Skills gdpr-data-handling

📦

gdpr-data-handling

Name: gdpr-data-handling
Author: sickn33

Content revision r2 High Risk 🌐 Network access⚙️ External commands

Build GDPR Data Handling Controls

GDPR implementation requires coordinated consent, data rights, retention, and breach controls. This skill provides practical patterns and checklists for planning and reviewing those controls.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "gdpr-data-handling" from https://skillstore.io/skills/sickn33-gdpr-data-handling.md and its manifest at https://skillstore.io/api/skills/sickn33-gdpr-data-handling/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-gdpr-data-handling.md Signed manifest GET /api/skills/sickn33-gdpr-data-handling/manifest Signed lockfile GET /api/skills/sickn33-gdpr-data-handling/lockfile

Test it

Using "gdpr-data-handling". Review our analytics consent process for GDPR readiness.

Expected outcome:

Finding: Analytics remains disabled until the user makes a clear choice.
Gap: Withdrawal does not propagate to downstream analytics tools.
Action: Add consent versioning, propagation monitoring, and an auditable withdrawal record.

Using "gdpr-data-handling". Plan a customer data access request workflow.

Expected outcome:

Intake: Record the request and calculate the response deadline.
Verification: Confirm identity before searching or disclosing personal data.
Delivery: Use an authenticated channel and retain evidence of approval and completion.

Using "gdpr-data-handling". Assess our breach notification process.

Expected outcome:

Trigger: Evaluate risk to individual rights and freedoms.
Timeline: Escalate immediately and track the 72-hour supervisory authority deadline.
Evidence: Document facts, impact, decisions, notifications, and remediation.

Security Audit

High Risk

v5 • 7/23/2026 Open versioned report

All 22 static findings are false positives caused by method names, generic database calls, dictionary keys, checklist text, and Markdown formatting. The documentation contains no executable shell or network behavior and no prompt injection. However, the DSAR sample omits server-side verification and authorization checks before personal data access or deletion.

Files scanned

658

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

resources/implementation-playbook.md:199-212 resources/implementation-playbook.md:227-239 resources/implementation-playbook.md:259-275

DSAR Authorization Controls Are Missing

The examples accept verification state from a caller, then process access and erasure requests by identifier without enforcing verified status or authenticated ownership.

The sample records verification status but neither processing method checks it before reading or deleting data. No authorization guard appears in the documented flow.

Risk Factors

🌐 Network access (11)

resources/implementation-playbook.md:199 resources/implementation-playbook.md:227 resources/implementation-playbook.md:229 resources/implementation-playbook.md:255 resources/implementation-playbook.md:259 resources/implementation-playbook.md:261 resources/implementation-playbook.md:293 resources/implementation-playbook.md:297 resources/implementation-playbook.md:299 resources/implementation-playbook.md:300 resources/implementation-playbook.md:222

⚙️ External commands (2)

SKILL.md:32 SKILL.md:36

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-gdpr-data-handling/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-gdpr-data-handling/security.svg)](https://skillstore.io/skills/sickn33-gdpr-data-handling?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-gdpr-data-handling?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-gdpr-data-handling/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-gdpr-data-handling.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). gdpr-data-handling security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-gdpr-data-handling/audits/5

BibTeX citation

@techreport{sickn33-sickn33-gdpr-data-handling-2026,
  author = {sickn33},
  title = {gdpr-data-handling security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-gdpr-data-handling/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gdpr-data-handling security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-gdpr-data-handling/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-gdpr-data-handling:audit:5"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

wshobson Recommended

wshobson-gdpr-data-handling

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 20

Updated

2026-08-21

sickn33 Current

sickn33-gdpr-data-handling

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 13

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Implement Consent Controls

Design consent records, preference controls, withdrawal history, and downstream change events for a web application.

Plan Data Subject Requests

Map access, erasure, portability, verification, deadlines, and data source coordination into an operational workflow.

Review Breach Readiness

Assess notification triggers, reporting content, timelines, and compliance checklist gaps before an incident occurs.

Try These Prompts

Explain GDPR Basics

Explain which GDPR principles apply to [processing activity]. Identify personal data, likely lawful bases, and important questions for legal review.

Design Consent Management

Design a consent flow for [product]. Include separate purposes, clear choices, withdrawal, policy versioning, audit history, and accessibility considerations.

Create a DSAR Workflow

Create an authenticated DSAR workflow for [system]. Cover intake, identity verification, authorization, discovery, exceptions, deadlines, approval, delivery, and audit evidence.

Review a GDPR Architecture

Review [architecture description] for GDPR risks. Evaluate minimization, purpose limitation, retention, security, processor relationships, transfers, rights handling, and breach readiness.

Best Practices

Verify identity and authorization before accessing, exporting, correcting, or deleting personal data.
Document each processing purpose, lawful basis, retention rule, recipient, and control owner.
Treat sample code as a design reference and complete security, testing, and legal review before deployment.

Avoid

Do not use preselected consent or combine unrelated purposes into one choice.
Do not expose DSAR data through identifiers alone or trust caller-provided verification flags.
Do not retain personal data indefinitely or claim anonymization without validating reidentification risk.

Frequently Asked Questions

Does this skill provide legal advice?

No. It provides technical guidance and should be reviewed by qualified privacy or legal professionals.

Can I use the examples in production?

Use them as design references. Add authentication, authorization, encryption, error handling, testing, monitoring, and environment-specific integrations.

Does the skill process data subject requests automatically?

No. It outlines workflows and examples but does not connect to identity, database, approval, or delivery systems.

Which technologies do the examples use?

The playbook includes JavaScript, HTML, and Python examples with abstract database and service interfaces.

Does it cover international data transfers?

It mentions transfer safeguards in the checklist but does not perform transfer impact assessments or select legal mechanisms.

How should deadlines and legal bases be validated?

Confirm them against current law, regulator guidance, processing context, and advice from qualified privacy professionals.