[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG6655ABFKT2BBWHCP4PAT":3,"skill-same:01M6AG6655ABFKT2BBWHCP4PAT":90},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence",null,"Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",337,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35],"privacy","vendor privacy due diligence","review","assessment","onboarding","gdpr","flow","data","processor","risk","certification","analysis","2026-11-10 10:12:30",false,"---\nname: vendor-privacy-due-diligence\ndescription: >-\n  Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk\n  questionnaires, technical controls assessment, certification review, data flow\n  analysis, and documented sufficiency decisions for processor engagement.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: vendor-privacy-management\n  tags: \"vendor-due-diligence, art-28, processor-assessment, privacy-risk, vendor-onboarding\"\n---\n\n# Vendor Privacy Due Diligence\n\n## Overview\n\nGDPR Article 28(1) requires controllers to use only processors providing \"sufficient guarantees to implement appropriate technical and organisational measures\" to meet GDPR requirements and protect data subject rights. This obligation means controllers must conduct thorough privacy due diligence before engaging any vendor that will process personal data. The European Data Protection Board (EDPB) Guidelines 07\u002F2020 on controller and processor concepts reinforce that this assessment must be documented and proportionate to the risk involved.\n\nAt Summit Cloud Partners, the Vendor Privacy Due Diligence Program establishes a structured process for evaluating prospective vendors before any personal data processing begins.\n\n## Due Diligence Framework\n\n### Phase 1: Initial Screening\n\nBefore engaging in detailed evaluation, determine whether the vendor will process personal data at all.\n\n**Processing Determination Checklist:**\n\n| Question | If YES |\n|----------|--------|\n| Will the vendor access, store, or transmit personal data? | Proceed to full due diligence |\n| Will the vendor host systems containing personal data? | Proceed to full due diligence |\n| Will the vendor have logical or physical access to infrastructure holding personal data? | Proceed to full due diligence |\n| Is the vendor providing purely non-personal-data services (e.g., office supplies)? | No due diligence required — document determination |\n\n**Data Flow Preliminary Analysis:**\n\nMap the anticipated data flows before proceeding:\n\n1. What categories of personal data will the vendor process?\n2. How many data subjects are affected (approximate volume)?\n3. Will special category data (Article 9) be involved?\n4. Where will processing occur geographically?\n5. Will the vendor engage sub-processors?\n\n### Phase 2: Privacy Risk Questionnaire\n\nSummit Cloud Partners issues a standardized Privacy Risk Questionnaire to all prospective vendors scoring above the initial screening threshold.\n\n**Section A — Legal and Governance**\n\n| # | Question | Expected Response |\n|---|----------|-------------------|\n| A1 | Does your organization have a designated Data Protection Officer (DPO) or equivalent privacy lead? | Named individual with contact details |\n| A2 | In which jurisdictions is your organization established? | List of all establishment countries |\n| A3 | What is your GDPR compliance governance structure? | Documented privacy program with assigned responsibilities |\n| A4 | Have you been subject to any regulatory enforcement actions, fines, or investigations in the past 5 years? | Disclosure of any actions with remediation status |\n| A5 | Do you maintain a Record of Processing Activities per Article 30(2)? | Confirmation with sample structure |\n| A6 | What lawful bases do you rely on for your own processing activities? | Documented lawful basis assessment |\n| A7 | Do you have a process for conducting Data Protection Impact Assessments per Article 35? | DPIA methodology description |\n\n**Section B — Technical Security Controls**\n\n| # | Question | Expected Response |\n|---|----------|-------------------|\n| B1 | Describe your encryption approach for data at rest and in transit | AES-256 for at-rest, TLS 1.2+ for in-transit minimum |\n| B2 | How do you manage access controls and authentication? | RBAC, MFA, principle