[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7EMAM0W6GDNP4DGDWR1YAM8":3,"skill-same:01M7EMAM0W6GDNP4DGDWR1YAM8":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":14,"repositoryHtmlUrl":59,"repositoryHomepageUrl":59,"ownerHtmlUrl":60,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":61,"install":62,"resources":75},"01M7EMAM0W6GDNP4DGDWR1YAM8","gdpr-data-protection",null,"Implement GDPR (Reg 2016\u002F679) data protection — DPIA templates, Art.30 processing records, data subject rights, legal bases, and cross-border transfers.","Mr-Nobody-Anonymous\u002FAll-skills","Mr-Nobody-Anonymous","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F184253119?v=4","01M7AEXFJHKTYQW5R0ZCQQTWFV","anonymous","01M7C00M3GQR4QKP9GZA42GFAK",0,"MIT","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fcompliance\u002Fgdpr-data-protection\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: gdpr-data-protection\ndescription: Implement GDPR (Reg 2016\u002F679) data protection — DPIA templates, Art.30 processing records, data subject rights, legal bases, and cross-border transfers.\nversion: \"1.0.0\"\nlast-updated: \"2026-04-17\"\nmodel_tested: \"claude-sonnet-4-6\"\ncategory: compliance\nplatforms: [claude-code, codex, gemini-cli, cursor, copilot, windsurf, cline]\nlanguage: en\ngeo_relevance: [eu, fr]\npriority: critical\ndependencies:\n  mcp: []\n  skills: []\n  apis: []\n  data: []\nupdate_sources:\n  - url: \"https:\u002F\u002Fedpb.europa.eu\u002Four-work-tools\"\n    check_frequency: \"quarterly\"\n    last_checked: \"2026-04-17\"\n  - url: \"https:\u002F\u002Fwww.cnil.fr\u002Ffr\u002Foutil-pia\"\n    check_frequency: \"quarterly\"\n    last_checked: \"2026-04-17\"\nsource: \"https:\u002F\u002Fgithub.com\u002FBuilderCed\u002Fagent-skills\"\nsource_repository: \"BuilderCed\u002Fagent-skills\"\nsource_path: \"skills\u002Fcompliance\u002Fgdpr-data-protection\u002FSKILL.md\"\nlicense: \"MIT\"\nimported_at: \"2026-09-20\"\n---\n\n# GDPR Data Protection\n\n> **DISCLAIMER**: This skill provides guidance only. It does not constitute legal advice. Always verify with a Data Protection Officer or legal professional.\n\n## When to Use\n\n- Designing systems that process personal data\n- Conducting a Data Protection Impact Assessment (DPIA)\n- Creating Article 30 processing records\n- Implementing data subject rights (access, deletion, portability)\n- Evaluating legal bases for data processing\n- Planning cross-border data transfers\n\n## Step 1: Identify Legal Basis (Article 6)\n\nEvery processing activity needs exactly one legal basis:\n\n| Legal Basis | When to Use | Example |\n|-------------|-------------|---------|\n| **Consent** (6.1.a) | User actively opts in, can withdraw anytime | Newsletter signup |\n| **Contract** (6.1.b) | Processing necessary to fulfill a contract | Delivering purchased goods |\n| **Legal obligation** (6.1.c) | Required by law | Tax record retention |\n| **Vital interests** (6.1.d) | Protecting someone's life | Emergency medical data |\n| **Public interest** (6.1.e) | Official authority or public task | Government services |\n| **Legitimate interest** (6.1.f) | Balanced against data subject's rights | Fraud prevention, security |\n\n**Consent requirements**: freely given, specific, informed, unambiguous, easy to withdraw.\n\n## Step 2: Data Minimization Checklist\n\nBefore collecting any personal data:\n1. Is this data **necessary** for the stated purpose?\n2. Can the purpose be achieved with **less** data?\n3. Can the data be **anonymized** or **pseudonymized**?\n4. Is the **retention period** defined and minimal?\n5. Are **access controls** in place (who can see what)?\n\n## Step 3: Article 30 Processing Record\n\nEvery controller must maintain a record of processing activities:\n\n```\nProcessing Activity: [Name]\nController: [Organization name, contact]\nDPO Contact: [If applicable]\nPurpose: [Specific, explicit purpose]\nLegal Basis: [From Step 1]\nData Categories: [e.g., name, email, IP address]\nData Subjects: [e.g., customers, employees]\nRecipients: [Who receives the data, including processors]\nThird Country Transfers: [If any, with safeguard mechanism]\nRetention Period: [Specific duration or criteria]\nSecurity Measures: [Encryption, access control, etc.]