[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFYNQBSC9RCFRJ0RYCT537":3,"skill-same:01M6AFYNQBSC9RCFRJ0RYCT537":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":35,"linkOnly":36,"markdownContent":37,"markdownBody":38,"frontMatter":39,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":50,"ownerDescription":51,"updatedAt":52,"install":53,"resources":66},"01M6AFYNQBSC9RCFRJ0RYCT537","nist-privacy-identify",null,"Guides implementation of the NIST Privacy Framework IDENTIFY function covering ID.BE business environment, ID.DA data actions, ID.IM improvement, and ID.RA risk assessment subcategories. Maps NIST PF controls to GDPR requirements for dual-framework compliance. Keywords: NIST Privacy Framework, IDENTIFY function, ID.BE, ID.DA, ID.IM, ID.RA, privacy risk assessment, data actions.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-privacy-identify\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34],"privacy","NIST","nist privacy identify","risk assessment","assessment","framework","actions","compliance","gdpr","data","risk","2026-11-10 10:12:30",false,"---\nname: nist-privacy-identify\ndescription: >-\n  Guides implementation of the NIST Privacy Framework IDENTIFY function\n  covering ID.BE business environment, ID.DA data actions, ID.IM improvement,\n  and ID.RA risk assessment subcategories. Maps NIST PF controls to GDPR\n  requirements for dual-framework compliance. Keywords: NIST Privacy\n  Framework, IDENTIFY function, ID.BE, ID.DA, ID.IM, ID.RA, privacy risk\n  assessment, data actions.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: privacy-impact-assessment\n  tags: \"nist-privacy-framework, identify-function, privacy-risk, data-actions\"\n---\n\n# Implementing NIST Privacy Framework IDENTIFY Function\n\n## Overview\n\nThe NIST Privacy Framework Version 1.0 (January 2020) provides a voluntary enterprise risk management tool structured around five core functions: IDENTIFY, GOVERN, CONTROL, COMMUNICATE, and PROTECT. The IDENTIFY function develops the organisational understanding to manage privacy risk arising from data processing. This skill covers the four IDENTIFY subcategories: Inventory and Mapping (ID.IM), Business Environment (ID.BE), Risk Assessment (ID.RA), and Data Processing Ecosystem Risk Management (ID.DE).\n\n## IDENTIFY Function Structure\n\n### ID.IM — Inventory and Mapping\n\nData processing inventory and mapping activities are understood by the organisation.\n\n| Subcategory | Description | Implementation |\n|-------------|-------------|----------------|\n| ID.IM-P1 | Systems\u002Fproducts\u002Fservices that process data are inventoried | Maintain a comprehensive register of all systems processing personal data, including SaaS tools, internal databases, and third-party integrations |\n| ID.IM-P2 | Owners of systems\u002Fproducts\u002Fservices are identified | Assign a data processing owner to each system with documented responsibility for privacy compliance |\n| ID.IM-P3 | Categories of individuals whose data are processed are inventoried | Map all data subject categories (employees, customers, patients, vendors, website visitors) |\n| ID.IM-P4 | Data actions of the systems\u002Fproducts\u002Fservices are inventoried | Document data lifecycle actions: collection, retention, logging, generation, transformation, use, disclosure, sharing, transmission, disposal |\n| ID.IM-P5 | Purposes for data actions are inventoried | Document specific purposes for each data action, aligned with GDPR Art. 5(1)(b) purpose limitation |\n| ID.IM-P6 | Data elements within the data actions are inventoried | Catalogue all personal data elements processed per system and per purpose |\n| ID.IM-P7 | Environmental factors affecting the data processing ecosystem are understood | Assess external factors: legal\u002Fregulatory requirements, industry standards, market expectations, organisational risk tolerance |\n| ID.IM-P8 | Data processing is mapped | Create and maintain data flow maps showing how personal data moves through the organisation |\n\n### ID.BE — Business Environment\n\nThe organisation's mission, objectives, stakeholders, and activities are understood and prioritised.