[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF972P9BPJ37FE1D27M8DS":3,"skill-same:01M6AF972P9BPJ37FE1D27M8DS":97},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":34,"frontMatter":35,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":43,"repositoryHtmlUrl":44,"repositoryHomepageUrl":6,"ownerHtmlUrl":45,"ownerBlogUrl":46,"ownerDescription":47,"updatedAt":48,"install":49,"resources":62},"01M6AF972P9BPJ37FE1D27M8DS","multi-state-compliance",null,"Multi-state harmonized privacy compliance program. Common requirements matrix across all US state privacy laws, state-specific deltas, unified privacy program architecture, and implementation strategy for operating across California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and Kentucky.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",338,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fmulti-state-compliance\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30],"state","compliance","multi state compliance","architecture","requirements matrix","implementation strategy","privacy","2026-11-10 10:12:30",false,"---\nname: multi-state-compliance\ndescription: >-\n  Multi-state harmonized privacy compliance program. Common requirements\n  matrix across all US state privacy laws, state-specific deltas, unified\n  privacy program architecture, and implementation strategy for operating\n  across California, Virginia, Colorado, Connecticut, Texas, Oregon,\n  Montana, and Kentucky.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: us-state-privacy-laws\n  tags: \"multi-state, harmonized-compliance, common-requirements, state-deltas, unified-program\"\n---\n\n# Multi-State Harmonized Compliance Program\n\n## Overview\n\nAs of 2026, over 20 US states have enacted comprehensive consumer privacy legislation. Organizations operating nationwide face a complex patchwork of requirements with significant overlap but important state-specific variations. A harmonized multi-state compliance program identifies the common baseline, maps state-specific deltas, and implements a unified privacy architecture that satisfies all applicable laws.\n\nThis skill covers the eight major enacted and effective state privacy laws: CCPA\u002FCPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), TDPSA (Texas), OCPA (Oregon), MTDPA (Montana), and KPPA (Kentucky).\n\n## Common Requirements Matrix\n\n### Consumer Rights — Universal Baseline\n\nAll eight laws provide these core rights:\n\n| Right | CA | VA | CO | CT | TX | OR | MT | KY |\n|-------|----|----|----|----|----|----|----|----|\n| Access\u002FKnow | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Correct | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Delete | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Portability | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Opt-out: targeted ads | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Opt-out: sale | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Opt-out: profiling | No* | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Limit sensitive PI | Yes | N\u002FA | N\u002FA | N\u002FA | N\u002FA | N\u002FA | N\u002FA | N\u002FA |\n| Third-party list | No | No | No | No | No | Yes | No | No |\n| Appeal | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n\n*California provides opt-out of automated decision-making under pending CPPA regulations.\n\n### Controller Obligations — Universal Baseline\n\n| Obligation | All States |\n|-----------|-----------|\n| Privacy notice\u002Fpolicy | Required |\n| Data minimization | Required |\n| Purpose limitation | Required |\n| Data security | Required |\n| Non-discrimination | Required |\n| Response timeline | 45 days (all states) |\n\n## State-Specific Deltas\n\n### California (CCPA\u002FCPRA) — Unique Requirements\n- **Revenue threshold**: $25M alternative threshold (no other state has this)\n- **Sensitive PI limit right**: Post-collection limit mechanism (other states require pre-collection consent)\n- **CPPA enforcement**: Dedicated privacy agency (only state with one)\n- **Private right of action**: For data breach claims (only state with any private right of action)\n- **Annual metrics**: Required for businesses processing 10M+ consumers\n- **Data processing agreements**: Explicit statutory requirement\n- **No cure period**: Eliminated by CPRA\n\n### Virginia (VCDPA) — Unique Requirements\n- **50% revenue threshold**: Higher revenue percentage requirement than most states\n\n### Colorado (CPA) — Unique Requirements\n- **AG rulemaking**: Most detailed implementing regulations (4 CCR 904-3)\n- **Universal opt-out**: First mandated (effective July 2024)\n- **Profiling opt-out scope**: Broadest definition covering 7+ decision categories\n- **$20,000 penalties**: Higher