\n```\n\n## Step 4: Data Subject Rights\n\nRespond within **1 month** (extendable to 3 months for complex requests):\n\n| Right | Article | What to Implement |\n|-------|---------|-------------------|\n| **Access** | 15 | Provide copy of all personal data held |\n| **Rectification** | 16 | Correct inaccurate data |\n| **Erasure** (\"right to be forgotten\") | 17 | Delete data when no longer needed |\n| **Restriction** | 18 | Limit processing while disputes are resolved |\n| **Portability** | 20 | Export data in machine-readable format |\n| **Object** | 21 | Stop processing based on legitimate interest |\n| **Automated decisions** | 22 | Human review of automated decisions with legal effects |\n\n## Step 5: DPIA (Data Protection Impact Assessment)\n\nRequired when processing is \"likely to result in a high risk\":\n- Large-scale processing of special categories (health, biometrics)\n- Systematic monitoring of public areas\n- Automated decision-making with legal effects\n- New technologies with unknown risks\n\n### DPIA Structure (CNIL template)\n1. **Description**: Processing, purposes, data flows, retention\n2. **Necessity and proportionality**: Legal basis, minimization, rights\n3. **Risk assessment**: Likelihood x severity for confidentiality, integrity, availability\n4. **Measures**: Technical and organizational measures to mitigate risks\n\n## Step 6: Cross-Border Transfers\n\nPersonal data leaving the EEA requires a transfer mechanism:\n\n| Mechanism | When |\n|-----------|------|\n| Adequacy decision | Country deemed adequate by EC (e.g., UK, Japan, South Korea) |\n| Standard Contractual Clauses (SCCs) | Contract-based, most common |\n| Binding Corporate Rules | Intra-group transfers |\n| Derogations (Art. 49) | Explicit consent, contract necessity (limited use) |\n\n**Post-Schrems II**: SCCs must include a Transfer Impact Assessment (TIA) evaluating whether the recipient country's laws undermine the protections.\n\n## Penalties\n\n| Violation Type | Max Fine |\n|---------------|----------|\n| Administrative (Art. 83.4) | EUR 10M or 2% of global turnover |\n| Core principles, rights, transfers (Art. 83.5) | EUR 20M or 4% of global turnover |\n\n## France-Specific (CNIL)\n\n- Cookie consent: prior opt-in required (no cookie walls)\n- Child consent: 15 years (not 16 as in GDPR default)\n- DPIA tool: cnil.fr\u002Ffr\u002Foutil-pia (free, open source)\n- DPO designation mandatory for: public bodies, large-scale systematic monitoring, large-scale special categories\n\n## What This Skill Does NOT Do\n\n- Does not implement consent management UI\n- Does not configure cookie banners\n- Does not perform the DPIA risk assessment (guides structure)\n- Does not replace a DPO or legal counsel\n","# GDPR Data Protection\n\n> **DISCLAIMER**: This skill provides guidance only. It does not constitute legal advice. Always verify with a Data Protection Officer or legal professional.\n\n## When to Use\n\n- Designing systems that process personal data\n- Conducting a Data Protection Impact Assessment (DPIA)\n- Creating Article 30 processing records\n- Implementing data subject rights (access, deletion, portability)\n- Evaluating legal bases for data processing\n- Planning cross-border data transfers\n\n## Step 1: Identify Legal Basis (Article 6)\n\nEvery processing activity needs exactly one legal basis:\n\n| Legal Basis | When to Use | Example |\n|-------------|-------------|---------|\n| **Consent** (6.1.a) | User actively opts in, can withdraw anytime | Newsletter signup |\n| **Contract** (6.1.b) | Processing necessary to fulfill a contract | Delivering purchased goods |\n| **Legal obligation** (6.1.c) | Required by law | Tax record retention |\n| **Vital interests** (6.1.d) | Protecting someone's life | Emergency medical data |\n| **Public interest** (6.1.e) | Official authority or public task | Government services |\n| **Legitimate interest** (6.1.f) | Balanced against data subject's rights | Fraud prevention, security |\n\n**Consent requirements**: freely given, specific, informed, unambiguous, easy to withdraw.