\n\n| Subcategory | Description | Implementation |\n|-------------|-------------|----------------|\n| ID.BE-P1 | The organisation's role in the data processing ecosystem is identified and communicated | Determine controller\u002Fprocessor\u002Fjoint controller status for each processing activity |\n| ID.BE-P2 | Priorities for organisational mission, objectives, and activities are established and communicated | Align privacy programme with business objectives; ensure privacy is a design requirement |\n| ID.BE-P3 | Systems\u002Fproducts\u002Fservices that support organisational priorities are identified and key requirements communicated | Identify which processing activities are critical to business operations and prioritise privacy investment accordingly |\n\n### ID.RA — Risk Assessment\n\nThe organisation understands the privacy risks to individuals and how such processing creates privacy risks to the organisation.\n\n| Subcategory | Description | Implementation |\n|-------------|-------------|----------------|\n| ID.RA-P1 | Contextual factors related to the systems\u002Fproducts\u002Fservices and data actions are identified | Assess context: relationship with data subjects, data subject expectations, sensitivity, volume, collection method |\n| ID.RA-P2 | Data analytic inputs and outputs are identified and evaluated | For data analytics and AI, identify inputs (training data, inference data) and outputs (predictions, scores, decisions) |\n| ID.RA-P3 | Potential problems for individuals that arise from data processing are identified | Identify privacy harms: loss of autonomy, discrimination, economic loss, physical harm, reputational damage, loss of trust |\n| ID.RA-P4 | Problematic data actions, the likelihood that they occur, and the resulting problems for individuals are identified and assessed | Assess likelihood and severity of each problematic data action — aligned with GDPR DPIA risk assessment |\n| ID.RA-P5 | Risk responses are identified and prioritised | For each identified risk, determine response: mitigate, transfer, avoid, accept |\n\n### ID.DE — Data Processing Ecosystem Risk Management\n\nThe organisation identifies, assesses, and manages privacy risks associated with data processing by third parties.\n\n| Subcategory | Description | Implementation |\n|-------------|-------------|----------------|\n| ID.DE-P1 | Data processing ecosystem risk management policies, processes, and procedures are identified, established, assessed, and managed | Vendor privacy management programme with due diligence, contractual requirements, and ongoing monitoring |\n| ID.DE-P2 | Data processing ecosystem parties are identified, prioritised, and assessed | Map all processors, sub-processors, and third-party recipients with risk rating |\n| ID.DE-P3 | Contracts with data processing ecosystem parties are established, maintained, and managed | Art. 28 DPAs with all processors; joint controller arrangements per Art. 26 |\n| ID.DE-P4 | Interoperability frameworks or mechanisms are established for data processing ecosystem parties | Standard data formats, APIs, and privacy-preserving data exchange protocols |\n| ID.DE-P5 | Data processing ecosystem parties are managed consistent with the organisation's risk strategy | Ongoing processor performance monitoring, audit rights exercise, sub-processor change management |\n\n## NIST PF to GDPR Mapping\n\n| NIST PF Subcategory | GDPR Equivalent | Implementation Overlap |\n|---------------------|-----------------|----------------------|\n| ID.IM-P1 through P8 | Art. 30 Records of Processing Activities | RoPA fulfils the core inventory and mapping requirements |\n| ID.BE-P1 | Art. 26 Joint Controllers, Art. 28 Processors | Role determination aligns directly |\n| ID.RA-P1 through P5 | Art. 35 DPIA | DPIA risk assessment methodology maps to NIST risk assessment |\n| ID.DE-P1 through P5 | Art. 28 Processor Requirements | Processor governance maps to ecosystem risk management |\n\n## Implementation Methodology\n\n### Phase 1: Establish Inventory and Mapping (Months 1-3)\n\n1. Deploy a data discovery tool to identify personal data across all systems.\n2. Conduct departmental interviews to identify informal data processing.\n3. Create the system-level processing inventory (ID.IM-P1, P2).\n4. Map data subject categories (ID.IM-P3) and data elements (ID.IM-P6).\n5. Document data actions per system (ID.IM-P4) and purposes (ID.IM-P5).\n6. Create data flow maps (ID.IM-P8).\n7. Cross-reference with existing Art. 30 RoPA.\n\n### Phase 2: Business Environment Analysis (Month 2-3)\n\n1. Determine controller\u002Fprocessor\u002Fjoint controller roles (ID.BE-P1).\n2. Align privacy programme priorities with business strategy (ID.BE-P2).\n3. Identify critical processing activities (ID.BE-P3).\n\n### Phase 3: Risk Assessment (Months 3-5)\n\n1. For each processing activity, assess contextual factors (ID.RA-P1).