per-violation penalties under Consumer Protection Act\n\n### Connecticut (CTDPA) — Unique Requirements\n- **Dark pattern prohibition**: Explicit statutory definition and prohibition\n- **Loyalty program exemption**: Bona fide loyalty programs exempt from sale opt-out\n- **25% revenue threshold**: Lower than Virginia's 50%\n\n### Texas (TDPSA) — Unique Requirements\n- **No revenue\u002Fconsumer threshold**: Applies to all non-SBA-small businesses\n- **Data broker registration**: Secretary of State registration requirement\n- **CUBI interaction**: Separate biometric data law (up to $25,000\u002Fviolation)\n- **Broadest applicability**: Largest state population, lowest effective threshold\n\n### Oregon (OCPA) — Unique Requirements\n- **Nonprofit coverage**: Applies to nonprofit organizations\n- **Third-party list right**: Specific entity names, not just categories\n- **De-identified data**: Most detailed compliance requirements\n- **Employee data partial exemption**: Unique treatment of employee data\n- **Transgender\u002Fnonbinary status**: Explicit sensitive data category\n- **14-day cure period**: Shortest cure period among states\n\n### Montana (MTDPA) — Unique Requirements\n- **50,000 consumer threshold**: Lowest consumer count threshold\n- **15-day extension only**: Shorter extension than most states' 45 days\n- **Air carrier exemption**: Unique industry exemption\n\n### Kentucky (KPPA) — Unique Requirements\n- **January 2026 effective date**: Most recently effective among this group\n- **50% revenue threshold**: Matches Virginia\n\n## Unified Privacy Program Architecture\n\n### Tier 1: Common Baseline (Apply Everywhere)\n\nThese requirements are common across all states and form the foundation:\n\n1. **Privacy notice** with categories of PI, purposes, rights, third parties, contact info\n2. **Consumer rights portal** supporting access, correct, delete, portability, opt-out\n3. **45-day response SLA** with tracking and metrics\n4. **Data minimization** and purpose limitation controls\n5. **Reasonable data security** measures\n6. **Non-discrimination** protections\n\n### Tier 2: High-Water Mark (Apply to Satisfy Strictest Requirement)\n\nWhere state requirements differ, apply the strictest standard universally:\n\n| Area | Strictest Standard | Source State |\n|------|--------------------|-------------|\n| Sensitive data consent | Opt-in consent before collection | VA, CO, CT, TX, OR, MT, KY |\n| Dark pattern prohibition | Consent via dark patterns invalid | CT (explicit), all (implicit) |\n| Response extension | 15-day extension only | MT (strictest) or accept state-by-state |\n| Universal opt-out | Honor GPC signals | CA, CO, CT, MT |\n| Profiling opt-out | Include 7+ decision categories | CO (broadest scope) |\n| De-identified data | Full compliance program | OR (most detailed) |\n| Privacy notice retention periods | Include per-category retention | CA (CPRA requirement) |\n\n### Tier 3: State-Specific (Apply Only Where Required)\n\n| Requirement | State(s) | Implementation |\n|-------------|----------|---------------|\n| \"Do Not Sell or Share\" link | CA | Homepage footer |\n| \"Limit Sensitive PI\" link | CA | Adjacent to opt-out link |\n| Specific third-party list | OR | Additional disclosure in Oregon responses |\n| Data broker registration | TX | Secretary of State registration (if applicable) |\n| Annual metrics disclosure | CA (10M+) | Privacy notice metrics section |\n| Loyalty program exemption | CT | Program-specific terms |\n| Nonprofit compliance | OR | Full program for Oregon nonprofit operations |\n\n### Implementation Strategy for Liberty Commerce Inc.\n\n**Approach: High-Water Mark with State-Specific Overlays**\n\nLiberty Commerce Inc. implements a unified privacy program at the highest common standard, with state-specific modules activated based on the consumer's state of residence.\n\n```\nConsumer Request Received\n  │\n  ├─► Determine Consumer's State\n  │\n  ├─► Apply Tier 1 Common Baseline\n  │     (Same for all states)\n  │\n  ├─► Apply Tier 2 High-Water Mark\n  │     (Strictest standard, applied universally)\n  │\n  └─► Apply Tier 3 State-Specific Module\n        ├─ California module: CPRA-specific disclosures, sensitive PI limit\n        ├─ Oregon module: Third-party specific list\n        ├─ Texas module: Data broker check\n        └─ Connecticut module: Loyalty program exemption assessment\n```\n\n## Harmonized Privacy Notice Template\n\nA multi-state privacy notice should include these sections to satisfy all eight laws:\n\n1. **Categories of PI\u002Fpersonal data collected** (all states)\n2. **Categories of sensitive PI\u002Fsensitive data collected** (all states)\n3. **Purposes for each category** (all states)\n4. **Retention period or criteria per category** (CA