conducting-gdpr-compliance-assessment

Files (9)

• LICENSE
• SKILL.md
• compliance-scorecard.md · assets/
• api-reference.md · references/
• detailed-workflow.md · references/
• standards.md · references/
• article30_parser.py · scripts/
• article30_validator.py · scripts/
• generate_ropa_report.py · scripts/

SKILL.md (first lines)

# Conducting GDPR Compliance Assessment

> **Effective Date**: August 2026  
> **Legal Basis**: EU Regulation 2016/679 (GDPR), UK GDPR as amended by Data Protection Act 2018 and Data (Use and Access) Act 2025 (ukpga/2025/18)  
> **Pending Changes**: Digital Omnibus proposal (COM(2025) 837) would change Article 30(5) threshold from 250 to 750 employees and Article 33 breach notification from 72h to 96h. Still in proposal stage; current requirements remain in force.

## When to Use

- When an organization **processes personal data of EU residents** (Article 3 territorial scope applies)
- When preparing for a **supervisory authority audit** (ICO, CNIL, BfDI) or responding to formal inquiry
- When implementing **privacy-by-design** requirements (Article 25) for new systems or data flows
- When **scoping compliance gaps** before M&A due diligence or contract negotiations with EU entities
- When responding to **data subject access requests (DSARs)** and discovering gaps in data inventory
- When assessing **third-party processors** for GDPR compliance before signing Data Processing Agreements (DPAs)
- After **data breach incidents** to verify notification procedures meet 72-hour requirement (Article 33)

**Do not use** for:
- **Technical implementation** of specific GDPR controls (encryption, pseudonymization, access controls) — use **implementing-gdpr-data-protection-controls** for Article 32 technical/organizational measures
- **Automated DSAR processing workflows** (identity verification, PII discovery, redaction, delivery) — use **implementing-gdpr-data-subject-access-request** for DSAR automation
- Non-EU privacy frameworks alone (CCPA, PIPEDA, LGPD); those require separate assessments with jurisdiction-specific criteria
- This skill is for **comprehensive compliance assessment** across all GDPR articles; use the specialized skills for focused implementation tasks

## Prerequisites

- Understanding of GDPR Articles 5-32 and key definitions
- Access to Article 30 records of processing activities
- Data Processing Agreements with third-party processors
- Privacy policies, consent forms, cookie notices
- Knowledge of lawful bases (Article 6)
- Data breach response plan and incident register
- List of international data transfers with safeguards

## Workflow

**For detailed procedures, templates, and examples, see `references/detailed-workflow.md`**

### Phase 1: Determine Territorial Applicability (Article 3)

GDPR applies if:
1. Organization has establishment in EU
2. Offers goods/services to EU residents
3. Monitors behavior of EU residents

**Check**: EU office? EU website targeting? Behavioral tracking?

### Phase 2: Inventory Data Processing Activities (Article 30)

Document for EACH activity:
- Controller/processor details
- Processing purposes (specific)
- Data categories and special categories (Art. 9)
- Recipients and international transfers
- Retention periods
- Security measures

**Tools**: Use `scripts/article30_parser.py`, `article30_validator.py`, `generate_ropa_report.py`

**Common gaps**: Missing retention periods (68%), vague purposes, undocumented transfers

### Phase 3: Validate Lawful Basis (Article 6)

| Basis | Use Case | Key Requirement |
|-------|----------|-----------------|
| **Consent** (6(1)(a)) | Marketing, profiling | Freely given, specific, withdrawable |
| **Contract** (6(1)(b)) | Order fulfillment | Strictly necessary only |
| **Legal Obligation** (6(1)(c)) | Tax records | Cite specific law |
| **Legitimate Interest** (6(1)(f)) | Fraud prevention, analytics | Three-part test + balancing |

**Action**: Map each Article 30 activity to one lawful basis. Document legitimate interest assessments.

### Phase 4: Assess Data Subject Rights (Articles 12-23)

Verify capability for:
- **Access** (15): Provide copy in machine-readable format within 1 month
- **Rectification** (16): Correct inaccurate data
- **Erasure** (17): "Right to be forgotten" (with exceptions)
- **Portability** (20): Transfer data in structured format
- **Objection** (21): Opt-out of legitimate interest processing
- **Automated Decision-Making** (22): Human review of algorithmic decisions

**Test**: Process sample DSAR through full workflow. Use `scripts/` for automation.

### Phase 5: Review DPIAs (Article 35)

DPIA **mandatory** for:
- Large-scale profiling with automated decisions
- Large-scale special categories processing
- Systematic monitoring of public areas (facial recognition)

**Template**: See `references/detailed-workflow.md` for complete DPIA structure

**Content**: Description, necessity, risks, mitigation, consultation (DPO, supervisory authority if novel high-risk)

### Phase 6: Audit Breach Notification (Articles 33-34)

**72-hour rule**: Notify supervisory authority within 72 hours of becoming aware of breach likely to risk rights.

**Decision tree**:
- Unencrypted SSNs stolen? → NOTIFY + notify data subjects
- Encrypted backup stolen (key secure)? → Document only
- Temporary exposure (2 hours, no financial data)? → NOTIFY authority, assess data subject notification

**Content**: Nature, categories/numbers, DPO contact, consequences, mitigation

### Phase 7: Verify International Transfers (Chapter V)

**Mechanisms**:
- Adequacy decisions (UK, Japan, etc.)
- Standard Contractual Clauses (SCCs) 2021 + Transfer Impact Assessment
- Binding Corporate Rules (BCRs)
- Derogations (Article 49 - limited)

**Post-Schrems II**: Assess destination country surveillance laws, implement supplementary measures (encryption with EU-held keys)

### Phase 8: Assess Security Measures (Article 32)

"Security appropriate to the risk":
- **Low risk**: TLS 1.2+, password hashing, access logs, patching
- **Medium risk**: AES-256 encryption, MFA, RBAC, penetration testing, SOC 2
- **High risk**: HSMs, key rotation, SIEM, bug bounty, ISO 27001

From mukul975/Anthropic-Cybersecurity-Skills, Apache-2.0.

More from mukul975/Anthropic-Cybersecurity-Skills