[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF7C7STX8FPWDM1NJEMW2T":3,"skill-same:01M6AF7C7STX8FPWDM1NJEMW2T":98},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":47,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M6AF7C7STX8FPWDM1NJEMW2T","vendor-termination-data",null,"Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fvendor-termination-data\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31],"data","vendor termination data","planning","verification","extraction","gdpr","privacy","certification","2026-11-10 10:12:30",false,"---\nname: vendor-termination-data\ndescription: >-\n  Vendor termination data return and deletion procedures per GDPR Article\n  28(3)(g). Covers data extraction formats, deletion certification requirements,\n  transition planning, residual data handling, and post-termination verification.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: vendor-privacy-management\n  tags: \"vendor-termination, data-return, deletion-certification, art-28-termination, data-portability\"\n---\n\n# Vendor Termination Data Return and Deletion\n\n## Overview\n\nGDPR Article 28(3)(g) requires that at the choice of the controller, the processor shall \"delete or return all the personal data to the controller after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the personal data.\" This termination obligation ensures that personal data does not persist at a former processor beyond the legitimate processing period.\n\nThe EDPB Guidelines 07\u002F2020 (paragraph 108) emphasize that this obligation extends to all copies, backups, and derived data — not just production data. The deletion must be verifiable, and the controller should obtain written certification.\n\nAt Summit Cloud Partners, the Vendor Termination Data Protocol provides a structured process for managing data return and deletion when vendor relationships end.\n\n## Termination Triggers\n\n| Trigger | Description | Timeline Considerations |\n|---------|-------------|----------------------|\n| Contract expiry (non-renewal) | MSA\u002FDPA term ends without renewal | 90-day notice per DPA |\n| Termination for convenience | Controller elects to terminate | Per MSA notice period |\n| Termination for cause | Material DPA breach by processor | Immediate or per cure period |\n| Service migration | Controller moves to alternative provider | Overlap period for data migration |\n| Vendor insolvency | Processor enters insolvency proceedings | Emergency data retrieval |\n| Regulatory order | Supervisory authority orders cessation | Per order timeline |\n\n## Data Return Process\n\n### Step 1: Data Inventory and Mapping\n\nBefore initiating return, confirm the complete scope of personal data held by the processor:\n\n| Data Category | Location | Format | Volume | Retention Basis |\n|--------------|----------|--------|--------|----------------|\n| Production data | Primary database | Structured (SQL\u002FJSON) | [Volume] | DPA processing |\n| Backup data | Backup storage | Encrypted backup files | [Volume] | Business continuity per DPA |\n| Log data | Log storage | Semi-structured (JSON\u002Ftext) | [Volume] | Security monitoring |\n| Derived\u002Faggregated data | Analytics system | Structured | [Volume] | Processing output |\n| Metadata | Various systems | Structured | [Volume] | System operation |\n| Cached data | CDN\u002Fcache layers | Various | [Volume] | Performance |\n\n### Step 2: Data Export Format and Method\n\n**Standard Export Formats:**\n\n| Data Type | Preferred Format | Alternative Format | Notes |\n|-----------|-----------------|-------------------|-------|\n| Structured data | CSV with defined schema | JSON, XML, Parquet | UTF-8 encoding required |\n| Documents | Original format (PDF, DOCX) | ZIP archive | Preserve directory structure |\n| Images\u002Fmedia | Original format (PNG, JPEG) | ZIP archive | Preserve metadata |\n| Logs | JSON lines (JSONL) | CSV | Include timestamps |\n| API-accessible data | Direct API extraction | Bulk export endpoint | Paginated if large |\n\n**Export Methods:**\n\n| Method | When to Use | Security Requirements |\n|--------|-----------|----------------------|\n| Encrypted file transfer (SFTP) | Large datasets | TLS 1.2+, PGP encryption |\n| Secure API extraction | Structured, API-accessible data | OAuth 2.0, TLS 1.3 |\n| Encrypted portable media | Very large datasets without bandwidth | AES-256 encryption, tracked courier |\n| Cloud-to-cloud migration | Cloud provider transition | Encrypted transfer, access audit |\n\n### Step 3: Data Validation\n\nUpon receiving