required; best practice all)\n5. **Sources of PI** (CA required; best practice all)\n6. **Categories of third parties receiving PI** (all states)\n7. **Whether PI is sold or shared** (all states)\n8. **Whether targeted advertising is conducted** (all non-CA states)\n9. **Whether profiling is conducted** (all non-CA states)\n10. **Consumer rights and how to exercise** (all states)\n11. **Appeal process** (VA, CO, CT, TX, OR, MT, KY)\n12. **Contact information** (all states)\n13. **\"Do Not Sell or Share\" link** (CA)\n14. **\"Limit Sensitive PI\" link** (CA)\n15. **Universal opt-out disclosure** (CA, CO, CT, MT)\n16. **Last updated date** (CA required; best practice all)\n17. **Annual metrics** (CA, if 10M+ consumers)\n\n## Key Regulatory References\n\n- IAPP US State Comprehensive Privacy Law Comparison Chart (updated quarterly)\n- CPPA Regulations 11 CCR §7001-7102\n- Colorado AG Regulations 4 CCR 904-3\n- Global Privacy Control Specification v1.0\n","# Multi-State Harmonized Compliance Program\n\n## Overview\n\nAs of 2026, over 20 US states have enacted comprehensive consumer privacy legislation. Organizations operating nationwide face a complex patchwork of requirements with significant overlap but important state-specific variations. A harmonized multi-state compliance program identifies the common baseline, maps state-specific deltas, and implements a unified privacy architecture that satisfies all applicable laws.\n\nThis skill covers the eight major enacted and effective state privacy laws: CCPA\u002FCPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), TDPSA (Texas), OCPA (Oregon), MTDPA (Montana), and KPPA (Kentucky).\n\n## Common Requirements Matrix\n\n### Consumer Rights — Universal Baseline\n\nAll eight laws provide these core rights:\n\n| Right | CA | VA | CO | CT | TX | OR | MT | KY |\n|-------|----|----|----|----|----|----|----|----|\n| Access\u002FKnow | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Correct | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Delete | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Portability | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Opt-out: targeted ads | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Opt-out: sale | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Opt-out: profiling | No* | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n| Limit sensitive PI | Yes | N\u002FA | N\u002FA | N\u002FA | N\u002FA | N\u002FA | N\u002FA | N\u002FA |\n| Third-party list | No | No | No | No | No | Yes | No | No |\n| Appeal | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes |\n\n*California provides opt-out of automated decision-making under pending CPPA regulations.\n\n### Controller Obligations — Universal Baseline\n\n| Obligation | All States |\n|-----------|-----------|\n| Privacy notice\u002Fpolicy | Required |\n| Data minimization | Required |\n| Purpose limitation | Required |\n| Data security | Required |\n| Non-discrimination | Required |\n| Response timeline | 45 days (all states) |\n\n## State-Specific Deltas\n\n### California (CCPA\u002FCPRA) — Unique Requirements\n- **Revenue threshold**: $25M alternative threshold (no other state has this)\n- **Sensitive PI limit right**: Post-collection limit mechanism (other states require pre-collection consent)\n- **CPPA enforcement**: Dedicated privacy agency (only state with one)\n- **Private right of action**: For data breach claims (only state with any private right of action)\n- **Annual metrics**: Required for businesses processing 10M+ consumers\n- **Data processing agreements**: Explicit statutory requirement\n- **No cure period**: Eliminated by CPRA\n\n### Virginia (VCDPA) — Unique Requirements\n- **50% revenue threshold**: Higher revenue percentage requirement than most states\n\n### Colorado (CPA) — Unique Requirements\n- **AG rulemaking**: Most detailed implementing regulations (4 CCR 904-3)\n- **Universal opt-out**: First mandated (effective July 2024)\n- **Profiling opt-out scope**: Broadest definition covering 7+ decision categories\n- **$20,000 penalties**: Higher per-violation penalties under Consumer Protection Act\n\n### Connecticut (CTDPA) — Unique Requirements\n- **Dark pattern prohibition**: Explicit statutory definition and prohibition\n- **Loyalty program exemption**: Bona fide loyalty programs exempt from sale opt-out\n- **25% revenue threshold**: Lower than Virginia's 50%\n\n### Texas (TDPSA) — Unique Requirements\n- **No revenue\u002Fconsumer threshold**: Applies to all non-SBA-small businesses\n- **Data broker registration**: Secretary of State registration requirement\n- **CUBI interaction**: Separate biometric data law (up to $25,000\u002Fviolation)\n- **Broadest applicability**: Largest state population, lowest effective