Master of the High Court system.\n- **TransUnion South Africa (2022)**: Following a breach affecting 54 million records, the Information Regulator investigated and issued compliance directives regarding breach notification obligations and security safeguards.\n- **Department of Home Affairs (2023)**: Enforcement notice for non-compliance with data subject access requests and security safeguard conditions.\n\n## Integration Points\n\n- **breach-72h-notification**: POPIA Section 22 breach notification (note: POPIA uses \"as soon as reasonably possible\" not a fixed 72-hour clock)\n- **cross-border transfers**: Section 72 transfer restrictions apply alongside GDPR Chapter V where dual applicability exists\n- **vendor-privacy-due-diligence**: Operator agreements under Section 21 must include security obligation requirements\n- **data-inventory-mapping**: Section 17 notification to the Information Regulator requires comprehensive processing inventory\n",{"name":5,"license":15,"metadata":36,"description":7},{"tags":37,"author":9,"domain":29,"version":38,"subdomain":39},"popia, south-africa, information-regulator, cross-border-transfer, responsible-party","1.0","jurisdiction-compliance","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsouth-africa-popia",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill south-africa-popia",{"tool":55,"command":56},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill south-africa-popia",{"tool":58,"command":59},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill south-africa-popia","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsouth-africa-popia\u002FSKILL.md",true,[63,69,75,79],{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"assets\u002Ftemplate.md","ASSET","资产文件",6121,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsouth-africa-popia\u002Fassets\u002Ftemplate.md",{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fstandards.md","REFERENCE","参考文档",4292,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsouth-africa-popia\u002Freferences\u002Fstandards.md",{"path":76,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fworkflows.md",7584,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsouth-africa-popia\u002Freferences\u002Fworkflows.md",{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"scripts\u002Fprocess.py","SCRIPT","脚本",13059,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fsouth-africa-popia\u002Fscripts\u002Fprocess.py",[86,109,126,139,155,168],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":101,"publishedAt":31},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[92,97,100],{"categoryNo":93,"categoryName":94,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":98,"categoryName":99,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[102,103,29,28,104,30,105,106,107,108],"email","workplace email privacy","content","policy","testing","monitoring","metadata",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":119,"publishedAt":31},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[115,118],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[30,120,121,122,28,123,124,29,125],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":133,"publishedAt":31},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[132],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},[30,134,135,136,137,124,29,138],"vendor termination data","planning","verification","extraction","certification",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":31},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[145],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},[147,148,149,150,151,152,27,153,29,30,154],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","certifications","processor",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":31},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[161],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[29,163,124,164,152,165,166,30,154,148,138,167],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":181,"publishedAt":31},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[174,177,180],{"categoryNo":175,"categoryName":176,"taxonomyType":95,"taxonomyTypeDesc":96},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":178,"categoryName":179,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[182,183,29,184,136,185,28,124,186,154,187,188,189,135],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]