returned data, Summit Cloud Partners validates:\n\n| Validation Check | Method | Pass Criteria |\n|-----------------|--------|---------------|\n| Completeness | Record count comparison | Returned count matches source count |\n| Integrity | Checksum verification (SHA-256) | Checksums match vendor-provided manifest |\n| Format compliance | Schema validation | All fields present per agreed schema |\n| Encoding | Character encoding verification | UTF-8 without corruption |\n| Sample verification | Random sample manual review | Data content matches expectations |\n\n## Data Deletion Process\n\n### Deletion Scope\n\nThe processor must delete ALL copies of personal data, including:\n\n1. **Production data** — Primary databases and data stores\n2. **Backup data** — All backup copies including off-site backups\n3. **Disaster recovery copies** — DR site data\n4. **Log data** — Application logs, access logs, audit logs containing personal data\n5. **Cached data** — CDN caches, application caches, database caches\n6. **Derived data** — Analytics outputs, aggregated data containing personal data\n7. **Metadata** — System metadata referencing personal data\n8. **Archived data** — Any archived copies\n9. **Sub-processor data** — Data at all sub-processors\n\n### Deletion Methods\n\n| Data Location | Deletion Method | Verification |\n|--------------|----------------|--------------|\n| Databases (SQL) | DELETE + VACUUM or DROP TABLE | Query confirmation; storage analysis |\n| Object storage (S3\u002FBlob) | Delete all objects + bucket | Bucket listing verification |\n| File systems | Secure overwrite (NIST 800-88) | Disk analysis confirmation |\n| SSD\u002FFlash storage | Crypto-erase (destroy encryption key) | Vendor attestation |\n| Backup tapes | Degaussing or physical destruction | Destruction certificate |\n| Application caches | Cache flush + TTL expiry confirmation | Application verification |\n| Log systems | Targeted log deletion or retention expiry | Log query confirmation |\n| Sub-processors | Cascade deletion instruction | Sub-processor deletion certificate |\n\n### Deletion Timeline\n\n| Phase | Activity | DPA Standard Timeline |\n|-------|----------|----------------------|\n| T+0 | Controller elects deletion (or return + deletion) | Upon termination notice |\n| T+0 to T+30 | Data return completed (if return elected) | 30 calendar days |\n| T+30 to T+60 | Production data deletion | 60 calendar days from termination |\n| T+60 to T+90 | Backup and archive deletion | 90 calendar days from termination |\n| T+90 | Deletion certification issued | 90 calendar days from termination |\n\n### Deletion Exceptions\n\nArticle 28(3)(g) permits continued storage where \"Union or Member State law requires storage of the personal data.\" Exceptions must be:\n\n| Requirement | Processor Action |\n|------------|-----------------|\n| Documented in writing | Processor identifies specific legal requirement |\n| Limited to required data | Only data subject to legal retention requirement |\n| Isolated from production | Retained data moved to restricted storage |\n| Time-limited | Retained only for legally required duration |\n| Notified to controller | Controller informed of retention and legal basis |\n\n## Deletion Certification\n\nThe processor must provide a written deletion certification containing:\n\n| Field | Content |\n|-------|---------|\n| Certifying party | Name and title of authorized processor representative |\n| Controller name | Summit Cloud Partners |\n| DPA reference | Reference to terminated DPA |\n| Deletion scope | Description of all data deleted (categories, locations, formats) |\n| Deletion date(s) | Date each deletion action was completed |\n| Deletion method(s) | Technical method used for each data location |\n| Sub-processor deletion | Confirmation that all sub-processors have also deleted data |\n| Exceptions | Any data retained under legal obligation (with legal basis citation) |\n| Certification date | Date of certification |\n| Signature | Authorized officer signature |\n\n## Transition Planning\n\nFor service migrations, a transition plan ensures continuity while managing data protection obligations:\n\n| Phase | Activity | Duration |\n|-------|----------|----------|\n| **Planning** | Define data migration scope, format, timeline | 4-6 weeks |\n| **Parallel operation** | Old and new vendor operate simultaneously | 2-4 weeks |\n| **Migration** | Data transferred from old to new vendor | 1-2 weeks |\n| **Validation** | Verify complete and accurate migration | 1 week |\n| **Cutover** | Switch