[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFND6PRSSK8EBX09JVAJKN":3,"skill-same:01M6AFND6PRSSK8EBX09JVAJKN":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":35,"linkOnly":36,"markdownContent":37,"markdownBody":38,"frontMatter":39,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":50,"ownerDescription":51,"updatedAt":52,"install":53,"resources":66},"01M6AFND6PRSSK8EBX09JVAJKN","dpia-mitigation-plan",null,"Structures risk mitigation planning and residual risk tracking for Data Protection Impact Assessments under GDPR Article 35(7)(d). Covers mitigation measure identification, implementation tracking, residual risk acceptance, and Art. 36 prior consultation triggers. Keywords: DPIA mitigation, risk treatment, residual risk, Art. 35(7)(d), safeguards, mitigation tracking, prior consultation.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-mitigation-plan\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34],"mitigation plan","dpia","dpia mitigation plan","assessment","planning","acceptance","data protection","gdpr","privacy","data","risk","2026-11-10 10:12:30",false,"---\nname: dpia-mitigation-plan\ndescription: >-\n  Structures risk mitigation planning and residual risk tracking for Data\n  Protection Impact Assessments under GDPR Article 35(7)(d). Covers\n  mitigation measure identification, implementation tracking, residual\n  risk acceptance, and Art. 36 prior consultation triggers. Keywords:\n  DPIA mitigation, risk treatment, residual risk, Art. 35(7)(d),\n  safeguards, mitigation tracking, prior consultation.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: privacy-impact-assessment\n  tags: \"dpia-mitigation, risk-treatment, residual-risk, art-35-7d, safeguards\"\n---\n\n# DPIA Mitigation Planning\n\n## Overview\n\nArticle 35(7)(d) GDPR requires a DPIA to include \"the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation.\" This skill provides a structured mitigation planning framework.\n\n## Mitigation Strategy Categories\n\n### Technical Measures\n| Category | Examples | GDPR Reference |\n|----------|----------|----------------|\n| Encryption | At-rest, in-transit, end-to-end | Art. 32(1)(a) |\n| Pseudonymisation | Tokenisation, hashing, key-coded | Art. 25(1), Art. 32(1)(a) |\n| Access controls | RBAC, MFA, privileged access management | Art. 32(1)(b) |\n| Data minimisation | Field-level reduction, aggregation, sampling | Art. 5(1)(c), Art. 25(1) |\n| Anonymisation | k-anonymity, differential privacy, generalisation | Recital 26 |\n| Monitoring | SIEM, DLP, anomaly detection | Art. 32(1)(d) |\n\n### Organisational Measures\n| Category | Examples | GDPR Reference |\n|----------|----------|----------------|\n| Policies | Data protection policy, acceptable use | Art. 24(2) |\n| Training | Privacy awareness, role-specific training | Art. 39(1)(b) |\n| Contracts | DPAs, joint controller arrangements, NDAs | Art. 28, Art. 26 |\n| Audits | Internal audits, processor audits, certification | Art. 28(3)(h) |\n| Governance | DPO oversight, privacy committee, RACI | Art. 37-39 |\n| Incident response | Breach procedures, notification protocols | Art. 33-34 |\n\n## Mitigation Plan Structure\n\nFor each identified risk:\n\n1. **Risk reference** -- Link to DPIA risk register entry\n2. **Inherent risk level** -- Before mitigation\n3. **Proposed measures** -- Specific technical and organisational controls\n4. **Implementation owner** -- Accountable person\n5. **Implementation deadline** -- Target completion date\n6. **Verification method** -- How effectiveness will be confirmed\n7. **Residual risk level** -- After planned mitigation\n8. **Acceptance decision** -- Within appetite \u002F escalation required \u002F prior consultation\n\n## Residual Risk Decision Framework\n\n```\nResidual Risk LOW → Accept; document; routine monitoring\nResidual Risk MEDIUM → Accept with enhanced monitoring; annual review\nResidual Risk HIGH → Escalate to senior management; consider additional measures\nResidual Risk VERY HIGH → Art. 36 prior consultation required before processing\n```\n\n## Implementation Tracking\n\nEach mitigation measure progresses through:\n- **Proposed** -- Identified but not yet approved\n- **Approved** -- Budget and resources allocated\n- **In Progress** -- Implementation underway\n- **Implemented** -- Deployed and operational\n- **Verified** -- Effectiveness confirmed through testing\n","# DPIA Mitigation Planning\n\n## Overview\n\nArticle 35(7)(d) GDPR requires a DPIA to include \"the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation.\" This skill provides a structured mitigation planning framework.