\n2. Identify problematic data actions using the NIST problematic data action taxonomy:\n   - Appropriation: use of data in ways beyond data subject expectations\n   - Distortion: use of inaccurate data or misleading inferences\n   - Induced disclosure: pressure to reveal more data than intended\n   - Insecurity: inadequate protection of data\n   - Re-identification: linking anonymised data back to individuals\n   - Stigmatisation: association with disfavoured groups\n   - Surveillance: excessive monitoring\n   - Unanticipated revelation: discovery of information beyond original data\n   - Unwarranted restriction: limiting access to services based on data\n3. Assess likelihood and severity for each problematic data action (ID.RA-P4).\n4. Determine risk responses (ID.RA-P5).\n\n### Phase 4: Ecosystem Risk Management (Months 4-6)\n\n1. Inventory all third-party data processors and recipients (ID.DE-P2).\n2. Conduct vendor privacy due diligence assessments.\n3. Verify DPA compliance for all processors (ID.DE-P3).\n4. Establish ongoing monitoring programme (ID.DE-P5).\n\n## Enforcement Context\n\nWhile the NIST Privacy Framework is voluntary and not directly enforceable, organisations demonstrating NIST PF implementation show a mature privacy programme that can support GDPR accountability under Art. 5(2) and Art. 24. US state privacy laws (California CPRA, Virginia VCDPA, Colorado CPA) increasingly reference the NIST PF as a compliance resource.\n","# Implementing NIST Privacy Framework IDENTIFY Function\n\n## Overview\n\nThe NIST Privacy Framework Version 1.0 (January 2020) provides a voluntary enterprise risk management tool structured around five core functions: IDENTIFY, GOVERN, CONTROL, COMMUNICATE, and PROTECT. The IDENTIFY function develops the organisational understanding to manage privacy risk arising from data processing. This skill covers the four IDENTIFY subcategories: Inventory and Mapping (ID.IM), Business Environment (ID.BE), Risk Assessment (ID.RA), and Data Processing Ecosystem Risk Management (ID.DE).\n\n## IDENTIFY Function Structure\n\n### ID.IM — Inventory and Mapping\n\nData processing inventory and mapping activities are understood by the organisation.\n\n| Subcategory | Description | Implementation |\n|-------------|-------------|----------------|\n| ID.IM-P1 | Systems\u002Fproducts\u002Fservices that process data are inventoried | Maintain a comprehensive register of all systems processing personal data, including SaaS tools, internal databases, and third-party integrations |\n| ID.IM-P2 | Owners of systems\u002Fproducts\u002Fservices are identified | Assign a data processing owner to each system with documented responsibility for privacy compliance |\n| ID.IM-P3 | Categories of individuals whose data are processed are inventoried | Map all data subject categories (employees, customers, patients, vendors, website visitors) |\n| ID.IM-P4 | Data actions of the systems\u002Fproducts\u002Fservices are inventoried | Document data lifecycle actions: collection, retention, logging, generation, transformation, use, disclosure, sharing, transmission, disposal |\n| ID.IM-P5 | Purposes for data actions are inventoried | Document specific purposes for each data action, aligned with GDPR Art. 5(1)(b) purpose limitation |\n| ID.IM-P6 | Data elements within the data actions are inventoried | Catalogue all personal data elements processed per system and per purpose |\n| ID.IM-P7 | Environmental factors affecting the data processing ecosystem are understood | Assess external factors: legal\u002Fregulatory requirements, industry standards, market expectations, organisational risk tolerance |\n| ID.IM-P8 | Data processing is mapped | Create and maintain data flow maps showing how personal data moves through the organisation |\n\n### ID.BE — Business Environment\n\nThe organisation's mission, objectives, stakeholders, and activities are understood and prioritised.\n\n| Subcategory | Description | Implementation |\n|-------------|-------------|----------------|\n| ID.BE-P1 | The organisation's role in the data processing ecosystem is identified and communicated | Determine controller\u002Fprocessor\u002Fjoint controller status for each processing activity |\n| ID.BE-P2 | Priorities for organisational mission, objectives, and activities are established and communicated | Align privacy programme with business objectives; ensure privacy is a design requirement |\n| ID.BE-P3 | Systems\u002Fproducts\u002Fservices that support organisational priorities are identified and key requirements communicated | Identify which processing activities are critical to business operations and prioritise privacy investment accordingly |\n\n### ID.RA — Risk Assessment\n\nThe organisation understands the privacy risks to individuals and how such processing creates privacy risks to the organisation.