# Data Protection & Privacy — jurisdiction-neutral

Personal-data processing, privacy compliance, breach response, and data-transfer terms.

Jurisdiction: `general` · Practice: `data-protection` · Skill language: en

## Skills (119)

| Skill | What it does |
|---|---|
| [`Data Subject Rights for AI Systems`](skills/ai-data-subject-rights/) | Implements data subject rights mechanisms for AI systems including right to explanation of AI decisions, conte… |
| [`Lawful Basis for AI Training Data`](skills/ai-training-lawfulness/) | Assesses lawful basis for AI training data processing per EDPB April 2025 report on LLMs and general-purpose A… |
| [`Managing Consent for Analytics Cookies`](skills/analytics-cookie-consent/) | Managing consent for analytics cookies and implementing privacy-preserving measurement. Covers GA4 privacy con… |
| [`Applying Privacy Design Patterns`](skills/applying-privacy-design-patterns/) | Systematic application of the eight privacy design patterns per Hoepman: minimize, hide, separate, abstract, i… |
| [`GDPR Compliance Assessment`](skills/assess-gdpr/) | Conduct a GDPR compliance assessment for a system or processing activity. |
| [`Audit Compliance`](skills/audit-compliance/) | Check that your legal compliance is still in good shape. Pick what to check: your privacy policy, your privacy… |
| [`Managing Automated Decision-Making and Profiling Rights`](skills/automated-decision-rights/) | Manages GDPR Article 22 rights related to solely automated decision-making and profiling, including identifica… |
| [`Backup Retention and Erasure Management`](skills/backup-retention-erasure/) | Manages backup and archive data under retention schedules and erasure obligations. Covers the technical infeas… |
| [`Establishing Binding Corporate Rules`](skills/bcr-establishment/) | Guides development and approval of Binding Corporate Rules under GDPR Article 47 for intra-group international… |
| [`Assessing Biometric Processing Privacy`](skills/biometric-dpia/) | Guides DPIA for biometric processing systems including facial recognition, fingerprint, voice, iris, and gait… |
| [`BosskuAI Legal / Compliance`](skills/bosskuai-legal-compliance/) | Use this for product-facing legal and compliance readiness such as privacy posture, consent, retention, vendor… |
| [`Managing Breach Credit Monitoring`](skills/breach-credit-monitor/) | Coordinates credit monitoring and identity theft protection services for individuals affected by a data breach… |
| [`Maintaining Breach Documentation Records`](skills/breach-documentation/) | Maintains the GDPR Article 33(5) breach register documenting all personal data breaches regardless of whether… |
| [`Designing Breach Simulation Exercise`](skills/breach-simulation/) | Designs and executes tabletop breach simulation exercises for testing organizational breach response capabilit… |
| [`Managing Data Subject Breach Communication`](skills/breach-subject-comms/) | Manages direct communication to affected data subjects following a personal data breach under GDPR Article 34… |
| [`Universal Escalation Triggers (Apply to All Categories) (+2)`](skills/canned-responses-escalation-triggers-all-categories/) | Sub-skill of canned-responses: Universal Escalation Triggers (Apply to All Categories) (+2). |
| [`cite-check — Copilot CLI Skill`](skills/cite-check/) | Verifiable legal-citation tooling for product counsel reviews. Two modes: (1) ORIGINATE — turn a PPL issue int… |
| [`Cloud Service Provider Privacy Assessment`](skills/cloud-provider-assessment/) | Cloud service provider privacy assessment framework. Covers ISO 27018 cloud privacy controls, CSA STAR certifi… |
| [`/cold-start-interview`](skills/cold-start-interview-10/) | Run the cold-start interview — learns your privacy practice and writes CLAUDE.md from your policy, DPA templat… |
| [`Compliance Checklist Skill`](skills/compliance-checklist/) | Generate a prioritised compliance checklist for GDPR, SOC 2, ISO 27001, FCA, HIPAA, or other frameworks with a… |
