[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF65WDX2F0AV4VD92YBA14":3,"skill-same:01M6AF65WDX2F0AV4VD92YBA14":94},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M6AF65WDX2F0AV4VD92YBA14","turkey-kvkk",null,"Implements compliance with Turkey's Personal Data Protection Law (Kisisel Verilerin Korunmasi Kanunu, KVKK, Law No. 6698). Covers data controller obligations, data subject rights, VERBIS registration, cross-border transfer restrictions, Board decisions, and administrative fines. Keywords: KVKK, Turkey, VERBIS, data controller registry, Board decision, cross-border.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fturkey-kvkk\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务",[27,28,29,30,31,32,33,34,35],"turkey kvkk","personal","registry","transfer","compliance","data protection","privacy","data","controller","2026-11-10 10:12:30",false,"---\nname: turkey-kvkk\ndescription: >-\n  Implements compliance with Turkey's Personal Data Protection Law (Kisisel\n  Verilerin Korunmasi Kanunu, KVKK, Law No. 6698). Covers data controller\n  obligations, data subject rights, VERBIS registration, cross-border transfer\n  restrictions, Board decisions, and administrative fines. Keywords: KVKK,\n  Turkey, VERBIS, data controller registry, Board decision, cross-border.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: jurisdiction-compliance\n  tags: \"kvkk, turkey, verbis, cross-border-transfer, data-controller-registry\"\n---\n\n# Turkey KVKK Compliance\n\n## Overview\n\nThe Kisisel Verilerin Korunmasi Kanunu (KVKK), Law No. 6698, is Turkey's comprehensive personal data protection law. It was published in the Official Gazette on 7 April 2016 and entered into force on the same date. The KVKK is modelled on the EU Data Protection Directive 95\u002F46\u002FEC and shares structural similarities with the GDPR, though there are significant differences in cross-border transfer mechanisms, consent requirements, and the role of the Personal Data Protection Authority (Kisisel Verileri Koruma Kurumu, KVKK Authority) and its decision-making body, the Personal Data Protection Board (Kurul).\n\nTurkey applied for EU membership in 1987, and the KVKK was enacted partly to align with EU data protection standards. However, Turkey has not received an adequacy decision from the European Commission under GDPR Article 45, which creates complexity for EU-Turkey data flows.\n\n## Key Definitions\n\n| Turkish Term | English | GDPR Equivalent |\n|-------------|---------|----------------|\n| Kisisel veri | Personal data | Personal data (Art. 4(1)) |\n| Ozel nitelikli kisisel veri | Special category personal data | Special category data (Art. 9) |\n| Veri sorumlusu | Data controller | Controller (Art. 4(7)) |\n| Veri isleyen | Data processor | Processor (Art. 4(8)) |\n| Ilgili kisi | Data subject \u002F Relevant person | Data subject |\n| Acik riza | Explicit consent | Consent |\n| VERBIS | Data Controllers Registry | No direct equivalent (registration system) |\n\n## Lawful Bases for Processing (Article 5)\n\nProcessing of personal data is prohibited without the explicit consent of the data subject, except where:\n\n1. **Expressly provided by law** — processing is clearly laid down in legislation\n2. **Necessary for protection of life or physical integrity** — where the data subject or another person is physically or legally incapable of giving consent\n3. **Necessary for performance of a contract** — directly related to establishing or performing a contract\n4. **Necessary for the controller to fulfil a legal obligation**\n5. **Data made public by the data subject** — manifestly made public\n6. **Necessary for establishment, exercise, or defence of a right**\n7. **Necessary for legitimate interests of the controller** — provided this does not violate fundamental rights and freedoms of the data subject\n\n## Special Category Data (Article 6)\n\nSpecial category data includes: race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, appearance and dressing, association\u002Ffoundation\u002Funion membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data.\n\nProcessing requires either:\n- Explicit consent of the data subject, OR\n- Express authorisation by law (for categories other than health and sexual life)\n- For health and sexual life data: processing by persons or authorised institutions under secrecy obligations for purposes of public health, preventive medicine, medical diagnosis, treatment, care, or health service management\n\n## VERBIS — Data Controllers Registry\n\nAll data controllers meeting the registration threshold must register with VERBIS (Veri Sorumlulari Sicil Bilgi Sistemi). Registration requires disclosure of:\n- Identity and contact information of the data controller and representative\n- Purpose of data processing\n- Categories of data subjects and personal data\n- Recipients or categories of recipients\n- Personal data transferred abroad and transfer safeguards\n- Maximum retention periods\n- Security measures taken\n\n**Exemptions from VERBIS**: The Board has exempted certain categories including data controllers processing data as required by law, data controllers with fewer than 50 employees and less than TRY 100 million annual turnover (provided core activity is not special category data processing), and notaries.