[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFN750B83RKZHD2F2NT181":3,"skill-same:01M6AFN750B83RKZHD2F2NT181":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M6AFN750B83RKZHD2F2NT181","dpia-automated-decisions",null,"Conducts a Data Protection Impact Assessment for automated decision-making and profiling systems under GDPR Article 35(3)(a), covering algorithmic transparency, meaningful human oversight, contestation mechanisms, and Art. 22 safeguards. Activate for DPIA automated decision, profiling DPIA, algorithmic impact assessment, Art. 35(3)(a), ADM risk assessment queries.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",337,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-automated-decisions\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40],"dpia","dpia automated decisions","risk assessment","assessment","data protection","gdpr","privacy","data","risk","2026-11-10 10:12:30",false,"---\nname: dpia-automated-decisions\ndescription: >-\n  Conducts a Data Protection Impact Assessment for automated decision-making\n  and profiling systems under GDPR Article 35(3)(a), covering algorithmic\n  transparency, meaningful human oversight, contestation mechanisms, and\n  Art. 22 safeguards. Activate for DPIA automated decision, profiling DPIA,\n  algorithmic impact assessment, Art. 35(3)(a), ADM risk assessment queries.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: 1.0.0\n  domain: privacy\n  subdomain: privacy-impact-assessment\n  tags:\n    - dpia\n    - automated-decisions\n    - profiling\n    - gdpr-article-35\n    - algorithmic-transparency\n  regulatory_frameworks:\n    - GDPR\n    - EU-AI-Act\n---\n\n# DPIA for Automated Decision-Making Systems\n\n## Purpose\n\nConduct a DPIA specifically tailored to automated decision-making (ADM) and profiling systems that produce legal or similarly significant effects on individuals, as required by GDPR Article 35(3)(a).\n\n## Prerequisites\n\n- System documentation for the ADM\u002Fprofiling system (algorithm design, training data, decision logic)\n- Art. 35(3)(a) threshold confirmed: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect natural persons\n- Data categories processed identified, including any Art. 9 special categories\n- Existing Art. 22 safeguards documentation if available\n\n## Workflow\n\n### Step 1: System Description and Scope\n\nDocument the ADM system under assessment:\n\n1. **System purpose**: Business objective and processing purpose\n2. **Decision types**: What decisions the system makes or supports (credit scoring, insurance pricing, recruitment screening, fraud detection, content moderation)\n3. **Processing scope**: Data categories used as inputs, volume of data subjects affected, geographic scope\n4. **Automation level**: Fully automated (no human in loop), semi-automated (human in loop), or automated with human override capability\n5. **Legal basis**: Art. 6(1) basis for the processing, and if Art. 22 applies, the Art. 22(2) exception relied upon (contract, EU\u002FMember State law, explicit consent)\n\n### Step 2: Necessity and Proportionality Assessment\n\nEvaluate whether the automated processing is necessary and proportionate:\n\n1. **Purpose limitation**: Confirm processing purpose is specific, explicit, and legitimate per Art. 5(1)(b)\n2. **Data minimization**: Verify only data strictly necessary for the decision is processed per Art. 5(1)(c)\n3. **Accuracy**: Assess input data quality and its impact on decision accuracy per Art. 5(1)(d)\n4. **Less intrusive alternatives**: Document whether the decision could be made through less automated means\n5. **Proportionality**: Balance the organizational benefit against the impact on individuals' rights and freedoms\n\n### Step 3: Risk Identification\n\nIdentify risks specific to ADM systems:\n\n1. **Discrimination risk**: Assess whether the system could produce discriminatory outcomes based on Art. 9 characteristics (race, ethnicity, political opinions, religion, health, sexual orientation)\n2. **Opacity risk**: Evaluate whether the decision logic is explainable to affected individuals per Art. 13(2)(f) and Art. 14(2)(g)\n3. **Accuracy risk**: Assess false positive and false negative rates and their consequences\n4. **Data quality risk**: Evaluate whether training data reflects real-world populations without bias\n5. **Feedback loop risk**: Assess whether the system creates self-reinforcing biases\n6. **Scope creep risk**: Evaluate whether the system could be applied beyond its intended purpose\n7. **Security risk**: Assess adversarial manipulation vectors (data poisoning, model extraction)\n\n### Step 4: Art. 22 Compliance Assessment\n\nIf the system makes solely automated decisions with