production to new vendor | 1 day |\n| **Decommission** | Terminate old vendor; initiate deletion | Per DPA timeline |\n| **Deletion verification** | Confirm old vendor data deletion | 90 days |\n\n## Key Regulatory References\n\n- GDPR Article 28(3)(g) — Deletion or return of personal data upon termination\n- GDPR Article 17 — Right to erasure (informs deletion standards)\n- GDPR Article 5(1)(e) — Storage limitation principle\n- EDPB Guidelines 07\u002F2020 — Paragraph 108 on termination data obligations\n- NIST SP 800-88 Rev. 1 — Guidelines for Media Sanitization\n- ISO\u002FIEC 27001:2022 — A.8.10 Information deletion\n","# Vendor Termination Data Return and Deletion\n\n## Overview\n\nGDPR Article 28(3)(g) requires that at the choice of the controller, the processor shall \"delete or return all the personal data to the controller after the end of the provision of services relating to processing, and delete existing copies unless Union or Member State law requires storage of the personal data.\" This termination obligation ensures that personal data does not persist at a former processor beyond the legitimate processing period.\n\nThe EDPB Guidelines 07\u002F2020 (paragraph 108) emphasize that this obligation extends to all copies, backups, and derived data — not just production data. The deletion must be verifiable, and the controller should obtain written certification.\n\nAt Summit Cloud Partners, the Vendor Termination Data Protocol provides a structured process for managing data return and deletion when vendor relationships end.\n\n## Termination Triggers\n\n| Trigger | Description | Timeline Considerations |\n|---------|-------------|----------------------|\n| Contract expiry (non-renewal) | MSA\u002FDPA term ends without renewal | 90-day notice per DPA |\n| Termination for convenience | Controller elects to terminate | Per MSA notice period |\n| Termination for cause | Material DPA breach by processor | Immediate or per cure period |\n| Service migration | Controller moves to alternative provider | Overlap period for data migration |\n| Vendor insolvency | Processor enters insolvency proceedings | Emergency data retrieval |\n| Regulatory order | Supervisory authority orders cessation | Per order timeline |\n\n## Data Return Process\n\n### Step 1: Data Inventory and Mapping\n\nBefore initiating return, confirm the complete scope of personal data held by the processor:\n\n| Data Category | Location | Format | Volume | Retention Basis |\n|--------------|----------|--------|--------|----------------|\n| Production data | Primary database | Structured (SQL\u002FJSON) | [Volume] | DPA processing |\n| Backup data | Backup storage | Encrypted backup files | [Volume] | Business continuity per DPA |\n| Log data | Log storage | Semi-structured (JSON\u002Ftext) | [Volume] | Security monitoring |\n| Derived\u002Faggregated data | Analytics system | Structured | [Volume] | Processing output |\n| Metadata | Various systems | Structured | [Volume] | System operation |\n| Cached data | CDN\u002Fcache layers | Various | [Volume] | Performance |\n\n### Step 2: Data Export Format and Method\n\n**Standard Export Formats:**\n\n| Data Type | Preferred Format | Alternative Format | Notes |\n|-----------|-----------------|-------------------|-------|\n| Structured data | CSV with defined schema | JSON, XML, Parquet | UTF-8 encoding required |\n| Documents | Original format (PDF, DOCX) | ZIP archive | Preserve directory structure |\n| Images\u002Fmedia | Original format (PNG, JPEG) | ZIP archive | Preserve metadata |\n| Logs | JSON lines (JSONL) | CSV | Include timestamps |\n| API-accessible data | Direct API extraction | Bulk export endpoint | Paginated if large |\n\n**Export Methods:**\n\n| Method | When to Use | Security Requirements |\n|--------|-----------|----------------------|\n| Encrypted file transfer (SFTP) | Large datasets | TLS 1.2+, PGP encryption |\n| Secure API extraction | Structured, API-accessible data | OAuth 2.0, TLS 1.3 |\n| Encrypted portable media | Very large datasets without bandwidth | AES-256 encryption, tracked courier |\n| Cloud-to-cloud migration | Cloud provider transition | Encrypted transfer, access audit |\n\n### Step 3: Data Validation\n\nUpon receiving returned data, Summit Cloud Partners validates:\n\n| Validation Check | Method | Pass Criteria |\n|-----------------|--------|---------------|\n| Completeness | Record count comparison | Returned count matches source count |\n| Integrity | Checksum verification (SHA-256) | Checksums match vendor-provided manifest |\n| Format