| [`Compliance Checklist Generation`](skills/compliance-checklist-generation/) | Generate compliance checklists for SOC2, HIPAA, PCI-DSS, and GDPR with gap analysis and remediation priorities… |
| [`compliance-evidence`](skills/compliance-evidence-cembasaranoglu/) | Use when the user needs compliance and privacy evidence. |
| [`Compliance Policy Auditor`](skills/compliance-policy-auditor/) | Audit corporate policies or data-handling descriptions against regulatory frameworks (GDPR, SOC2, HIPAA). Use… |
| [`Purpose`](skills/compliance-review/) | Compliance review for auditability, GDPR/PII, retention, financial controls, consent, and regulatory traceabil… |
| [`Managing Consent for Transfers`](skills/consent-for-transfers/) | Guide for obtaining explicit consent for international data transfers under GDPR Article 49(1)(a). Covers info… |
| [`Implementing Consent Withdrawal`](skills/consent-withdrawal/) | Implementation guide for GDPR Article 7(3) consent withdrawal mechanisms. Covers the equal ease requirement en… |
| [`Controller RoPA Creation`](skills/controller-ropa-creation/) | Creates GDPR Article 30(1) Records of Processing Activities (RoPA) for data controllers with all seven mandato… |
| [`Pages: Cookie Policy`](skills/cookie-policy-page-generator/) | When the user wants to create or optimize a cookie policy page. Also use when the user mentions "cookie policy… |
| [`Criminal Conviction and Offence Data Handling — GDPR Art. 10`](skills/criminal-data-handling/) | Handles GDPR Art. 10 criminal conviction and offence data classification including official authority requirem… |
| [`/customize`](skills/customize-11/) | Guided customization of your privacy practice profile — change one thing without re-running the whole cold-sta… |
| [`Data Inventory and Mapping for Classification`](skills/data-inventory-mapping/) | Builds comprehensive data inventory per GDPR Art. 30 Records of Processing Activities. Covers system-by-system… |
| [`Executing Data Portability Requests`](skills/data-portability/) | Executes GDPR Article 20 data portability requests, covering machine-readable format requirements (JSON, CSV,… |
| [`Critical rules`](skills/data-privacy/) | Ensure data privacy compliance covering GDPR obligations, user consent management, data retention policies, PI… |
| [`GDPR Data Processing Addendum (DPA)`](skills/data-processing-addendum/) | Drafts a GDPR Article 28-compliant Data Processing Addendum (DPA) between data controllers and processors. Ext… |
| [`Approach`](skills/data-protection/) | GDPR compliance analysis covering lawful basis assessment, privacy notices, processor agreements, and breach r… |
| [`Providing Direct Collection Information`](skills/direct-collection-notice/) | Provides GDPR Article 13 information at the point of direct data collection, covering all required elements un… |
| [`Supervisory Authority Inspection Preparation`](skills/dpa-inspection-prep/) | Guides preparation for supervisory authority (DPA) inspections and investigations including document readiness… |
| [`$privacy-legal:dpa-review`](skills/dpa-review/) | Review a Data Processing Agreement against your DPA playbook — auto-detects whether you're processor or contro… |
| [`/dpa-review`](skills/dpa-review-anthropics/) | Review a Data Processing Agreement against your DPA playbook — auto-detects whether you're processor or contro… |
| [`DPA Review`](skills/dpa-review-stubbi/) | Review a Data Processing Agreement against your DPA playbook — auto-detects whether you're processor or contro… |
| [`/dpa-review`](skills/dpa-review-zhou210712/) | 依据你的数据处理协议（DPA）操作手册审查一份DPA——自动检测你是受托处理者 还是处理者，并应用操作手册正确的半部分。当用户说"审查这份DPA""检查这份 数据处理附录""客户发来了他们的DPA""这份DPA可以吗"，… |
| [`DPIA Risk Scoring Methodology`](skills/dpia-risk-scoring/) | Provides a structured risk scoring methodology for Data Protection Impact Assessments aligned with ENISA threa… |
