[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFY92SCT4HWVBKXBY4RJ5T":3,"skill-same:01M6AFY92SCT4HWVBKXBY4RJ5T":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":47,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M6AFY92SCT4HWVBKXBY4RJ5T","nist-pf-control",null,"Implement the NIST Privacy Framework CONTROL function covering CT.DM data management, CT.DP data processing policies and procedures, and CT.PO disassociated processing. Provides technical control architectures, data management workflows, and de-identification implementation guidance.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",337,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-pf-control\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31],"NIST","nist pf control","implement","workflows","framework","engineering","privacy","data","2026-11-10 10:12:30",false,"---\nname: nist-pf-control\ndescription: >-\n  Implement the NIST Privacy Framework CONTROL function covering CT.DM data\n  management, CT.DP data processing policies and procedures, and CT.PO\n  disassociated processing. Provides technical control architectures, data\n  management workflows, and de-identification implementation guidance.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: privacy-engineering\n  tags: \"nist-privacy-framework, control-function, data-management, disassociated-processing, de-identification\"\n---\n\n# NIST Privacy Framework — CONTROL Function\n\n## Overview\n\nThe CONTROL function develops and implements appropriate activities to enable organizations and individuals to manage data with sufficient granularity to manage privacy risks. It addresses data management, data processing governance, and disassociated processing techniques.\n\n## CONTROL Function Subcategories\n\n### CT.DM — Data Management\n\nPolicies and procedures for managing data throughout its lifecycle.\n\n| Subcategory | Description | Implementation Guidance |\n|-------------|-------------|------------------------|\n| CT.DM-P1 | Data elements can be accessed for review | Implement data subject access portals. Provide export in machine-readable formats (JSON, CSV). Response within regulatory timelines. |\n| CT.DM-P2 | Data elements can be accessed for transmission or disclosure | Support data portability requests. Implement secure transfer mechanisms. Maintain disclosure logs. |\n| CT.DM-P3 | Data elements can be accessed for alteration | Enable data correction workflows. Propagate corrections across all systems holding the data. |\n| CT.DM-P4 | Data elements can be accessed for deletion | Implement cascading deletion across primary and backup systems. Maintain deletion verification logs. Address data in analytics pipelines. |\n| CT.DM-P5 | Data processing activities are configured to meet the organization's data processing principles | Default to most privacy-protective settings. Implement purpose limitation at the system level. |\n| CT.DM-P6 | Retention schedules are established and in place | Define retention periods per data category. Implement automated purging. Document legal hold exceptions. |\n| CT.DM-P7 | Data are processed in accordance with established retention schedules | Automated enforcement of retention policies. Regular audits of data stores. Reporting on retention compliance. |\n| CT.DM-P8 | Integrity of data elements is maintained | Implement checksums and validation rules. Detect and resolve data quality issues. Track data lineage. |\n| CT.DM-P9 | Audit\u002Flog records are determined, documented, implemented, and reviewed | Privacy-specific audit logging for all data access and modifications. Log retention per regulatory requirements. |\n| CT.DM-P10 | Mechanisms for data subjects to authorize processing exist | Consent collection and management infrastructure. Granular consent options. Consent withdrawal capability. |\n\n### CT.DP — Data Processing Policies and Procedures\n\nGovernance controls for data processing activities.\n\n| Subcategory | Description | Implementation Guidance |\n|-------------|-------------|------------------------|\n| CT.DP-P1 | Policies, processes, and procedures for authorizing data processing are maintained and enforced | Document lawful basis for each processing activity. Implement access controls aligned with authorized purposes. |\n| CT.DP-P2 | Data processing environment is identified, managed, and monitored | Maintain environment inventory (production, staging, development). Monitor for unauthorized processing. Separate test data from production data. |\n| CT.DP-P3 | Data processing procedures are maintained and monitored to meet established terms | Standard operating procedures for each processing type. Automated compliance checking. Exception management workflow. |\n| CT.DP-P4 | System or device configurations are set to authorized specifications | Secure configuration baselines for systems processing personal data. Configuration drift detection. Change management for privacy-relevant settings. |\n| CT.DP-P5 | Data processing activities are monitored and logged | Real-time monitoring of data processing operations. Anomaly detection for unusual processing patterns. Alerting for policy violations. |\n\n### CT.PO — Disassociated Processing\n\nTechniques to process data while minimizing identifiability.