compliance | Schema validation | All fields present per agreed schema |\n| Encoding | Character encoding verification | UTF-8 without corruption |\n| Sample verification | Random sample manual review | Data content matches expectations |\n\n## Data Deletion Process\n\n### Deletion Scope\n\nThe processor must delete ALL copies of personal data, including:\n\n1. **Production data** — Primary databases and data stores\n2. **Backup data** — All backup copies including off-site backups\n3. **Disaster recovery copies** — DR site data\n4. **Log data** — Application logs, access logs, audit logs containing personal data\n5. **Cached data** — CDN caches, application caches, database caches\n6. **Derived data** — Analytics outputs, aggregated data containing personal data\n7. **Metadata** — System metadata referencing personal data\n8. **Archived data** — Any archived copies\n9. **Sub-processor data** — Data at all sub-processors\n\n### Deletion Methods\n\n| Data Location | Deletion Method | Verification |\n|--------------|----------------|--------------|\n| Databases (SQL) | DELETE + VACUUM or DROP TABLE | Query confirmation; storage analysis |\n| Object storage (S3\u002FBlob) | Delete all objects + bucket | Bucket listing verification |\n| File systems | Secure overwrite (NIST 800-88) | Disk analysis confirmation |\n| SSD\u002FFlash storage | Crypto-erase (destroy encryption key) | Vendor attestation |\n| Backup tapes | Degaussing or physical destruction | Destruction certificate |\n| Application caches | Cache flush + TTL expiry confirmation | Application verification |\n| Log systems | Targeted log deletion or retention expiry | Log query confirmation |\n| Sub-processors | Cascade deletion instruction | Sub-processor deletion certificate |\n\n### Deletion Timeline\n\n| Phase | Activity | DPA Standard Timeline |\n|-------|----------|----------------------|\n| T+0 | Controller elects deletion (or return + deletion) | Upon termination notice |\n| T+0 to T+30 | Data return completed (if return elected) | 30 calendar days |\n| T+30 to T+60 | Production data deletion | 60 calendar days from termination |\n| T+60 to T+90 | Backup and archive deletion | 90 calendar days from termination |\n| T+90 | Deletion certification issued | 90 calendar days from termination |\n\n### Deletion Exceptions\n\nArticle 28(3)(g) permits continued storage where \"Union or Member State law requires storage of the personal data.\" Exceptions must be:\n\n| Requirement | Processor Action |\n|------------|-----------------|\n| Documented in writing | Processor identifies specific legal requirement |\n| Limited to required data | Only data subject to legal retention requirement |\n| Isolated from production | Retained data moved to restricted storage |\n| Time-limited | Retained only for legally required duration |\n| Notified to controller | Controller informed of retention and legal basis |\n\n## Deletion Certification\n\nThe processor must provide a written deletion certification containing:\n\n| Field | Content |\n|-------|---------|\n| Certifying party | Name and title of authorized processor representative |\n| Controller name | Summit Cloud Partners |\n| DPA reference | Reference to terminated DPA |\n| Deletion scope | Description of all data deleted (categories, locations, formats) |\n| Deletion date(s) | Date each deletion action was completed |\n| Deletion method(s) | Technical method used for each data location |\n| Sub-processor deletion | Confirmation that all sub-processors have also deleted data |\n| Exceptions | Any data retained under legal obligation (with legal basis citation) |\n| Certification date | Date of certification |\n| Signature | Authorized officer signature |\n\n## Transition Planning\n\nFor service migrations, a transition plan ensures continuity while managing data protection obligations:\n\n| Phase | Activity | Duration |\n|-------|----------|----------|\n| **Planning** | Define data migration scope, format, timeline | 4-6 weeks |\n| **Parallel operation** | Old and new vendor operate simultaneously | 2-4 weeks |\n| **Migration** | Data transferred from old to new vendor | 1-2 weeks |\n| **Validation** | Verify complete and accurate migration | 1 week |\n| **Cutover** | Switch production to new vendor | 1 day |\n| **Decommission** | Terminate old vendor; initiate deletion | Per DPA timeline |\n| **Deletion verification** | Confirm old vendor data deletion | 90 days |\n\n## Key Regulatory References\n\n- GDPR Article 28(3)(g) — Deletion or return of personal data upon termination\n- GDPR Article 