of least privilege |\n| B3 | Describe your vulnerability management program | Regular scanning, patching cadence, penetration testing |\n| B4 | What logging and monitoring controls are in place? | SIEM, access logging, anomaly detection |\n| B5 | Describe your incident detection and response capabilities | 24\u002F7 monitoring, documented IRP, mean time to detect |\n| B6 | How do you secure development practices? | SDLC, code review, OWASP compliance |\n| B7 | What physical security controls protect data processing facilities? | Access controls, CCTV, environmental controls |\n\n**Section C — Data Handling Practices**\n\n| # | Question | Expected Response |\n|---|----------|-------------------|\n| C1 | How do you segregate client data from other clients? | Logical or physical segregation description |\n| C2 | What is your data retention and deletion approach? | Defined retention periods, certified deletion |\n| C3 | How do you handle data subject access requests forwarded by controllers? | Process description with SLA commitments |\n| C4 | Describe your data backup and recovery procedures | Backup frequency, encryption, tested recovery |\n| C5 | Do you process personal data in any country outside the EEA? | List of all processing locations with transfer mechanisms |\n| C6 | What is your sub-processor engagement process? | Notification mechanism, assessment requirements |\n\n**Section D — Certifications and Attestations**\n\n| # | Question | Expected Response |\n|---|----------|-------------------|\n| D1 | Do you hold ISO 27001 certification? | Certificate with scope and certification body |\n| D2 | Do you hold ISO 27701 certification? | Certificate with scope |\n| D3 | Do you hold SOC 2 Type II attestation? | Report with scope and period |\n| D4 | Do you hold any cloud-specific certifications (CSA STAR, ISO 27017\u002F27018)? | Certificate details |\n| D5 | Do you adhere to any approved GDPR Code of Conduct per Article 40? | Code of Conduct reference and adherence documentation |\n| D6 | Have you obtained any GDPR certification per Article 42? | Certification details |\n\n### Phase 3: Technical Controls Assessment\n\nBeyond questionnaire responses, Summit Cloud Partners conducts independent verification of critical controls.\n\n**Assessment Methods:**\n\n1. **Documentation Review**: Examine vendor security policies, procedures, and architectural documentation\n2. **Certification Verification**: Independently verify certification validity with issuing bodies\n3. **Technical Testing**: Where contractually permitted, conduct or review penetration test results\n4. **Reference Checks**: Contact existing clients of the vendor regarding privacy practices\n5. **Public Record Search**: Review breach notification databases, regulatory actions, and news reports\n\n**Control Verification Matrix:**\n\n| Control Domain | Questionnaire Claim | Verification Method |\n|---------------|---------------------|-------------------|\n| Encryption at rest | AES-256 | Review architecture docs, request encryption key management details |\n| Encryption in transit | TLS 1.2+ | Technical scan of vendor endpoints |\n| Access management | RBAC with MFA | Review IAM policy documentation |\n| Incident response | 24\u002F7 SOC | Review SOC 2 Type II report findings |\n| Data segregation | Logical separation | Architecture review and documentation |\n| Patch management | Monthly cycle | Review vulnerability management reports |\n\n### Phase 4: Data Flow Analysis\n\nDocument the complete data flow for the proposed processing arrangement.\n\n**Data Flow Documentation Requirements:**\n\n```\nData Flow: Summit Cloud Partners → [Vendor Name]\n\n1. Data Categories:\n   - [List each category of personal data]\n   - Classification level per category (Public\u002FInternal\u002FConfidential\u002FRestricted)\n\n2. Data Subjects:\n   - [List each category of data subject]\n   - Approximate volume per category\n\n3. Transfer Mechanism:\n   - Method: [API \u002F SFTP \u002F Direct database access \u002F etc.]