legal or similarly significant effects:\n\n1. **Art. 22(1) prohibition check**: Confirm whether the default prohibition applies\n2. **Art. 22(2) exception**: Document which exception permits the processing:\n   - (a) Necessary for entering into or performance of a contract\n   - (b) Authorized by EU or Member State law with suitable safeguards\n   - (c) Based on explicit consent\n3. **Art. 22(3) safeguards**: Verify implementation of mandatory safeguards:\n   - Right to obtain human intervention from the controller\n   - Right to express the data subject's point of view\n   - Right to contest the decision\n4. **Art. 22(4) special categories**: If Art. 9 data is processed, confirm explicit consent under Art. 9(2)(a) or substantial public interest under Art. 9(2)(g) with suitable safeguards\n\n### Step 5: Transparency and Explainability\n\nAssess transparency obligations:\n\n1. **Pre-decision transparency**: Art. 13(2)(f) \u002F Art. 14(2)(g) require providing meaningful information about the logic involved, significance, and envisaged consequences\n2. **Logic explanation depth**: Document what level of explanation is provided:\n   - General system functionality description\n   - Key factors\u002Ffeatures influencing decisions\n   - Decision thresholds and their justification\n   - Individual-specific explanation of a particular decision\n3. **Recital 71 guidance**: Verify right to explanation is implemented as per Recital 71 (right to obtain an explanation of the decision reached after assessment)\n\n### Step 6: Risk Mitigation Measures\n\nImplement measures to mitigate identified risks:\n\n1. **Bias testing**: Regular testing for discriminatory impact across protected characteristics\n2. **Human oversight**: Define when and how human reviewers intervene\n3. **Accuracy monitoring**: Ongoing performance monitoring with defined acceptable thresholds\n4. **Audit trail**: Complete logging of inputs, model version, and outputs for each decision\n5. **Data subject rights**: Clear process for individuals to exercise Art. 22(3) rights\n6. **Regular review**: Periodic re-assessment schedule (at minimum annually)\n\n### Step 7: Stakeholder Consultation\n\nConsult required parties per Art. 35(9):\n\n1. **DPO opinion**: Obtain DPO assessment per Art. 35(2)\n2. **Data subjects**: Where appropriate, seek views of data subjects or their representatives per Art. 35(9)\n3. **Technical experts**: Algorithm developers, data scientists, domain experts\n4. **Legal counsel**: Assessment of applicable laws beyond GDPR (EU AI Act, sector-specific regulation)\n\n### Step 8: Documentation and Outcome\n\nDocument the DPIA outcome:\n\n1. **Risk matrix**: Residual risk rating after mitigation measures\n2. **DPO recommendation**: Documented DPO opinion on whether processing can proceed\n3. **Prior consultation**: If residual risk remains high, document decision to consult supervisory authority per Art. 36\n4. **Review schedule**: Next mandatory review date and trigger events for early review\n\n## Verification\n\n- [ ] ADM system fully described with decision types, automation level, and data categories\n- [ ] Art. 22(2) exception documented with Art. 22(3) safeguards implemented\n- [ ] Discrimination risk assessed across Art. 9 protected characteristics\n- [ ] Transparency obligations met per Art. 13(2)(f) \u002F Art. 14(2)(g)\n- [ ] Human intervention mechanism operational and tested\n- [ ] Contestation process documented and accessible to data subjects\n- [ ] DPO opinion obtained and documented\n- [ ] Review schedule established with clear trigger events\n","# DPIA for Automated Decision-Making Systems\n\n## Purpose\n\nConduct a DPIA specifically tailored to automated decision-making (ADM) and profiling systems that produce legal or similarly significant effects on individuals, as required by GDPR Article 35(3)(a).\n\n## Prerequisites\n\n- System documentation for the ADM\u002Fprofiling system (algorithm design, training data, decision logic)\n- Art. 35(3)(a) threshold confirmed: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions are based that produce legal effects or similarly significantly affect natural persons\n- Data categories processed identified, including any Art. 9 special categories\n- Existing Art. 22 safeguards documentation if available\n\n## Workflow\n\n### Step 1: System Description and Scope\n\nDocument the ADM system under assessment:\n\n1. **System purpose**: Business objective and processing purpose\n2. **Decision types**: What decisions the system makes or supports (credit scoring, insurance pricing, recruitment screening, fraud detection, content moderation)\n3. **Processing scope**: Data categories used as inputs, volume of data subjects