threshold\n\n### Oregon (OCPA) — Unique Requirements\n- **Nonprofit coverage**: Applies to nonprofit organizations\n- **Third-party list right**: Specific entity names, not just categories\n- **De-identified data**: Most detailed compliance requirements\n- **Employee data partial exemption**: Unique treatment of employee data\n- **Transgender\u002Fnonbinary status**: Explicit sensitive data category\n- **14-day cure period**: Shortest cure period among states\n\n### Montana (MTDPA) — Unique Requirements\n- **50,000 consumer threshold**: Lowest consumer count threshold\n- **15-day extension only**: Shorter extension than most states' 45 days\n- **Air carrier exemption**: Unique industry exemption\n\n### Kentucky (KPPA) — Unique Requirements\n- **January 2026 effective date**: Most recently effective among this group\n- **50% revenue threshold**: Matches Virginia\n\n## Unified Privacy Program Architecture\n\n### Tier 1: Common Baseline (Apply Everywhere)\n\nThese requirements are common across all states and form the foundation:\n\n1. **Privacy notice** with categories of PI, purposes, rights, third parties, contact info\n2. **Consumer rights portal** supporting access, correct, delete, portability, opt-out\n3. **45-day response SLA** with tracking and metrics\n4. **Data minimization** and purpose limitation controls\n5. **Reasonable data security** measures\n6. **Non-discrimination** protections\n\n### Tier 2: High-Water Mark (Apply to Satisfy Strictest Requirement)\n\nWhere state requirements differ, apply the strictest standard universally:\n\n| Area | Strictest Standard | Source State |\n|------|--------------------|-------------|\n| Sensitive data consent | Opt-in consent before collection | VA, CO, CT, TX, OR, MT, KY |\n| Dark pattern prohibition | Consent via dark patterns invalid | CT (explicit), all (implicit) |\n| Response extension | 15-day extension only | MT (strictest) or accept state-by-state |\n| Universal opt-out | Honor GPC signals | CA, CO, CT, MT |\n| Profiling opt-out | Include 7+ decision categories | CO (broadest scope) |\n| De-identified data | Full compliance program | OR (most detailed) |\n| Privacy notice retention periods | Include per-category retention | CA (CPRA requirement) |\n\n### Tier 3: State-Specific (Apply Only Where Required)\n\n| Requirement | State(s) | Implementation |\n|-------------|----------|---------------|\n| \"Do Not Sell or Share\" link | CA | Homepage footer |\n| \"Limit Sensitive PI\" link | CA | Adjacent to opt-out link |\n| Specific third-party list | OR | Additional disclosure in Oregon responses |\n| Data broker registration | TX | Secretary of State registration (if applicable) |\n| Annual metrics disclosure | CA (10M+) | Privacy notice metrics section |\n| Loyalty program exemption | CT | Program-specific terms |\n| Nonprofit compliance | OR | Full program for Oregon nonprofit operations |\n\n### Implementation Strategy for Liberty Commerce Inc.\n\n**Approach: High-Water Mark with State-Specific Overlays**\n\nLiberty Commerce Inc. implements a unified privacy program at the highest common standard, with state-specific modules activated based on the consumer's state of residence.\n\n```\nConsumer Request Received\n  │\n  ├─► Determine Consumer's State\n  │\n  ├─► Apply Tier 1 Common Baseline\n  │     (Same for all states)\n  │\n  ├─► Apply Tier 2 High-Water Mark\n  │     (Strictest standard, applied universally)\n  │\n  └─► Apply Tier 3 State-Specific Module\n        ├─ California module: CPRA-specific disclosures, sensitive PI limit\n        ├─ Oregon module: Third-party specific list\n        ├─ Texas module: Data broker check\n        └─ Connecticut module: Loyalty program exemption assessment\n```\n\n## Harmonized Privacy Notice Template\n\nA multi-state privacy notice should include these sections to satisfy all eight laws:\n\n1. **Categories of PI\u002Fpersonal data collected** (all states)\n2. **Categories of sensitive PI\u002Fsensitive data collected** (all states)\n3. **Purposes for each category** (all states)\n4. **Retention period or criteria per category** (CA required; best practice all)\n5. **Sources of PI** (CA required; best practice all)\n6. **Categories of third parties receiving PI** (all states)\n7. **Whether PI is sold or shared** (all states)\n8. **Whether targeted advertising is conducted** (all non-CA states)\n9. **Whether profiling is conducted** (all non-CA states)\n10. **Consumer rights and how to exercise** (all states)\n11. **Appeal process** (VA, CO, CT, TX, OR, MT, KY)\n12. **Contact information** (all states)\n13. **\"Do Not Sell or Share\" link** (CA)\n14. **\"Limit Sensitive PI\" link** (CA)\n15. **Universal opt-out disclosure** (CA, CO, CT, MT)\n16. **Last updated date** (CA required; best practice