\n\n## Step 2: Data Minimization Checklist\n\nBefore collecting any personal data:\n1. Is this data **necessary** for the stated purpose?\n2. Can the purpose be achieved with **less** data?\n3. Can the data be **anonymized** or **pseudonymized**?\n4. Is the **retention period** defined and minimal?\n5. Are **access controls** in place (who can see what)?\n\n## Step 3: Article 30 Processing Record\n\nEvery controller must maintain a record of processing activities:\n\n```\nProcessing Activity: [Name]\nController: [Organization name, contact]\nDPO Contact: [If applicable]\nPurpose: [Specific, explicit purpose]\nLegal Basis: [From Step 1]\nData Categories: [e.g., name, email, IP address]\nData Subjects: [e.g., customers, employees]\nRecipients: [Who receives the data, including processors]\nThird Country Transfers: [If any, with safeguard mechanism]\nRetention Period: [Specific duration or criteria]\nSecurity Measures: [Encryption, access control, etc.]\n```\n\n## Step 4: Data Subject Rights\n\nRespond within **1 month** (extendable to 3 months for complex requests):\n\n| Right | Article | What to Implement |\n|-------|---------|-------------------|\n| **Access** | 15 | Provide copy of all personal data held |\n| **Rectification** | 16 | Correct inaccurate data |\n| **Erasure** (\"right to be forgotten\") | 17 | Delete data when no longer needed |\n| **Restriction** | 18 | Limit processing while disputes are resolved |\n| **Portability** | 20 | Export data in machine-readable format |\n| **Object** | 21 | Stop processing based on legitimate interest |\n| **Automated decisions** | 22 | Human review of automated decisions with legal effects |\n\n## Step 5: DPIA (Data Protection Impact Assessment)\n\nRequired when processing is \"likely to result in a high risk\":\n- Large-scale processing of special categories (health, biometrics)\n- Systematic monitoring of public areas\n- Automated decision-making with legal effects\n- New technologies with unknown risks\n\n### DPIA Structure (CNIL template)\n1. **Description**: Processing, purposes, data flows, retention\n2. **Necessity and proportionality**: Legal basis, minimization, rights\n3. **Risk assessment**: Likelihood x severity for confidentiality, integrity, availability\n4. **Measures**: Technical and organizational measures to mitigate risks\n\n## Step 6: Cross-Border Transfers\n\nPersonal data leaving the EEA requires a transfer mechanism:\n\n| Mechanism | When |\n|-----------|------|\n| Adequacy decision | Country deemed adequate by EC (e.g., UK, Japan, South Korea) |\n| Standard Contractual Clauses (SCCs) | Contract-based, most common |\n| Binding Corporate Rules | Intra-group transfers |\n| Derogations (Art. 49) | Explicit consent, contract necessity (limited use) |\n\n**Post-Schrems II**: SCCs must include a Transfer Impact Assessment (TIA) evaluating whether the recipient country's laws undermine the protections.\n\n## Penalties\n\n| Violation Type | Max Fine |\n|---------------|----------|\n| Administrative (Art. 83.4) | EUR 10M or 2% of global turnover |\n| Core principles, rights, transfers (Art. 83.5) | EUR 20M or 4% of global turnover |\n\n## France-Specific (CNIL)\n\n- Cookie consent: prior opt-in required (no cookie walls)\n- Child consent: 15 years (not 16 as in GDPR default)\n- DPIA tool: cnil.fr\u002Ffr\u002Foutil-pia (free, open source)\n- DPO designation mandatory for: public bodies, large-scale systematic monitoring, large-scale special categories\n\n## What This Skill Does NOT Do\n\n- Does not implement consent management UI\n- Does not configure cookie banners\n- Does not perform the DPIA risk assessment (guides structure)\n- Does not replace a DPO or legal