affected, geographic scope\n4. **Automation level**: Fully automated (no human in loop), semi-automated (human in loop), or automated with human override capability\n5. **Legal basis**: Art. 6(1) basis for the processing, and if Art. 22 applies, the Art. 22(2) exception relied upon (contract, EU\u002FMember State law, explicit consent)\n\n### Step 2: Necessity and Proportionality Assessment\n\nEvaluate whether the automated processing is necessary and proportionate:\n\n1. **Purpose limitation**: Confirm processing purpose is specific, explicit, and legitimate per Art. 5(1)(b)\n2. **Data minimization**: Verify only data strictly necessary for the decision is processed per Art. 5(1)(c)\n3. **Accuracy**: Assess input data quality and its impact on decision accuracy per Art. 5(1)(d)\n4. **Less intrusive alternatives**: Document whether the decision could be made through less automated means\n5. **Proportionality**: Balance the organizational benefit against the impact on individuals' rights and freedoms\n\n### Step 3: Risk Identification\n\nIdentify risks specific to ADM systems:\n\n1. **Discrimination risk**: Assess whether the system could produce discriminatory outcomes based on Art. 9 characteristics (race, ethnicity, political opinions, religion, health, sexual orientation)\n2. **Opacity risk**: Evaluate whether the decision logic is explainable to affected individuals per Art. 13(2)(f) and Art. 14(2)(g)\n3. **Accuracy risk**: Assess false positive and false negative rates and their consequences\n4. **Data quality risk**: Evaluate whether training data reflects real-world populations without bias\n5. **Feedback loop risk**: Assess whether the system creates self-reinforcing biases\n6. **Scope creep risk**: Evaluate whether the system could be applied beyond its intended purpose\n7. **Security risk**: Assess adversarial manipulation vectors (data poisoning, model extraction)\n\n### Step 4: Art. 22 Compliance Assessment\n\nIf the system makes solely automated decisions with legal or similarly significant effects:\n\n1. **Art. 22(1) prohibition check**: Confirm whether the default prohibition applies\n2. **Art. 22(2) exception**: Document which exception permits the processing:\n   - (a) Necessary for entering into or performance of a contract\n   - (b) Authorized by EU or Member State law with suitable safeguards\n   - (c) Based on explicit consent\n3. **Art. 22(3) safeguards**: Verify implementation of mandatory safeguards:\n   - Right to obtain human intervention from the controller\n   - Right to express the data subject's point of view\n   - Right to contest the decision\n4. **Art. 22(4) special categories**: If Art. 9 data is processed, confirm explicit consent under Art. 9(2)(a) or substantial public interest under Art. 9(2)(g) with suitable safeguards\n\n### Step 5: Transparency and Explainability\n\nAssess transparency obligations:\n\n1. **Pre-decision transparency**: Art. 13(2)(f) \u002F Art. 14(2)(g) require providing meaningful information about the logic involved, significance, and envisaged consequences\n2. **Logic explanation depth**: Document what level of explanation is provided:\n   - General system functionality description\n   - Key factors\u002Ffeatures influencing decisions\n   - Decision thresholds and their justification\n   - Individual-specific explanation of a particular decision\n3. **Recital 71 guidance**: Verify right to explanation is implemented as per Recital 71 (right to obtain an explanation of the decision reached after assessment)\n\n### Step 6: Risk Mitigation Measures\n\nImplement measures to mitigate identified risks:\n\n1. **Bias testing**: Regular testing for discriminatory impact across protected characteristics\n2. **Human oversight**: Define when and how human reviewers intervene\n3. **Accuracy monitoring**: Ongoing performance monitoring with defined acceptable thresholds\n4. **Audit trail**: Complete logging of inputs, model version, and outputs for each decision\n5. **Data subject rights**: Clear process for individuals to exercise Art. 22(3) rights\n6. **Regular review**: Periodic re-assessment schedule (at minimum annually)\n\n### Step 7: Stakeholder Consultation\n\nConsult required parties per Art. 35(9):\n\n1. **DPO opinion**: Obtain DPO assessment per Art. 35(2)\n2. **Data subjects**: Where appropriate, seek views of data subjects or their representatives per Art. 35(9)\n3. **Technical experts**: Algorithm developers, data scientists, domain experts\n4. **Legal counsel**: Assessment of applicable laws beyond GDPR (EU AI Act, sector-specific regulation)\n\n### Step 8: Documentation and Outcome\n\nDocument the DPIA outcome:\n\n1. **Risk matrix**: Residual risk rating after mitigation measures\n2. **DPO