17 — Right to erasure (informs deletion standards)\n- GDPR Article 5(1)(e) — Storage limitation principle\n- EDPB Guidelines 07\u002F2020 — Paragraph 108 on termination data obligations\n- NIST SP 800-88 Rev. 1 — Guidelines for Media Sanitization\n- ISO\u002FIEC 27001:2022 — A.8.10 Information deletion\n",{"name":5,"license":15,"metadata":37,"description":7},{"tags":38,"author":9,"domain":30,"version":39,"subdomain":40},"vendor-termination, data-return, deletion-certification, art-28-termination, data-portability","1.0","vendor-privacy-management","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Fvendor-termination-data",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill vendor-termination-data",{"tool":56,"command":57},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill vendor-termination-data",{"tool":59,"command":60},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill vendor-termination-data","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fvendor-termination-data\u002FSKILL.md",true,[64,70,74,80,84,88,94],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"assets\u002Fexample_asset.txt","ASSET","资产文件",865,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fra-qm-team\u002Ffda-consultant-specialist\u002Fassets\u002Fexample_asset.txt",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":72,"sourceHtmlUrl":73},"assets\u002Ftemplate.md",1759,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fvendor-termination-data\u002Fassets\u002Ftemplate.md",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fapi_reference.md","REFERENCE","参考文档",976,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fra-qm-team\u002Ffda-consultant-specialist\u002Freferences\u002Fapi_reference.md",{"path":81,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fstandards.md",3089,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fvendor-termination-data\u002Freferences\u002Fstandards.md",{"path":85,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fworkflows.md",5426,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fvendor-termination-data\u002Freferences\u002Fworkflows.md",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Fexample.py","SCRIPT","脚本",609,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fra-qm-team\u002Ffda-consultant-specialist\u002Fscripts\u002Fexample.py",{"path":95,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":96,"sourceHtmlUrl":97},"scripts\u002Fprocess.py",14371,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Fvendor-termination-data\u002Fscripts\u002Fprocess.py",[99,125,139,145,162,175],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":116,"publishedAt":32},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[105,110,113],{"categoryNo":106,"categoryName":107,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":111,"categoryName":112,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务",[117,118,30,119,120,24,121,122,123,124],"email","workplace email privacy","compliance","content","policy","testing","monitoring","metadata",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":133,"publishedAt":32},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[131,132],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},[24,134,135,136,119,137,29,30,138],"whistleblower data","identity","reporting","data protection","prevention",{"skillNo":140,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":32},"01M6AG6CJP0PW3X65HC7VP9SR9","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[143],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[24,25,26,27,28,29,30,31],{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":32},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[151],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,154,155,156,157,158,159,160,30,24,161],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":169,"publishedAt":32},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[168],{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},[30,170,29,171,158,172,173,24,161,154,31,174],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":188,"publishedAt":32},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[181,184,187],{"categoryNo":182,"categoryName":183,"taxonomyType":108,"taxonomyTypeDesc":109},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":185,"categoryName":186,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":114,"categoryName":115,"taxonomyType":21,"taxonomyTypeDesc":22},[189,190,30,191,27,192,119,29,193,161,194,195,196,26],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]