\n\n## Mitigation Strategy Categories\n\n### Technical Measures\n| Category | Examples | GDPR Reference |\n|----------|----------|----------------|\n| Encryption | At-rest, in-transit, end-to-end | Art. 32(1)(a) |\n| Pseudonymisation | Tokenisation, hashing, key-coded | Art. 25(1), Art. 32(1)(a) |\n| Access controls | RBAC, MFA, privileged access management | Art. 32(1)(b) |\n| Data minimisation | Field-level reduction, aggregation, sampling | Art. 5(1)(c), Art. 25(1) |\n| Anonymisation | k-anonymity, differential privacy, generalisation | Recital 26 |\n| Monitoring | SIEM, DLP, anomaly detection | Art. 32(1)(d) |\n\n### Organisational Measures\n| Category | Examples | GDPR Reference |\n|----------|----------|----------------|\n| Policies | Data protection policy, acceptable use | Art. 24(2) |\n| Training | Privacy awareness, role-specific training | Art. 39(1)(b) |\n| Contracts | DPAs, joint controller arrangements, NDAs | Art. 28, Art. 26 |\n| Audits | Internal audits, processor audits, certification | Art. 28(3)(h) |\n| Governance | DPO oversight, privacy committee, RACI | Art. 37-39 |\n| Incident response | Breach procedures, notification protocols | Art. 33-34 |\n\n## Mitigation Plan Structure\n\nFor each identified risk:\n\n1. **Risk reference** -- Link to DPIA risk register entry\n2. **Inherent risk level** -- Before mitigation\n3. **Proposed measures** -- Specific technical and organisational controls\n4. **Implementation owner** -- Accountable person\n5. **Implementation deadline** -- Target completion date\n6. **Verification method** -- How effectiveness will be confirmed\n7. **Residual risk level** -- After planned mitigation\n8. **Acceptance decision** -- Within appetite \u002F escalation required \u002F prior consultation\n\n## Residual Risk Decision Framework\n\n```\nResidual Risk LOW → Accept; document; routine monitoring\nResidual Risk MEDIUM → Accept with enhanced monitoring; annual review\nResidual Risk HIGH → Escalate to senior management; consider additional measures\nResidual Risk VERY HIGH → Art. 36 prior consultation required before processing\n```\n\n## Implementation Tracking\n\nEach mitigation measure progresses through:\n- **Proposed** -- Identified but not yet approved\n- **Approved** -- Budget and resources allocated\n- **In Progress** -- Implementation underway\n- **Implemented** -- Deployed and operational\n- **Verified** -- Effectiveness confirmed through testing\n",{"name":5,"license":15,"metadata":40,"description":7},{"tags":41,"author":9,"domain":32,"version":42,"subdomain":43},"dpia-mitigation, risk-treatment, residual-risk, art-35-7d, safeguards","1.0","privacy-impact-assessment","main","9b2ef9eae161c00a17241d42a388571321b33e9f","skills\u002Fprivacy\u002Fdpia-mitigation-plan",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill dpia-mitigation-plan",{"tool":59,"command":60},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill dpia-mitigation-plan",{"tool":62,"command":63},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill dpia-mitigation-plan","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-mitigation-plan\u002FSKILL.md",true,[67,73,79,83],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"assets\u002Ftemplate.md","ASSET","资产文件",8098,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-mitigation-plan\u002Fassets\u002Ftemplate.md",{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fstandards.md","REFERENCE","参考文档",3398,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-mitigation-plan\u002Freferences\u002Fstandards.md",{"path":80,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fworkflows.md",3166,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-mitigation-plan\u002Freferences\u002Fworkflows.md",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"scripts\u002Fprocess.py","SCRIPT","脚本",12479,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fdpia-mitigation-plan\u002Fscripts\u002Fprocess.py",[90,116,131,143,158,171],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":107,"publishedAt":35},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[96,99,102],{"categoryNo":97,"categoryName":98,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":100,"categoryName":101,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[108,109,32,110,111,33,112,113,114,115],"email","workplace email privacy","compliance","content","policy","testing","monitoring","metadata",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":126,"publishedAt":35},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[122,125],{"categoryNo":123,"categoryName":124,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},[33,127,128,129,110,30,31,32,130],"whistleblower data","identity","reporting","prevention",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":35},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[137],{"categoryNo":123,"categoryName":124,"taxonomyType":105,"taxonomyTypeDesc":106},[33,139,28,140,141,31,32,142],"vendor termination data","verification","extraction","certification",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":35},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[149],{"categoryNo":123,"categoryName":124,"taxonomyType":105,"taxonomyTypeDesc":106},[151,34,152,153,154,27,155,156,32,33,157],"vendor risk scoring","risk scoring","methodology","risk-scoring","transfer","certifications","processor",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":35},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[164],{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},[32,166,31,167,27,168,169,33,157,34,142,170],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":184,"publishedAt":35},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[177,180,183],{"categoryNo":178,"categoryName":179,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":181,"categoryName":182,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},[185,186,32,187,140,188,110,31,189,157,190,191,192,28],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]