\n\n## Cross-Border Transfers (Article 9)\n\nTransfer of personal data abroad requires:\n1. **Explicit consent** of the data subject, OR\n2. One of the Article 5(2) or Article 6(3) conditions is met, AND one of:\n   - Transfer is to a country with **adequate protection** (as determined by the Board — as of 2026 the Board has not yet published a list of adequate countries)\n   - Data controllers in Turkey and abroad provide **adequate protection in writing** and the Board grants permission\n   - **Binding corporate rules** approved by the Board\n\n**2024 Amendment**: The KVKK was amended in March 2024 to introduce new cross-border transfer mechanisms including standard contractual clauses and adequacy decisions aligned more closely with GDPR Chapter V, with transitional provisions extending to 1 September 2024.\n\n## Data Subject Rights (Article 11)\n\nData subjects have the right to:\n1. Learn whether their personal data is being processed\n2. Request information about processing if data has been processed\n3. Learn the purpose of processing and whether data is used in accordance with its purpose\n4. Know the third parties to whom personal data is transferred domestically or abroad\n5. Request rectification of incomplete or inaccurate data\n6. Request erasure or destruction of personal data under Article 7\n7. Request notification of rectification\u002Ferasure to third parties\n8. Object to a result that is against them produced by analysis of processed data exclusively through automated systems\n9. Claim compensation for damages arising from unlawful processing\n\n## Enforcement and Penalties\n\nThe Personal Data Protection Board may impose administrative fines:\n- **TRY 5,000 to 1,000,000** for failure to comply with the obligation to inform (Article 10)\n- **TRY 15,000 to 1,000,000** for failure to comply with data security obligations (Article 12)\n- **TRY 25,000 to 1,000,000** for failure to comply with Board decisions (Article 15)\n- **TRY 20,000 to 1,000,000** for failure to register with VERBIS (Article 16)\n\nFine amounts are adjusted annually based on the revaluation rate.\n\n## Key Board Decisions\n\n- **Decision 2019\u002F78**: Guidelines on explicit consent — consent must be freely given, informed, specific, and an unambiguous indication of will\n- **Decision 2019\u002F10**: Data controller and data processor distinction — clarified responsibilities and contractual requirements\n- **Decision 2020\u002F915**: Cookie consent requirements — prior consent required for non-essential cookies\n- **Decision 2022\u002F1**: Cross-border transfer assessment criteria prior to the 2024 amendments\n\n## Integration Points\n\n- **cross-border transfers**: KVKK Article 9 transfer mechanisms interact with GDPR Chapter V for EU-Turkey flows\n- **vendor-privacy-due-diligence**: Data processor agreements must include Article 12 security obligations\n- **breach-72h-notification**: KVKK Article 12(5) requires notification to the Board \"as soon as possible\" (Board guideline suggests 72 hours)\n- **data-inventory-mapping**: VERBIS registration requires comprehensive processing inventory\n","# Turkey KVKK Compliance\n\n## Overview\n\nThe Kisisel Verilerin Korunmasi Kanunu (KVKK), Law No. 6698, is Turkey's comprehensive personal data protection law. It was published in the Official Gazette on 7 April 2016 and entered into force on the same date. The KVKK is modelled on the EU Data Protection Directive 95\u002F46\u002FEC and shares structural similarities with the GDPR, though there are significant differences in cross-border transfer mechanisms, consent requirements, and the role of the Personal Data Protection Authority (Kisisel Verileri Koruma Kurumu, KVKK Authority) and its decision-making body, the Personal Data Protection Board (Kurul).\n\nTurkey applied for EU membership in 1987, and the KVKK was enacted partly to align with EU data protection standards. However, Turkey has not received an adequacy decision from the European Commission under GDPR Article 45, which creates complexity for EU-Turkey data flows.