all)\n17. **Annual metrics** (CA, if 10M+ consumers)\n\n## Key Regulatory References\n\n- IAPP US State Comprehensive Privacy Law Comparison Chart (updated quarterly)\n- CPPA Regulations 11 CCR §7001-7102\n- Colorado AG Regulations 4 CCR 904-3\n- Global Privacy Control Specification v1.0\n",{"name":5,"license":15,"metadata":36,"description":7},{"tags":37,"author":9,"domain":30,"version":38,"subdomain":39},"multi-state, harmonized-compliance, common-requirements, state-deltas, unified-program","1.0","us-state-privacy-laws","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fus-state-privacy-skills\u002Fskills\u002Fmulti-state-compliance",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":50,"prompt":60,"zipAvailable":61},[51,54,57],{"tool":52,"command":53},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill multi-state-compliance",{"tool":55,"command":56},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill multi-state-compliance",{"tool":58,"command":59},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill multi-state-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fmulti-state-compliance\u002FSKILL.md",true,[63,69,73,79,83,87,93],{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"assets\u002Fexample_asset.txt","ASSET","资产文件",865,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fra-qm-team\u002Fmdr-745-specialist\u002Fassets\u002Fexample_asset.txt",{"path":70,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":71,"sourceHtmlUrl":72},"assets\u002Ftemplate.md",1867,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fmulti-state-compliance\u002Fassets\u002Ftemplate.md",{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fapi_reference.md","REFERENCE","参考文档",969,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fra-qm-team\u002Fmdr-745-specialist\u002Freferences\u002Fapi_reference.md",{"path":80,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fstandards.md",2294,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fmulti-state-compliance\u002Freferences\u002Fstandards.md",{"path":84,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fworkflows.md",3920,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fmulti-state-compliance\u002Freferences\u002Fworkflows.md",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"scripts\u002Fexample.py","SCRIPT","脚本",595,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frsmdt-the-startup\u002Falirezarezvani-claude-skills\u002Fra-qm-team\u002Fmdr-745-specialist\u002Fscripts\u002Fexample.py",{"path":94,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":95,"sourceHtmlUrl":96},"scripts\u002Fprocess.py",11921,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fmulti-state-compliance\u002Fscripts\u002Fprocess.py",[98,122,139,152,169,182],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":113,"publishedAt":31},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[104,109,112],{"categoryNo":105,"categoryName":106,"taxonomyType":107,"taxonomyTypeDesc":108},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":110,"categoryName":111,"taxonomyType":107,"taxonomyTypeDesc":108},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[114,115,30,25,116,117,118,119,120,121],"email","workplace email privacy","content","data","policy","testing","monitoring","metadata",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":132,"publishedAt":31},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[128,131],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[117,133,134,135,25,136,137,30,138],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":31},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[145],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[117,147,148,149,150,137,30,151],"vendor termination data","planning","verification","extraction","certification",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":159,"publishedAt":31},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[158],{"categoryNo":129,"categoryName":130,"taxonomyType":21,"taxonomyTypeDesc":22},[160,161,162,163,164,165,166,167,30,117,168],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":176,"publishedAt":31},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[175],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[30,177,137,178,165,179,180,117,168,161,151,181],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":195,"publishedAt":31},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[188,191,194],{"categoryNo":189,"categoryName":190,"taxonomyType":107,"taxonomyTypeDesc":108},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":192,"categoryName":193,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[196,197,30,198,149,199,25,137,200,168,201,202,203,148],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]