\n   - Encryption: [Protocol and strength]\n   - Authentication: [Method]\n\n4. Processing Locations:\n   - Primary: [Country, City, Data Center]\n   - Backup\u002FDR: [Country, City, Data Center]\n   - Support access: [Countries where staff may access data]\n\n5. Sub-processors:\n   - [List known sub-processors with location and function]\n\n6. Data Retention:\n   - Processing retention: [Duration]\n   - Backup retention: [Duration]\n   - Post-termination: [Return\u002Fdeletion timeline]\n\n7. Return Path:\n   - Data subject requests forwarded via: [mechanism]\n   - Response SLA: [timeframe]\n```\n\n### Phase 5: Sufficiency Decision\n\nThe DPO or Privacy Team Lead reviews all collected evidence and issues a documented sufficiency decision.\n\n**Sufficiency Decision Criteria:**\n\n| Criterion | Weight | Scoring |\n|-----------|--------|---------|\n| Legal governance maturity | 15% | 1-5 scale |\n| Technical security controls | 25% | 1-5 scale |\n| Data handling practices | 20% | 1-5 scale |\n| Certifications held | 15% | 1-5 scale |\n| Breach and enforcement history | 10% | 1-5 scale (inverse) |\n| Sub-processor management | 10% | 1-5 scale |\n| Cross-border transfer safeguards | 5% | 1-5 scale |\n\n**Decision Outcomes:**\n\n- **Approved** (weighted score 4.0+): Vendor provides sufficient guarantees. Proceed to DPA negotiation.\n- **Conditionally Approved** (weighted score 3.0–3.9): Vendor requires supplementary measures or contractual safeguards before engagement. Document conditions.\n- **Rejected** (weighted score below 3.0): Vendor does not provide sufficient guarantees. Document reasons. May be reconsidered after vendor remediation.\n\n**Documentation Requirements per Article 5(2) Accountability:**\n\nThe due diligence file must contain:\n1. Completed Privacy Risk Questionnaire with vendor responses\n2. Evidence of verification activities performed\n3. Data flow analysis documentation\n4. Sufficiency scoring worksheet\n5. Written decision with rationale\n6. Approval signature from DPO or designated privacy lead\n7. Date of assessment and scheduled reassessment date\n\n## Ongoing Obligations\n\nDue diligence is not a one-time exercise. Article 28(1) imposes a continuing obligation to ensure processors maintain sufficient guarantees. Summit Cloud Partners conducts:\n\n- **Annual Reassessment**: Full questionnaire refresh for high-risk vendors, abbreviated for standard risk\n- **Trigger-Based Review**: Reassessment triggered by vendor breach, regulatory action, material service change, or certification lapse\n- **Continuous Monitoring**: Automated alerts on vendor security posture changes via risk monitoring services\n\n## Key Regulatory References\n\n- GDPR Article 28(1) — Controller obligation to use processors with sufficient guarantees\n- GDPR Article 28(3) — Required DPA provisions\n- GDPR Article 5(2) — Accountability principle\n- GDPR Article 30(2) — Processor records of processing\n- GDPR Article 35 — DPIA requirements\n- EDPB Guidelines 07\u002F2020 — Controller and processor concepts under GDPR\n- EDPB Recommendations 01\u002F2020 — Supplementary measures for international transfers\n","# Vendor Privacy Due Diligence\n\n## Overview\n\nGDPR Article 28(1) requires controllers to use only processors providing \"sufficient guarantees to implement appropriate technical and organisational measures\" to meet GDPR requirements and protect data subject rights. This obligation means controllers must conduct thorough privacy due diligence before engaging any vendor that will process personal data. The European Data Protection Board (EDPB) Guidelines 07\u002F2020 on controller and processor concepts reinforce that this assessment must be documented and proportionate to the risk involved.\n\nAt Summit Cloud Partners, the Vendor Privacy Due Diligence Program establishes a structured process for evaluating prospective vendors before any personal data processing begins.\n\n## Due Diligence Framework\n\n### Phase 1: Initial Screening\n\nBefore engaging in detailed evaluation, determine whether the vendor will process personal data at all.\n\n**Processing Determination Checklist:**\n\n| Question | If YES |\n|----------|--------|\n| Will the vendor access, store, or transmit personal data? | Proceed to full due diligence |\n| Will the vendor host systems containing personal data? | Proceed to full due diligence |\n| Will the vendor have logical or physical access to infrastructure holding personal data? | Proceed to full due diligence |\n| Is the vendor providing purely non-personal-data services (e.g., office supplies)? | No due diligence required — document determination |\n\n**Data Flow Preliminary Analysis:**\n\nMap the anticipated data flows before proceeding:\n\n1. What categories of personal data will the vendor process?