# Build GDPR Data Handling Controls

GDPR implementation requires coordinated consent, data rights, retention, and breach controls. This skill provides practical patterns and checklists for planning and reviewing those controls.

## Install

```bash
npx skillstore add sickn33/gdpr-data-handling
```

## Metadata

- Status: approved
- Slug: sickn33-gdpr-data-handling
- Skillstore revision: r2
- Version status: missing
- Tree hash: 6a61b01a5753de45460ae4b3a558359044d9ce1f3b93c9ba32e74e56583d1a85
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/gdpr-data-handling
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, external\_commands
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/sickn33-gdpr-data-handling
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-gdpr-data-handling/manifest

## Capabilities

- Explains GDPR personal data categories, lawful bases, and data subject rights.
- Provides consent recording and preference interface examples.
- Outlines access, erasure, portability, and retention workflows.
- Shows privacy by design and data minimization patterns.
- Supplies breach response logic and a GDPR implementation checklist.

## Use Cases

- Implement Consent Controls: Design consent records, preference controls, withdrawal history, and downstream change events for a web application.
- Plan Data Subject Requests: Map access, erasure, portability, verification, deadlines, and data source coordination into an operational workflow.
- Review Breach Readiness: Assess notification triggers, reporting content, timelines, and compliance checklist gaps before an incident occurs.

## Prompt Templates

### Explain GDPR Basics

```
Explain which GDPR principles apply to [processing activity]. Identify personal data, likely lawful bases, and important questions for legal review.
```

### Design Consent Management

```
Design a consent flow for [product]. Include separate purposes, clear choices, withdrawal, policy versioning, audit history, and accessibility considerations.
```

### Create a DSAR Workflow

```
Create an authenticated DSAR workflow for [system]. Cover intake, identity verification, authorization, discovery, exceptions, deadlines, approval, delivery, and audit evidence.
```

### Review a GDPR Architecture

```
Review [architecture description] for GDPR risks. Evaluate minimization, purpose limitation, retention, security, processor relationships, transfers, rights handling, and breach readiness.
```

## Limitations

- Provides general technical guidance, not legal advice.
- Examples require authentication, authorization, encryption, testing, and integration before production use.
- Does not assess jurisdiction-specific laws or organization-specific processing activities.
- Does not connect to databases, identity systems, regulators, or notification services.

## Best Practices

- Verify identity and authorization before accessing, exporting, correcting, or deleting personal data.
- Document each processing purpose, lawful basis, retention rule, recipient, and control owner.
- Treat sample code as a design reference and complete security, testing, and legal review before deployment.

## Anti Patterns

- Do not use preselected consent or combine unrelated purposes into one choice.
- Do not expose DSAR data through identifiers alone or trust caller-provided verification flags.
- Do not retain personal data indefinitely or claim anonymization without validating reidentification risk.

## Security Audit

- Audited at: 2026-07-23T23:21:27.089\+00:00
- Summary: All 22 static findings are false positives caused by method names, generic database calls, dictionary keys, checklist text, and Markdown formatting. The documentation contains no executable shell or network behavior and no prompt injection. However, the DSAR sample omits server-side verification and authorization checks before personal data access or deletion.

## Stats

- Views: 111
- Downloads: 13
- Favorites: 0
- Popularity score: 0