\n\n| Subcategory | Description | Implementation |\n|-------------|-------------|----------------|\n| ID.RA-P1 | Contextual factors related to the systems\u002Fproducts\u002Fservices and data actions are identified | Assess context: relationship with data subjects, data subject expectations, sensitivity, volume, collection method |\n| ID.RA-P2 | Data analytic inputs and outputs are identified and evaluated | For data analytics and AI, identify inputs (training data, inference data) and outputs (predictions, scores, decisions) |\n| ID.RA-P3 | Potential problems for individuals that arise from data processing are identified | Identify privacy harms: loss of autonomy, discrimination, economic loss, physical harm, reputational damage, loss of trust |\n| ID.RA-P4 | Problematic data actions, the likelihood that they occur, and the resulting problems for individuals are identified and assessed | Assess likelihood and severity of each problematic data action — aligned with GDPR DPIA risk assessment |\n| ID.RA-P5 | Risk responses are identified and prioritised | For each identified risk, determine response: mitigate, transfer, avoid, accept |\n\n### ID.DE — Data Processing Ecosystem Risk Management\n\nThe organisation identifies, assesses, and manages privacy risks associated with data processing by third parties.\n\n| Subcategory | Description | Implementation |\n|-------------|-------------|----------------|\n| ID.DE-P1 | Data processing ecosystem risk management policies, processes, and procedures are identified, established, assessed, and managed | Vendor privacy management programme with due diligence, contractual requirements, and ongoing monitoring |\n| ID.DE-P2 | Data processing ecosystem parties are identified, prioritised, and assessed | Map all processors, sub-processors, and third-party recipients with risk rating |\n| ID.DE-P3 | Contracts with data processing ecosystem parties are established, maintained, and managed | Art. 28 DPAs with all processors; joint controller arrangements per Art. 26 |\n| ID.DE-P4 | Interoperability frameworks or mechanisms are established for data processing ecosystem parties | Standard data formats, APIs, and privacy-preserving data exchange protocols |\n| ID.DE-P5 | Data processing ecosystem parties are managed consistent with the organisation's risk strategy | Ongoing processor performance monitoring, audit rights exercise, sub-processor change management |\n\n## NIST PF to GDPR Mapping\n\n| NIST PF Subcategory | GDPR Equivalent | Implementation Overlap |\n|---------------------|-----------------|----------------------|\n| ID.IM-P1 through P8 | Art. 30 Records of Processing Activities | RoPA fulfils the core inventory and mapping requirements |\n| ID.BE-P1 | Art. 26 Joint Controllers, Art. 28 Processors | Role determination aligns directly |\n| ID.RA-P1 through P5 | Art. 35 DPIA | DPIA risk assessment methodology maps to NIST risk assessment |\n| ID.DE-P1 through P5 | Art. 28 Processor Requirements | Processor governance maps to ecosystem risk management |\n\n## Implementation Methodology\n\n### Phase 1: Establish Inventory and Mapping (Months 1-3)\n\n1. Deploy a data discovery tool to identify personal data across all systems.\n2. Conduct departmental interviews to identify informal data processing.\n3. Create the system-level processing inventory (ID.IM-P1, P2).\n4. Map data subject categories (ID.IM-P3) and data elements (ID.IM-P6).\n5. Document data actions per system (ID.IM-P4) and purposes (ID.IM-P5).\n6. Create data flow maps (ID.IM-P8).\n7. Cross-reference with existing Art. 30 RoPA.\n\n### Phase 2: Business Environment Analysis (Month 2-3)\n\n1. Determine controller\u002Fprocessor\u002Fjoint controller roles (ID.BE-P1).\n2. Align privacy programme priorities with business strategy (ID.BE-P2).\n3. Identify critical processing activities (ID.BE-P3).\n\n### Phase 3: Risk Assessment (Months 3-5)\n\n1. For each processing activity, assess contextual factors (ID.RA-P1).