\n2. How many data subjects are affected (approximate volume)?\n3. Will special category data (Article 9) be involved?\n4. Where will processing occur geographically?\n5. Will the vendor engage sub-processors?\n\n### Phase 2: Privacy Risk Questionnaire\n\nSummit Cloud Partners issues a standardized Privacy Risk Questionnaire to all prospective vendors scoring above the initial screening threshold.\n\n**Section A — Legal and Governance**\n\n| # | Question | Expected Response |\n|---|----------|-------------------|\n| A1 | Does your organization have a designated Data Protection Officer (DPO) or equivalent privacy lead? | Named individual with contact details |\n| A2 | In which jurisdictions is your organization established? | List of all establishment countries |\n| A3 | What is your GDPR compliance governance structure? | Documented privacy program with assigned responsibilities |\n| A4 | Have you been subject to any regulatory enforcement actions, fines, or investigations in the past 5 years? | Disclosure of any actions with remediation status |\n| A5 | Do you maintain a Record of Processing Activities per Article 30(2)? | Confirmation with sample structure |\n| A6 | What lawful bases do you rely on for your own processing activities? | Documented lawful basis assessment |\n| A7 | Do you have a process for conducting Data Protection Impact Assessments per Article 35? | DPIA methodology description |\n\n**Section B — Technical Security Controls**\n\n| # | Question | Expected Response |\n|---|----------|-------------------|\n| B1 | Describe your encryption approach for data at rest and in transit | AES-256 for at-rest, TLS 1.2+ for in-transit minimum |\n| B2 | How do you manage access controls and authentication? | RBAC, MFA, principle of least privilege |\n| B3 | Describe your vulnerability management program | Regular scanning, patching cadence, penetration testing |\n| B4 | What logging and monitoring controls are in place? | SIEM, access logging, anomaly detection |\n| B5 | Describe your incident detection and response capabilities | 24\u002F7 monitoring, documented IRP, mean time to detect |\n| B6 | How do you secure development practices? | SDLC, code review, OWASP compliance |\n| B7 | What physical security controls protect data processing facilities? | Access controls, CCTV, environmental controls |\n\n**Section C — Data Handling Practices**\n\n| # | Question | Expected Response |\n|---|----------|-------------------|\n| C1 | How do you segregate client data from other clients? | Logical or physical segregation description |\n| C2 | What is your data retention and deletion approach? | Defined retention periods, certified deletion |\n| C3 | How do you handle data subject access requests forwarded by controllers? | Process description with SLA commitments |\n| C4 | Describe your data backup and recovery procedures | Backup frequency, encryption, tested recovery |\n| C5 | Do you process personal data in any country outside the EEA? | List of all processing locations with transfer mechanisms |\n| C6 | What is your sub-processor engagement process? | Notification mechanism, assessment requirements |\n\n**Section D — Certifications and Attestations**\n\n| # | Question | Expected Response |\n|---|----------|-------------------|\n| D1 | Do you hold ISO 27001 certification? | Certificate with scope and certification body |\n| D2 | Do you hold ISO 27701 certification? | Certificate with scope |\n| D3 | Do you hold SOC 2 Type II attestation? | Report with scope and period |\n| D4 | Do you hold any cloud-specific certifications (CSA STAR, ISO 27017\u002F27018)? | Certificate details |\n| D5 | Do you adhere to any approved GDPR Code of Conduct per Article 40? | Code of Conduct reference and adherence documentation |\n| D6 | Have you obtained any GDPR certification per Article 42? | Certification details |\n\n### Phase 3: Technical Controls Assessment\n\nBeyond questionnaire responses, Summit Cloud Partners conducts independent verification of critical controls.