| [`Draft Cybersecurity Website Terms and Cookie Policies`](skills/draft-cybersecurity-website-terms-and-cookie-policies/) | Generates Terms of Use and Cookie Policy documents for a cybersecurity company website, strictly limiting data… |
| [`Processing Data Subject Access Requests`](skills/dsar-processing/) | Guides AI agents through the complete GDPR Data Subject Access Request (DSAR) workflow under Article 15, inclu… |
| [`$privacy-legal:dsar-response`](skills/dsar-response/) | Walk through a Data Subject Access Request (or deletion, portability, correction request) and draft the respon… |
| [`/dsar-response`](skills/dsar-response-anthropics/) | Walk through a Data Subject Access Request (or deletion, portability, correction request) and draft the respon… |
| [`DSAR Response`](skills/dsar-response-stubbi/) | Walk through a Data Subject Access Request (or deletion, portability, correction request) and draft the respon… |
| [`Employee DSAR Response`](skills/employee-dsar-response/) | Manages Data Subject Access Request procedures for employee requests under Art. 15 GDPR. Covers scope of discl… |
| [`Employee Monitoring DPIA`](skills/employee-monitoring-dpia/) | Conducts Data Protection Impact Assessments for employee monitoring systems per EDPB Guidelines 3/2019 on work… |
| [`Employment Consent Limits`](skills/employment-consent-limits/) | Analyses the limitations on consent as a lawful basis for processing employee data under Art. 88 GDPR and WP29… |
| [`ePrivacy Directive Article 5(3) Essential Cookie Exemption`](skills/eprivacy-essential-cookies/) | Applying the ePrivacy Directive Article 5(3) strictly necessary exemption to classify cookies that do not requ… |
| [`/cs:gdpr-audit-prep — GDPR DPO Forcing Questions`](skills/gdpr-audit-prep/) | /cs:gdpr-audit-prep <scope> — GDPR audit 6-question Article-cited forcing interrogation. Use before annual int… |
| [`Implementing Data Protection Certification`](skills/gdpr-certification/) | Guides implementation of GDPR Article 42-43 data protection certification mechanisms including accredited cert… |
| [`Developing Codes of Conduct`](skills/gdpr-codes-of-conduct/) | Guides development of GDPR Article 40-41 codes of conduct for industry sectors including drafting, submission,… |
| [`Conducting Data Protection Audit`](skills/gdpr-compliance-audit/) | Guides a comprehensive organisational data protection audit against key GDPR requirements including Articles 5… |
| [`GDPR Compliance for Marketing`](skills/gdpr-compliance-guia-matthieu/) | Ensure GDPR compliance for marketing activities including consent management, data processing, privacy notices… |
| [`GDPR Compliance`](skills/gdpr-compliance-vibeeval/) | GDPR compliance - data subject rights, lawful basis, DPIA, privacy by design, breach notification, consent man… |
| [`GDPR Data Processing Addendum (DPA)`](skills/gdpr-data-processing-addendum/) | Drafts an Article 28-aligned GDPR Data Processing Addendum (DPA) as an attachable annex for SaaS, cloud, or ou… |
| [`GDPR Data Processing Addendum (DPA)`](skills/gdpr-dpa/) | Drafts GDPR Article 28-compliant Data Processing Addenda with schedules ready for execution. Use when drafting… |
| [`Appointing EU Representative`](skills/gdpr-eu-representative/) | Guides appointment of GDPR Article 27 EU representative for non-EU controllers or processors. Covers criteria,… |
| [`GDPR Parental Consent Verification`](skills/gdpr-parental-consent/) | Implements GDPR Article 8 parental consent verification for information society services offered to children.… |
| [`Conducting Prior Consultation Process`](skills/gdpr-prior-consultation/) | Guides the GDPR Article 36 prior consultation process with supervisory authorities when a DPIA indicates high… |
| [`Creating GDPR Remediation Roadmap`](skills/gdpr-remediation-roadmap/) | Guides conversion of gap analysis findings into phased implementation plans with milestones and risk-based pri… |
| [`Performing GDPR Controller Self-Assessment`](skills/gdpr-self-assessment/) | Guides comprehensive controller self-assessment covering GDPR Articles 5-49 with scoring methodology and repor… |