\n\n| Subcategory | Description | Implementation Guidance |\n|-------------|-------------|------------------------|\n| CT.PO-P1 | De-identification is applied to data elements to limit observability or linkability | Apply pseudonymization, anonymization, or generalization based on use case. Document de-identification methodology. |\n| CT.PO-P2 | Technical measures for disassociated processing are implemented | Deploy differential privacy, secure multi-party computation, or homomorphic encryption as appropriate. Select technique based on data utility requirements. |\n\n## Data Management Architecture\n\n### Lifecycle Control Points\n\n```\nCollection --> Storage --> Processing --> Sharing --> Retention --> Deletion\n    |            |           |             |            |            |\n    v            v           v             v            v            v\n Consent     Encryption   Purpose      Access       Schedule    Cascading\n Capture     at Rest      Limitation   Controls     Enforcement  Purge\n    |            |           |             |            |            |\n    v            v           v             v            v            v\n Audit Log   Access Log   Process Log  Transfer Log Retention Log Deletion Log\n```\n\n### Data Element Access Control Matrix\n\n| Operation | Data Subject | Data Steward | Processor | Analyst | Admin |\n|-----------|-------------|-------------|-----------|---------|-------|\n| View own data | Yes | Yes | No | No | Yes |\n| Export own data | Yes | Yes | No | No | Yes |\n| Correct own data | Request | Yes | No | No | Yes |\n| Delete own data | Request | Yes | No | No | Yes |\n| View aggregate | No | Yes | Yes | Yes | Yes |\n| Process data | No | No | Yes | No | Yes |\n| Analyze data | No | No | No | Yes | Yes |\n| Configure system | No | No | No | No | Yes |\n\n## Disassociated Processing Techniques\n\n### Technique Selection Guide\n\n| Technique | Identifiability Reduction | Data Utility | Computational Cost | Reversible |\n|-----------|--------------------------|-------------|-------------------|------------|\n| Pseudonymization | Medium | High | Low | Yes (with key) |\n| k-Anonymity | Medium-High | Medium | Medium | No |\n| l-Diversity | High | Medium | Medium | No |\n| t-Closeness | High | Medium-Low | High | No |\n| Differential Privacy | Very High | Medium | Medium | No |\n| Data Masking | Low-Medium | Medium | Low | Depends |\n| Generalization | Medium | Medium | Low | No |\n| Suppression | High | Low | Low | No |\n| Synthetic Data | Very High | Variable | High | No |\n\n### De-identification Decision Framework\n\n```\nIs the data being shared externally?\n├── Yes → Is re-identification risk acceptable?\n│   ├── No → Apply formal anonymization (differential privacy, k-anonymity with k>=5)\n│   └── Yes → Apply pseudonymization with contractual controls\n└── No → Is the data used for analytics?\n    ├── Yes → Apply aggregation or differential privacy\n    └── No → Apply pseudonymization with access controls\n```\n\n## Retention Schedule Template\n\n| Data Category | Retention Period | Legal Basis | Deletion Method | Verification |\n|--------------|-----------------|-------------|-----------------|-------------|\n| Customer transaction records | 7 years from transaction | Tax\u002Faccounting regulations | Secure overwrite | Automated audit |\n| Marketing consent records | Duration of consent + 3 years | Legitimate interest (proof) | Logical deletion | Annual review |\n| Employee personnel files | Employment + 7 years | Employment law | Secure destruction | HR verification |\n| Website analytics | 26 months | Consent | Automated purge | Monthly check |\n| Support tickets | 3 years from resolution | Contract performance | Secure overwrite | Quarterly audit |\n| CCTV footage | 30 days | Legitimate interest | Automated overwrite | Weekly check |\n| Backup tapes | 90 days rolling | Business continuity | Tape degaussing | Quarterly audit |\n\n## Audit Logging Requirements\n\n### Privacy-Specific Events to Log\n\n| Event Category | Specific Events | Required Fields |\n|---------------|-----------------|-----------------|\n| Data Access | View, export, download | User ID, timestamp, data subject ID, data elements accessed, purpose |\n| Data Modification | Create, update, correct | User ID, timestamp, data subject ID, before\u002Fafter values, purpose |\n| Data Deletion | Delete, purge, anonymize | User ID, timestamp, data subject ID, deletion scope, verification |\n| Consent Changes | Grant, withdraw, modify | Data subject ID, timestamp, consent scope, collection channel |\n| Data Transfer | Internal transfer, external disclosure | User ID, timestamp, recipient, data elements, legal basis |\n| Configuration | Access control changes, retention policy changes | Admin ID, timestamp, before\u002Fafter settings, approval reference |\n\n## Control Mapping\n\n| NIST PF