\n\n**Assessment Methods:**\n\n1. **Documentation Review**: Examine vendor security policies, procedures, and architectural documentation\n2. **Certification Verification**: Independently verify certification validity with issuing bodies\n3. **Technical Testing**: Where contractually permitted, conduct or review penetration test results\n4. **Reference Checks**: Contact existing clients of the vendor regarding privacy practices\n5. **Public Record Search**: Review breach notification databases, regulatory actions, and news reports\n\n**Control Verification Matrix:**\n\n| Control Domain | Questionnaire Claim | Verification Method |\n|---------------|---------------------|-------------------|\n| Encryption at rest | AES-256 | Review architecture docs, request encryption key management details |\n| Encryption in transit | TLS 1.2+ | Technical scan of vendor endpoints |\n| Access management | RBAC with MFA | Review IAM policy documentation |\n| Incident response | 24\u002F7 SOC | Review SOC 2 Type II report findings |\n| Data segregation | Logical separation | Architecture review and documentation |\n| Patch management | Monthly cycle | Review vulnerability management reports |\n\n### Phase 4: Data Flow Analysis\n\nDocument the complete data flow for the proposed processing arrangement.\n\n**Data Flow Documentation Requirements:**\n\n```\nData Flow: Summit Cloud Partners → [Vendor Name]\n\n1. Data Categories:\n   - [List each category of personal data]\n   - Classification level per category (Public\u002FInternal\u002FConfidential\u002FRestricted)\n\n2. Data Subjects:\n   - [List each category of data subject]\n   - Approximate volume per category\n\n3. Transfer Mechanism:\n   - Method: [API \u002F SFTP \u002F Direct database access \u002F etc.]\n   - Encryption: [Protocol and strength]\n   - Authentication: [Method]\n\n4. Processing Locations:\n   - Primary: [Country, City, Data Center]\n   - Backup\u002FDR: [Country, City, Data Center]\n   - Support access: [Countries where staff may access data]\n\n5. Sub-processors:\n   - [List known sub-processors with location and function]\n\n6. Data Retention:\n   - Processing retention: [Duration]\n   - Backup retention: [Duration]\n   - Post-termination: [Return\u002Fdeletion timeline]\n\n7. Return Path:\n   - Data subject requests forwarded via: [mechanism]\n   - Response SLA: [timeframe]\n```\n\n### Phase 5: Sufficiency Decision\n\nThe DPO or Privacy Team Lead reviews all collected evidence and issues a documented sufficiency decision.\n\n**Sufficiency Decision Criteria:**\n\n| Criterion | Weight | Scoring |\n|-----------|--------|---------|\n| Legal governance maturity | 15% | 1-5 scale |\n| Technical security controls | 25% | 1-5 scale |\n| Data handling practices | 20% | 1-5 scale |\n| Certifications held | 15% | 1-5 scale |\n| Breach and enforcement history | 10% | 1-5 scale (inverse) |\n| Sub-processor management | 10% | 1-5 scale |\n| Cross-border transfer safeguards | 5% | 1-5 scale |\n\n**Decision Outcomes:**\n\n- **Approved** (weighted score 4.0+): Vendor provides sufficient guarantees. Proceed to DPA negotiation.\n- **Conditionally Approved** (weighted score 3.0–3.9): Vendor requires supplementary measures or contractual safeguards before engagement. Document conditions.\n- **Rejected** (weighted score below 3.0): Vendor does not provide sufficient guarantees. Document reasons. May be reconsidered after vendor remediation.\n\n**Documentation Requirements per Article 5(2) Accountability:**\n\nThe due diligence file must contain:\n1. Completed Privacy Risk Questionnaire with vendor responses\n2. Evidence of verification activities performed\n3. Data flow analysis documentation\n4. Sufficiency scoring worksheet\n5. Written decision with rationale\n6. Approval signature from DPO or designated privacy lead\n7. Date of assessment and scheduled reassessment date\n\n## Ongoing Obligations\n\nDue diligence is not a one-time exercise. Article 28(1) imposes a continuing obligation to ensure processors maintain sufficient guarantees. Summit Cloud Partners conducts:\n\n- **Annual Reassessment**: Full questionnaire refresh for high-risk vendors, abbreviated for standard risk\n- **Trigger-Based Review**: Reassessment triggered by vendor breach, regulatory action, material service change, or certification lapse\n- **Continuous Monitoring**: Automated alerts on vendor security posture changes via risk monitoring services\n\n## Key