| [`Generate a Compliance Audit Document`](skills/generate-compliance-audit-document/) | Generate a formatted PDF compliance audit document with findings, risk ratings, remediation recommendations, a… |
| [`Generating Compliance Reports`](skills/generating-compliance-reports/) | Generate comprehensive compliance reports for security standards. Use when creating compliance documentation.… |
| [`Configuring Google Consent Mode v2`](skills/google-consent-mode-v2/) | Configuring Google Consent Mode v2 for privacy-compliant measurement and advertising. Covers default and updat… |
| [`Providing Indirect Collection Information`](skills/indirect-collection-notice/) | Provides GDPR Article 14 information for personal data obtained from sources other than the data subject, cove… |
| [`ISO 27701 Privacy Information Management Skill`](skills/iso27701/) | Expert ISO 27701 Privacy Information Management System (PIMS) compliance advisor. Use this skill whenever a us… |
| [`Managing Joint Controller Arrangements`](skills/joint-controller-art26/) | Guides the establishment and management of joint controller arrangements under GDPR Article 26, including dete… |
| [`Canned Responses Skill`](skills/kwp-legal-canned-responses/) | Generate templated responses for common legal inquiries and identify when situations require individualized at… |
| [`Implementing Lawful Basis Assessment`](skills/lawful-basis-assessment/) | Guides determination of the correct lawful basis under GDPR Article 6(1)(a)-(f) for each processing activity.… |
| [`legal-advisor`](skills/legal-advisor/) | legal-advisor workflow skill. Use this skill when the user needs Draft privacy policies, terms of service, dis… |
| [`legal-advisor`](skills/legal-advisor-v2/) | legal-advisor workflow skill. Use this skill when the user needs Draft privacy policies, terms of service, dis… |
| [`Privacy & Terms Generator`](skills/legal-docs/) | Generate jurisdiction-aware Privacy Policies and Terms & Conditions for SaaS products, apps, and digital servi… |
| [`Legal Lite Privacy Review`](skills/legal-privacy-review/) | DPA, 개인정보 처리 활동, DSAR, PIA/DPIA, privacy policy 변경을 검토합니다. 사용자가 제공한 정책/문서/처리 설명을 기준으로 개인정보 리스크와 확인 질문, 초안 산출물을… |
| [`Assessing Legitimate Interest vs Consent`](skills/legit-interest-vs-consent/) | Decision framework for choosing between consent and legitimate interest as the lawful basis for processing. Co… |
| [`Performing Legitimate Interest Assessment`](skills/legitimate-interest-lia/) | Guides the three-part Legitimate Interest Assessment (LIA) required under GDPR Article 6(1)(f): purpose test,… |
| [`Managing Consent for Research`](skills/managing-consent-for-research/) | Guide for managing consent for scientific research under GDPR Article 89 and Recital 33 broad consent provisio… |
| [`Assessing Marketing Analytics Privacy`](skills/marketing-analytics-dpia/) | Guides DPIA for marketing profiling, behavioural targeting, cross-device tracking, and advertising analytics.… |
| [`NIST Privacy Framework — IDENTIFY Function`](skills/nist-pf-identify/) | Implement the NIST Privacy Framework IDENTIFY function including ID.BE business environment, ID.DA data action… |
| [`Personal Data Classification Test — GDPR Art. 4(1)`](skills/personal-data-test/) | Classifies personal vs non-personal data per GDPR Art. 4(1) definition test with decision tree for borderline… |
| [`/pia-generation`](skills/pia-generation/) | Generate a Privacy Impact Assessment in house format for a new feature, product, or processing activity, using… |
| [`PIA Generation`](skills/pia-generation-stubbi/) | Generate a Privacy Impact Assessment in house format for a new feature, product, or processing activity, using… |
| [`Privacy Impact Assessment for Large-Scale Monitoring`](skills/pia-large-scale-monitor/) | Conducts Privacy Impact Assessment for large-scale systematic monitoring under GDPR Article 35(3)(c). Covers C… |