\n\n## Key Definitions\n\n| Turkish Term | English | GDPR Equivalent |\n|-------------|---------|----------------|\n| Kisisel veri | Personal data | Personal data (Art. 4(1)) |\n| Ozel nitelikli kisisel veri | Special category personal data | Special category data (Art. 9) |\n| Veri sorumlusu | Data controller | Controller (Art. 4(7)) |\n| Veri isleyen | Data processor | Processor (Art. 4(8)) |\n| Ilgili kisi | Data subject \u002F Relevant person | Data subject |\n| Acik riza | Explicit consent | Consent |\n| VERBIS | Data Controllers Registry | No direct equivalent (registration system) |\n\n## Lawful Bases for Processing (Article 5)\n\nProcessing of personal data is prohibited without the explicit consent of the data subject, except where:\n\n1. **Expressly provided by law** — processing is clearly laid down in legislation\n2. **Necessary for protection of life or physical integrity** — where the data subject or another person is physically or legally incapable of giving consent\n3. **Necessary for performance of a contract** — directly related to establishing or performing a contract\n4. **Necessary for the controller to fulfil a legal obligation**\n5. **Data made public by the data subject** — manifestly made public\n6. **Necessary for establishment, exercise, or defence of a right**\n7. **Necessary for legitimate interests of the controller** — provided this does not violate fundamental rights and freedoms of the data subject\n\n## Special Category Data (Article 6)\n\nSpecial category data includes: race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, appearance and dressing, association\u002Ffoundation\u002Funion membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data.\n\nProcessing requires either:\n- Explicit consent of the data subject, OR\n- Express authorisation by law (for categories other than health and sexual life)\n- For health and sexual life data: processing by persons or authorised institutions under secrecy obligations for purposes of public health, preventive medicine, medical diagnosis, treatment, care, or health service management\n\n## VERBIS — Data Controllers Registry\n\nAll data controllers meeting the registration threshold must register with VERBIS (Veri Sorumlulari Sicil Bilgi Sistemi). Registration requires disclosure of:\n- Identity and contact information of the data controller and representative\n- Purpose of data processing\n- Categories of data subjects and personal data\n- Recipients or categories of recipients\n- Personal data transferred abroad and transfer safeguards\n- Maximum retention periods\n- Security measures taken\n\n**Exemptions from VERBIS**: The Board has exempted certain categories including data controllers processing data as required by law, data controllers with fewer than 50 employees and less than TRY 100 million annual turnover (provided core activity is not special category data processing), and notaries.\n\n## Cross-Border Transfers (Article 9)\n\nTransfer of personal data abroad requires:\n1. **Explicit consent** of the data subject, OR\n2. One of the Article 5(2) or Article 6(3) conditions is met, AND one of:\n   - Transfer is to a country with **adequate protection** (as determined by the Board — as of 2026 the Board has not yet published a list of adequate countries)\n   - Data controllers in Turkey and abroad provide **adequate protection in writing** and the Board grants permission\n   - **Binding corporate rules** approved by the Board\n\n**2024 Amendment**: The KVKK was amended in March 2024 to introduce new cross-border transfer mechanisms including standard contractual clauses and adequacy decisions aligned more closely with GDPR Chapter V, with transitional provisions extending to 1 September 2024.\n\n## Data Subject Rights (Article 11)\n\nData subjects have the right to:\n1. Learn whether their personal data is being processed\n2. Request information about processing if data has been processed\n3. Learn the purpose of processing and whether data is used in accordance with its purpose\n4. Know the third parties to whom personal data is transferred domestically or abroad\n5. Request rectification of incomplete or inaccurate data\n6. Request erasure or destruction of personal data under Article 7\n7. Request notification of rectification\u002Ferasure to third parties\n8. Object to a result that is against them produced by analysis of processed data exclusively through automated systems\n9. Claim compensation for damages arising from unlawful processing\n\n## Enforcement and Penalties\n\nThe Personal Data Protection Board may impose administrative fines:\n- **TRY 5,000 to 1,000,000** for failure to comply with the obligation to inform (Article 10)\n- **TRY 15,000 to 1,000,000** for failure to comply with data security obligations (Article 12)\n- **TRY 25,000 to 1,000,000** for failure to comply with Board decisions (Article 15)\n- **TRY 20,000 to 1,000,000** for failure to register with VERBIS (Article 16)\n\nFine amounts are adjusted annually based on the revaluation rate.