CONTROL | ISO 27701 | GDPR Article | NIST 800-53 |\n|-----------------|-----------|--------------|-------------|\n| CT.DM-P1 | A.7.3.3 | Art. 15 | PM-25 |\n| CT.DM-P2 | A.7.3.7 | Art. 20 | PM-25 |\n| CT.DM-P3 | A.7.3.4 | Art. 16 | PM-25 |\n| CT.DM-P4 | A.7.3.5 | Art. 17 | PM-25 |\n| CT.DM-P6 | A.7.4.7 | Art. 5(1)(e) | SI-12 |\n| CT.DM-P9 | A.7.2.8 | Art. 30 | AU-2 |\n| CT.DM-P10 | A.7.2.3 | Art. 6, 7 | IP-1 |\n| CT.DP-P1 | A.7.2.2 | Art. 6(1) | PT-3 |\n| CT.DP-P5 | A.7.2.8 | Art. 30 | AU-6 |\n| CT.PO-P1 | A.7.4.5 | Art. 25(1) | PM-24 |\n| CT.PO-P2 | A.7.4.5 | Art. 25(1) | PM-24 |\n\n## References\n\n- NIST Privacy Framework Version 1.0 (January 16, 2020)\n- NIST SP 800-188 — De-Identifying Government Datasets\n- NIST IR 8053 — De-Identification of Personal Information\n- ISO\u002FIEC 20889:2018 — Privacy Enhancing Data De-identification Techniques\n","# NIST Privacy Framework — CONTROL Function\n\n## Overview\n\nThe CONTROL function develops and implements appropriate activities to enable organizations and individuals to manage data with sufficient granularity to manage privacy risks. It addresses data management, data processing governance, and disassociated processing techniques.\n\n## CONTROL Function Subcategories\n\n### CT.DM — Data Management\n\nPolicies and procedures for managing data throughout its lifecycle.\n\n| Subcategory | Description | Implementation Guidance |\n|-------------|-------------|------------------------|\n| CT.DM-P1 | Data elements can be accessed for review | Implement data subject access portals. Provide export in machine-readable formats (JSON, CSV). Response within regulatory timelines. |\n| CT.DM-P2 | Data elements can be accessed for transmission or disclosure | Support data portability requests. Implement secure transfer mechanisms. Maintain disclosure logs. |\n| CT.DM-P3 | Data elements can be accessed for alteration | Enable data correction workflows. Propagate corrections across all systems holding the data. |\n| CT.DM-P4 | Data elements can be accessed for deletion | Implement cascading deletion across primary and backup systems. Maintain deletion verification logs. Address data in analytics pipelines. |\n| CT.DM-P5 | Data processing activities are configured to meet the organization's data processing principles | Default to most privacy-protective settings. Implement purpose limitation at the system level. |\n| CT.DM-P6 | Retention schedules are established and in place | Define retention periods per data category. Implement automated purging. Document legal hold exceptions. |\n| CT.DM-P7 | Data are processed in accordance with established retention schedules | Automated enforcement of retention policies. Regular audits of data stores. Reporting on retention compliance. |\n| CT.DM-P8 | Integrity of data elements is maintained | Implement checksums and validation rules. Detect and resolve data quality issues. Track data lineage. |\n| CT.DM-P9 | Audit\u002Flog records are determined, documented, implemented, and reviewed | Privacy-specific audit logging for all data access and modifications. Log retention per regulatory requirements. |\n| CT.DM-P10 | Mechanisms for data subjects to authorize processing exist | Consent collection and management infrastructure. Granular consent options. Consent withdrawal capability. |\n\n### CT.DP — Data Processing Policies and Procedures\n\nGovernance controls for data processing activities.\n\n| Subcategory | Description | Implementation Guidance |\n|-------------|-------------|------------------------|\n| CT.DP-P1 | Policies, processes, and procedures for authorizing data processing are maintained and enforced | Document lawful basis for each processing activity. Implement access controls aligned with authorized purposes. |\n| CT.DP-P2 | Data processing environment is identified, managed, and monitored | Maintain environment inventory (production, staging, development). Monitor for unauthorized processing. Separate test data from production data. |\n| CT.DP-P3 | Data processing procedures are maintained and monitored to meet established terms | Standard operating procedures for each processing type. Automated compliance checking. Exception management workflow. |\n| CT.DP-P4 | System or device configurations are set to authorized specifications | Secure configuration baselines for systems processing personal data. Configuration drift detection. Change management for privacy-relevant settings. |\n| CT.DP-P5 | Data processing activities are monitored and logged | Real-time monitoring of data processing operations. Anomaly detection for unusual processing patterns. Alerting for policy violations. |\n\n### CT.PO — Disassociated Processing\n\nTechniques to process data while minimizing identifiability.