\n2. Identify problematic data actions using the NIST problematic data action taxonomy:\n   - Appropriation: use of data in ways beyond data subject expectations\n   - Distortion: use of inaccurate data or misleading inferences\n   - Induced disclosure: pressure to reveal more data than intended\n   - Insecurity: inadequate protection of data\n   - Re-identification: linking anonymised data back to individuals\n   - Stigmatisation: association with disfavoured groups\n   - Surveillance: excessive monitoring\n   - Unanticipated revelation: discovery of information beyond original data\n   - Unwarranted restriction: limiting access to services based on data\n3. Assess likelihood and severity for each problematic data action (ID.RA-P4).\n4. Determine risk responses (ID.RA-P5).\n\n### Phase 4: Ecosystem Risk Management (Months 4-6)\n\n1. Inventory all third-party data processors and recipients (ID.DE-P2).\n2. Conduct vendor privacy due diligence assessments.\n3. Verify DPA compliance for all processors (ID.DE-P3).\n4. Establish ongoing monitoring programme (ID.DE-P5).\n\n## Enforcement Context\n\nWhile the NIST Privacy Framework is voluntary and not directly enforceable, organisations demonstrating NIST PF implementation show a mature privacy programme that can support GDPR accountability under Art. 5(2) and Art. 24. US state privacy laws (California CPRA, Virginia VCDPA, Colorado CPA) increasingly reference the NIST PF as a compliance resource.\n",{"name":5,"license":15,"metadata":40,"description":7},{"tags":41,"author":9,"domain":24,"version":42,"subdomain":43},"nist-privacy-framework, identify-function, privacy-risk, data-actions","1.0","privacy-impact-assessment","main","9b2ef9eae161c00a17241d42a388571321b33e9f","skills\u002Fprivacy\u002Fnist-privacy-identify",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill nist-privacy-identify",{"tool":59,"command":60},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill nist-privacy-identify",{"tool":62,"command":63},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill nist-privacy-identify","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-privacy-identify\u002FSKILL.md",true,[67,73,79,83],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"assets\u002Ftemplate.md","ASSET","资产文件",823,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-privacy-identify\u002Fassets\u002Ftemplate.md",{"path":74,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fstandards.md","REFERENCE","参考文档",758,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-privacy-identify\u002Freferences\u002Fstandards.md",{"path":80,"resourceType":75,"resourceTypeDesc":76,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fworkflows.md",902,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-privacy-identify\u002Freferences\u002Fworkflows.md",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"scripts\u002Fprocess.py","SCRIPT","脚本",7380,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fnist-privacy-identify\u002Fscripts\u002Fprocess.py",[90,115,129,142,157,170],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":107,"publishedAt":35},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[96,101,104],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":102,"categoryName":103,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务",[108,109,24,31,110,33,111,112,113,114],"email","workplace email privacy","content","policy","testing","monitoring","metadata",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":123,"publishedAt":35},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[121,122],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},[33,124,125,126,31,127,32,24,128],"whistleblower data","identity","reporting","data protection","prevention",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":35},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[135],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[33,137,138,139,140,32,24,141],"vendor termination data","planning","verification","extraction","certification",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":149,"publishedAt":35},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[148],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[150,34,151,152,153,28,154,155,24,33,156],"vendor risk scoring","risk scoring","methodology","risk-scoring","transfer","certifications","processor",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":35},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[163],{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},[24,165,32,166,28,167,168,33,156,34,141,169],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":183,"publishedAt":35},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[176,179,182],{"categoryNo":177,"categoryName":178,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},[184,185,24,186,139,187,31,32,188,156,189,190,191,138],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]