recommendation**: Documented DPO opinion on whether processing can proceed\n3. **Prior consultation**: If residual risk remains high, document decision to consult supervisory authority per Art. 36\n4. **Review schedule**: Next mandatory review date and trigger events for early review\n\n## Verification\n\n- [ ] ADM system fully described with decision types, automation level, and data categories\n- [ ] Art. 22(2) exception documented with Art. 22(3) safeguards implemented\n- [ ] Discrimination risk assessed across Art. 9 protected characteristics\n- [ ] Transparency obligations met per Art. 13(2)(f) \u002F Art. 14(2)(g)\n- [ ] Human intervention mechanism operational and tested\n- [ ] Contestation process documented and accessible to data subjects\n- [ ] DPO opinion obtained and documented\n- [ ] Review schedule established with clear trigger events\n",{"name":5,"license":15,"metadata":46,"description":7},{"tags":47,"author":9,"domain":38,"version":52,"subdomain":53,"regulatory_frameworks":54},[32,48,49,50,51],"automated-decisions","profiling","gdpr-article-35","algorithmic-transparency","1.0.0","privacy-impact-assessment",[55,56],"GDPR","EU-AI-Act","main","9b2ef9eae161c00a17241d42a388571321b33e9f","skills\u002Fprivacy\u002Fdpia-automated-decisions",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill dpia-automated-decisions",{"tool":72,"command":73},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill dpia-automated-decisions",{"tool":75,"command":76},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill dpia-automated-decisions","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-automated-decisions\u002FSKILL.md",true,[80,86,92,96],{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"assets\u002Ftemplate.md","ASSET","资产文件",7651,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-automated-decisions\u002Fassets\u002Ftemplate.md",{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fstandards.md","REFERENCE","参考文档",6222,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-automated-decisions\u002Freferences\u002Fstandards.md",{"path":93,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fworkflows.md",7117,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-automated-decisions\u002Freferences\u002Fworkflows.md",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"scripts\u002Fprocess.py","SCRIPT","脚本",13967,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-automated-decisions\u002Fscripts\u002Fprocess.py",[103,127,142,155,170,183],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":118,"publishedAt":41},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[109,112,115],{"categoryNo":110,"categoryName":111,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":113,"categoryName":114,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":116,"categoryName":117,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000037","律师与法务",[119,120,38,121,122,39,123,124,125,126],"email","workplace email privacy","compliance","content","policy","testing","monitoring","metadata",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":137,"publishedAt":41},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[133,136],{"categoryNo":134,"categoryName":135,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":116,"categoryName":117,"taxonomyType":29,"taxonomyTypeDesc":30},[39,138,139,140,121,36,37,38,141],"whistleblower data","identity","reporting","prevention",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":41},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[148],{"categoryNo":134,"categoryName":135,"taxonomyType":29,"taxonomyTypeDesc":30},[39,150,151,152,153,37,38,154],"vendor termination data","planning","verification","extraction","certification",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":41},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[161],{"categoryNo":134,"categoryName":135,"taxonomyType":29,"taxonomyTypeDesc":30},[163,40,164,165,166,35,167,168,38,39,169],"vendor risk scoring","risk scoring","methodology","risk-scoring","transfer","certifications","processor",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":177,"publishedAt":41},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[176],{"categoryNo":116,"categoryName":117,"taxonomyType":29,"taxonomyTypeDesc":30},[38,178,37,179,35,180,181,39,169,40,154,182],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":192,"publishedAt":41},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[189,190,191],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},{"categoryNo":116,"categoryName":117,"taxonomyType":29,"taxonomyTypeDesc":30},[193,194,38,195,152,196,121,37,197,169,198,199,200,151],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]