Regulatory References\n\n- GDPR Article 28(1) — Controller obligation to use processors with sufficient guarantees\n- GDPR Article 28(3) — Required DPA provisions\n- GDPR Article 5(2) — Accountability principle\n- GDPR Article 30(2) — Processor records of processing\n- GDPR Article 35 — DPIA requirements\n- EDPB Guidelines 07\u002F2020 — Controller and processor concepts under GDPR\n- EDPB Recommendations 01\u002F2020 — Supplementary measures for international transfers\n",{"name":5,"license":15,"metadata":41,"description":7},{"tags":42,"author":9,"domain":24,"version":43,"subdomain":44},"vendor-due-diligence, art-28, processor-assessment, privacy-risk, vendor-onboarding","1.0","vendor-privacy-management","main","9b2ef9eae161c00a17241d42a388571321b33e9f","skills\u002Fprivacy\u002Fvendor-privacy-due-diligence",68,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill vendor-privacy-due-diligence",{"tool":60,"command":61},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill vendor-privacy-due-diligence",{"tool":63,"command":64},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill vendor-privacy-due-diligence","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",true,[68,74,80,84],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"assets\u002Ftemplate.md","ASSET","资产文件",6599,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002Fassets\u002Ftemplate.md",{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fstandards.md","REFERENCE","参考文档",5021,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002Freferences\u002Fstandards.md",{"path":81,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Fworkflows.md",7287,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002Freferences\u002Fworkflows.md",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fprocess.py","SCRIPT","脚本",20120,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002Fscripts\u002Fprocess.py",[91,115,131,143,157,179],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":106,"publishedAt":36},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[97,102,105],{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":103,"categoryName":104,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[107,108,24,109,31,110,111,112,113,114],"workplace email privacy","email","compliance","policy","monitoring","metadata","testing","content",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":125,"publishedAt":36},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[121,124],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[31,126,127,128,109,129,29,24,130],"whistleblower data","identity","reporting","data protection","prevention",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":36},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[137],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},[31,139,140,141,29,24,34,142],"vendor termination data","verification","extraction","planning",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":36},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[149],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},[151,33,152,32,27,153,154,24,31,155,156],"vendor risk scoring","risk scoring","transfer","certifications","methodology","risk-scoring",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":170,"publishedAt":36},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[163,166,169],{"categoryNo":164,"categoryName":165,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":167,"categoryName":168,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[171,24,172,173,142,174,140,175,109,29,32,176,177,178],"vendor privacy audit","audit","remediation","report","audit report","collection","remediation-tracking","classification",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":36},"01M6AG5ZBRVKD56CK8TECD8SRT","vendor-monitoring-program","Ongoing vendor privacy compliance monitoring program. Covers annual reassessment procedures, continuous monitoring signals, contract renewal privacy triggers, performance metrics, KPIs, and vendor governance reporting dashboards.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-monitoring-program\u002FSKILL.md",[185],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[187,111,188,189,128,109,24,190,191],"vendor monitoring program","governance","metrics","continuous-monitoring","performance"]