counsel\n",{"name":5,"source":24,"license":15,"version":25,"category":26,"language":27,"priority":28,"platforms":29,"description":7,"imported_at":37,"source_path":38,"dependencies":39,"last-updated":44,"model_tested":45,"geo_relevance":46,"update_sources":49,"source_repository":55},"https:\u002F\u002Fgithub.com\u002FBuilderCed\u002Fagent-skills","1.0.0","compliance","en","critical",[30,31,32,33,34,35,36],"claude-code","codex","gemini-cli","cursor","copilot","windsurf","cline","2026-09-20","skills\u002Fcompliance\u002Fgdpr-data-protection\u002FSKILL.md",{"mcp":40,"apis":41,"data":42,"skills":43},[],[],[],[],"2026-04-17","claude-sonnet-4-6",[47,48],"eu","fr",[50,53],{"url":51,"last_checked":44,"check_frequency":52},"https:\u002F\u002Fedpb.europa.eu\u002Four-work-tools","quarterly",{"url":54,"last_checked":44,"check_frequency":52},"https:\u002F\u002Fwww.cnil.fr\u002Ffr\u002Foutil-pia","BuilderCed\u002Fagent-skills","main","2d1750717747097b602acf30bd09a7cbd4b4c6ea","awesome_skills\u002Fcompliance\u002Fgdpr-data-protection","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous","2026-11-09 11:45:36",{"source":8,"skillName":5,"commands":63,"prompt":73,"zipAvailable":74},[64,67,70],{"tool":65,"command":66},"npx","npx skills add Mr-Nobody-Anonymous\u002FAll-skills --skill gdpr-data-protection",{"tool":68,"command":69},"bunx","bunx skills add Mr-Nobody-Anonymous\u002FAll-skills --skill gdpr-data-protection",{"tool":71,"command":72},"pnpm","pnpm dlx skills add Mr-Nobody-Anonymous\u002FAll-skills --skill gdpr-data-protection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fcompliance\u002Fgdpr-data-protection\u002FSKILL.md",true,[],[77,85,92,99,106,113],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":84},"01M7EXRQF9GFM7D9BG6N5HAT34","oath","Auditing regulatory compliance (SOC2\u002FPCI-DSS\u002FHIPAA\u002FISO 27001): maps requirements, checks controls, designs audit trails, implements Policy as Code. Use when compliance auditing is needed.","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Foath\u002FSKILL.md",[],[],"2026-11-15 14:25:24",{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":19},"01M7EXRH7TYTNZJT0BQXEWAMW7","nexus","Orchestrating multi-specialist task chains and scope-adaptive product delivery: classifies intent, selects and executes the minimum viable chain, aggregates results, and verifies acceptance criteria. For multi-domain tasks, build-first delivery, and product lifecycle execution.","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Fnexus\u002FSKILL.md",[],[],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":19},"01M7EXRCDPFWVEEEFR2ZQGJCYY","nest","Designing LLM-optimized folder structures: audits and restructures directories for context efficiency, progressive disclosure, and prompt cache performance. Not for general repo structure (Grove).","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Fnest\u002FSKILL.md",[],[],{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":19},"01M7EXR7JEER60TH0HD0AH4EE9","native","Implementing production iOS\u002FAndroid\u002FmacOS native features (SwiftUI, Compose) and iterating a screen against a reference design. Not for cross-platform RN\u002FFlutter (Port) or web (Artisan).","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Fnative\u002FSKILL.md",[],[],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":19},"01M7EXR133J7DD5961R80QTRZY","muse","Defining and managing design tokens, applying token systems to existing codebases, building design system foundations. Use for spacing, color, typography, dark mode, cross-platform output.","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Fmuse\u002FSKILL.md",[],[],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":19},"01M7EXQWWX7ECQN0J50B41YN5N","morph","Converting document formats (Markdown\u002FWord\u002FExcel\u002FPDF\u002FHTML) and generating reusable conversion scripts. Use for distributable specs, accessibility-compliant PDFs, or Pandoc\u002FLibreOffice pipelines.","https:\u002F\u002Fgithub.com\u002FMr-Nobody-Anonymous\u002FAll-skills\u002Fblob\u002Fmain\u002Fawesome_skills\u002Fdevsecops\u002Fmorph\u002FSKILL.md",[],[]]