\n\n| Subcategory | Description | Implementation Guidance |\n|-------------|-------------|------------------------|\n| CT.PO-P1 | De-identification is applied to data elements to limit observability or linkability | Apply pseudonymization, anonymization, or generalization based on use case. Document de-identification methodology. |\n| CT.PO-P2 | Technical measures for disassociated processing are implemented | Deploy differential privacy, secure multi-party computation, or homomorphic encryption as appropriate. Select technique based on data utility requirements. |\n\n## Data Management Architecture\n\n### Lifecycle Control Points\n\n```\nCollection --> Storage --> Processing --> Sharing --> Retention --> Deletion\n    |            |           |             |            |            |\n    v            v           v             v            v            v\n Consent     Encryption   Purpose      Access       Schedule    Cascading\n Capture     at Rest      Limitation   Controls     Enforcement  Purge\n    |            |           |             |            |            |\n    v            v           v             v            v            v\n Audit Log   Access Log   Process Log  Transfer Log Retention Log Deletion Log\n```\n\n### Data Element Access Control Matrix\n\n| Operation | Data Subject | Data Steward | Processor | Analyst | Admin |\n|-----------|-------------|-------------|-----------|---------|-------|\n| View own data | Yes | Yes | No | No | Yes |\n| Export own data | Yes | Yes | No | No | Yes |\n| Correct own data | Request | Yes | No | No | Yes |\n| Delete own data | Request | Yes | No | No | Yes |\n| View aggregate | No | Yes | Yes | Yes | Yes |\n| Process data | No | No | Yes | No | Yes |\n| Analyze data | No | No | No | Yes | Yes |\n| Configure system | No | No | No | No | Yes |\n\n## Disassociated Processing Techniques\n\n### Technique Selection Guide\n\n| Technique | Identifiability Reduction | Data Utility | Computational Cost | Reversible |\n|-----------|--------------------------|-------------|-------------------|------------|\n| Pseudonymization | Medium | High | Low | Yes (with key) |\n| k-Anonymity | Medium-High | Medium | Medium | No |\n| l-Diversity | High | Medium | Medium | No |\n| t-Closeness | High | Medium-Low | High | No |\n| Differential Privacy | Very High | Medium | Medium | No |\n| Data Masking | Low-Medium | Medium | Low | Depends |\n| Generalization | Medium | Medium | Low | No |\n| Suppression | High | Low | Low | No |\n| Synthetic Data | Very High | Variable | High | No |\n\n### De-identification Decision Framework\n\n```\nIs the data being shared externally?\n├── Yes → Is re-identification risk acceptable?\n│   ├── No → Apply formal anonymization (differential privacy, k-anonymity with k>=5)\n│   └── Yes → Apply pseudonymization with contractual controls\n└── No → Is the data used for analytics?\n    ├── Yes → Apply aggregation or differential privacy\n    └── No → Apply pseudonymization with access controls\n```\n\n## Retention Schedule Template\n\n| Data Category | Retention Period | Legal Basis | Deletion Method | Verification |\n|--------------|-----------------|-------------|-----------------|-------------|\n| Customer transaction records | 7 years from transaction | Tax\u002Faccounting regulations | Secure overwrite | Automated audit |\n| Marketing consent records | Duration of consent + 3 years | Legitimate interest (proof) | Logical deletion | Annual review |\n| Employee personnel files | Employment + 7 years | Employment law | Secure destruction | HR verification |\n| Website analytics | 26 months | Consent | Automated purge | Monthly check |\n| Support tickets | 3 years from resolution | Contract performance | Secure overwrite | Quarterly audit |\n| CCTV footage | 30 days | Legitimate interest | Automated overwrite | Weekly check |\n| Backup tapes | 90 days rolling | Business continuity | Tape degaussing | Quarterly audit |\n\n## Audit Logging Requirements\n\n### Privacy-Specific Events to Log\n\n| Event Category | Specific Events | Required Fields |\n|---------------|-----------------|-----------------|\n| Data Access | View, export, download | User ID, timestamp, data subject ID, data elements accessed, purpose |\n| Data Modification | Create, update, correct | User ID, timestamp, data subject ID, before\u002Fafter values, purpose |\n| Data Deletion | Delete, purge, anonymize | User ID, timestamp, data subject ID, deletion scope, verification |\n| Consent Changes | Grant, withdraw, modify | Data subject ID, timestamp, consent scope, collection channel |\n| Data Transfer | Internal transfer, external disclosure | User ID, timestamp, recipient, data elements, legal basis |\n| Configuration | Access control changes, retention policy changes | Admin ID, timestamp, before\u002Fafter settings, approval reference |\n\n## Control Mapping\n\n| NIST PF CONTROL | ISO 27701 | GDPR Article | NIST 800-53 |\n|-----------------|-----------|--------------|-------------|\n| CT.DM-P1 | A.7.3.3 | Art. 15 | PM-25 |\n| CT.DM-P2 | A.7.3.7 | Art. 20 | PM-25 |\n| CT.DM-P3 | A.7.3.4 | Art. 16 | PM-25 |\n| CT.DM-P4 | A.7.3.5 | Art. 17 | PM-25 |\n| CT.DM-P6 | A.7.4.7 | Art. 5(1)(e) | SI-12 |\n| CT.DM-P9 | A.7.2.8 | Art. 30 | AU-2 |\n| CT.DM-P10 | A.7.2.3 | Art. 6, 7 | IP-1 |\n| CT.DP-P1 | A.7.2.2 | Art. 6(1) | PT-3 |\n| CT.DP-P5 | A.7.2.8 | Art. 30 | AU-6 |\n| CT.PO-P1 | A.7.4.5 | Art. 25(1) | PM-24 |\n| CT.PO-P2 | A.7.4.5 | Art. 25(1) | PM-24 |\n\n## References\n\n- NIST Privacy Framework Version 1.0 (January 16, 2020)\n- NIST SP 800-188 — De-Identifying Government Datasets\n- NIST IR 8053 — De-Identification of Personal Information\n- ISO\u002FIEC 20889:2018 — Privacy Enhancing Data De-identification Techniques\n",{"name":5,"license":15,"metadata":37,"description":7},{"tags":38,"author":9,"domain":30,"version":39,"subdomain":40},"nist-privacy-framework, control-function, data-management, disassociated-processing, de-identification","1.0","privacy-engineering","main","9b2ef9eae161c00a17241d42a388571321b33e9f","skills\u002Fprivacy\u002Fnist-pf-control",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill nist-pf-control",{"tool":56,"command":57},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill nist-pf-control",{"tool":59,"command":60},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill nist-pf-control","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-pf-control\u002FSKILL.md",true,[64,70,76,80,86,90,94,98,104,108],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"anthropic-best-practices.md","REFERENCE","参考文档",45825,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Fanthropic-best-practices.md",{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"assets\u002Ftemplate.md","ASSET","资产文件",1325,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-pf-control\u002Fassets\u002Ftemplate.md",{"path":77,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":78,"sourceHtmlUrl":79},"examples\u002FCLAUDE_MD_TESTING.md",5423,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Fexamples\u002FCLAUDE_MD_TESTING.md",{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"graphviz-conventions.dot","OTHER","其他",5970,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Fgraphviz-conventions.dot",{"path":87,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":88,"sourceHtmlUrl":89},"persuasion-principles.md",5908,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Fpersuasion-principles.md",{"path":91,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fstandards.md",1485,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-pf-control\u002Freferences\u002Fstandards.md",{"path":95,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fworkflows.md",1677,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-pf-control\u002Freferences\u002Fworkflows.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"render-graphs.js","SCRIPT","脚本",4857,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Frender-graphs.js",{"path":105,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fprocess.py",8277,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-pf-control\u002Fscripts\u002Fprocess.py",{"path":109,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":110,"sourceHtmlUrl":111},"testing-skills-with-subagents.md",12557,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fsuperpowers\u002Fskills\u002Fwriting-skills\u002Ftesting-skills-with-subagents.md",[113,139,154,167,184,197],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":130,"publishedAt":32},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[119,124,127],{"categoryNo":120,"categoryName":121,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":125,"categoryName":126,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务",[131,132,30,133,134,31,135,136,137,138],"email","workplace email privacy","compliance","content","policy","testing","monitoring","metadata",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":147,"publishedAt":32},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[145,146],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},[31,148,149,150,133,151,152,30,153],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":161,"publishedAt":32},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[160],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[31,162,163,164,165,152,30,166],"vendor termination data","planning","verification","extraction","certification",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":174,"publishedAt":32},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[173],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[175,176,177,178,179,180,181,182,30,31,183],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":185,"name":186,"nameZh":6,"description":187,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":188,"categories":189,"keywords":191,"publishedAt":32},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[190],{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},[30,192,152,193,180,194,195,31,183,176,166,196],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":210,"publishedAt":32},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[203,206,209],{"categoryNo":204,"categoryName":205,"taxonomyType":122,"taxonomyTypeDesc":123},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":207,"categoryName":208,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,30,213,164,214,133,152,215,183,216,217,218,163],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]