\n\n## Key Board Decisions\n\n- **Decision 2019\u002F78**: Guidelines on explicit consent — consent must be freely given, informed, specific, and an unambiguous indication of will\n- **Decision 2019\u002F10**: Data controller and data processor distinction — clarified responsibilities and contractual requirements\n- **Decision 2020\u002F915**: Cookie consent requirements — prior consent required for non-essential cookies\n- **Decision 2022\u002F1**: Cross-border transfer assessment criteria prior to the 2024 amendments\n\n## Integration Points\n\n- **cross-border transfers**: KVKK Article 9 transfer mechanisms interact with GDPR Chapter V for EU-Turkey flows\n- **vendor-privacy-due-diligence**: Data processor agreements must include Article 12 security obligations\n- **breach-72h-notification**: KVKK Article 12(5) requires notification to the Board \"as soon as possible\" (Board guideline suggests 72 hours)\n- **data-inventory-mapping**: VERBIS registration requires comprehensive processing inventory\n",{"name":5,"license":15,"metadata":41,"description":7},{"tags":42,"author":9,"domain":33,"version":43,"subdomain":44},"kvkk, turkey, verbis, cross-border-transfer, data-controller-registry","1.0","jurisdiction-compliance","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Fturkey-kvkk",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill turkey-kvkk",{"tool":60,"command":61},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill turkey-kvkk",{"tool":63,"command":64},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill turkey-kvkk","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fturkey-kvkk\u002FSKILL.md",true,[68,74,80,84,88],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"agents\u002Fopenai.yaml","REFERENCE","参考文档",113,"https:\u002F\u002Fgithub.com\u002Ffderuiter\u002FQRCraftly-web\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fresolving-merge-conflicts\u002Fagents\u002Fopenai.yaml",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"assets\u002Ftemplate.md","ASSET","资产文件",5526,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fturkey-kvkk\u002Fassets\u002Ftemplate.md",{"path":81,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fstandards.md",4953,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fturkey-kvkk\u002Freferences\u002Fstandards.md",{"path":85,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fworkflows.md",8511,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fturkey-kvkk\u002Freferences\u002Fworkflows.md",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fprocess.py","SCRIPT","脚本",14240,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fturkey-kvkk\u002Fscripts\u002Fprocess.py",[95,118,132,145,161,174],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":110,"publishedAt":36},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[101,106,109],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":107,"categoryName":108,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[111,112,33,31,113,34,114,115,116,117],"email","workplace email privacy","content","policy","testing","monitoring","metadata",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":126,"publishedAt":36},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[124,125],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[34,127,128,129,31,32,130,33,131],"whistleblower data","identity","reporting","gdpr","prevention",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":139,"publishedAt":36},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[138],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[34,140,141,142,143,130,33,144],"vendor termination data","planning","verification","extraction","certification",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":36},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[151],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,154,155,156,157,158,30,159,33,34,160],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","certifications","processor",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":168,"publishedAt":36},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[167],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[33,169,130,170,158,171,172,34,160,154,144,173],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":187,"publishedAt":36},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[180,183,186],{"categoryNo":181,"categoryName":182,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":184,"categoryName":185,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[188,189,33,190,142,191,31,130,192,160,193,194,195,141],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]