| [`Managing PIA Review and Update Cadence`](skills/pia-review-cadence/) | Guides the periodic DPIA review lifecycle including trigger identification for regulatory changes, new data ca… |
| [`/policy-monitor`](skills/policy-monitor-anthropics/) | Keep the privacy policy current with practice. Two modes: weekly sweep of saved PIAs, DPA reviews, and triage… |
| [`/policy-redraft`](skills/policy-redraft-zekaisuni/) | Policy-diff veya gaps sonucunda bulunan boşluğu kapatmak için Türkçe/İngilizce iç politika üzerinde öneri redr… |
| [`Privacy Guideline`](skills/privacy/) | Privacy and data protection - GDPR, CCPA, consent. Use when handling user data. |
| [`Privacy Check Skill`](skills/privacy-check/) | Use to assess Privacy by Design compliance and GDPR/data protection alignment for a feature or system. |
| [`Privacy Law Gap Analysis for Market Entry`](skills/privacy-law-gap-analysis/) | Guides conducting privacy law gap analysis for market entry into new jurisdictions. Covers target jurisdiction… |
| [`Pages: Privacy Policy`](skills/privacy-page-generator/) | When the user wants to create, optimize, or structure Privacy Policy page. Also use when the user mentions "pr… |
| [`개인정보처리방침 생성기`](skills/privacy-policy-lucas-flatwhite/) | 데이터 유형, 관할권, GDPR 및 컴플라이언스 고려사항, 법률 검토가 필요한 조항을 다루는 상세한 개인정보처리방침을 초안 작성합니다. 개인정보처리방침 작성, 데이터 보호 문서 업데이트, 또는 컴플… |
| [`Privacy policy paperclipai`](skills/privacy-policy-paperclipai/) | Draft a detailed privacy policy covering data types, jurisdiction, GDPR and compliance considerations, and cla… |
| [`Privacy Policy Generator`](skills/privacy-policy-phuryn/) | Draft a detailed privacy policy covering data types, jurisdiction, GDPR and compliance considerations, and cla… |
| [`Skill: privacy-policy-reviewer`](skills/privacy-policy-reviewer/) | Review a privacy policy or terms of service against a structured scorecard, combining TOSDR's human-curated ra… |
| [`Pseudonymised vs Anonymised Data Classification`](skills/pseudo-vs-anon-data/) | Classifies data as pseudonymised or anonymised using Recital 26 reasonably likely test, Breyer ruling C-582/14… |
| [`Recovery App Legal Terms`](skills/recovery-app-legal-terms/) | Generate legally-sound terms of service, privacy policies, and medical disclaimers for recovery and wellness a… |
| [`/reg-gap-analysis`](skills/reg-gap-analysis-anthropics/) | Diff a new or changed regulation against current privacy policy and practice — outputs a gap list and a remedi… |
| [`Handling Right to Restriction Requests`](skills/restriction-of-processing/) | Handles GDPR Article 18 right to restriction of processing requests, covering the four grounds for restriction… |
| [`Retention Exception Management`](skills/retention-exception-mgmt/) | Manages retention exception workflows including request-approval processes, duration limits, periodic review c… |
| [`Implementing Right to Erasure Workflow`](skills/right-to-erasure/) | Implements the GDPR Article 17 right to erasure (right to be forgotten) workflow, covering all six grounds for… |
| [`Handling Right to Object to Processing`](skills/right-to-object/) | Handles GDPR Article 21 right to object to processing, including compelling legitimate grounds assessment, cea… |
| [`Processing Right to Rectification`](skills/right-to-rectification/) | Processes GDPR Article 16 right to rectification requests, covering verification of corrected data accuracy, n… |
| [`RoPA Maintenance Workflow`](skills/ropa-maintenance-workflow/) | Establishes ongoing RoPA maintenance processes including update triggers, change management integration, versi… |
| [`RoPA Tool Integration`](skills/ropa-tool-integration/) | Integrates Records of Processing Activities with privacy management platforms including OneTrust, TrustArc, Co… |
| [`Search Engine Erasure (Right to Be Forgotten)`](skills/search-engine-erasure/) | Implements the right to be forgotten in search engines under GDPR Article 17 and the CJEU Google Spain ruling… |
| [`Slovak to English GDPR Translation`](skills/slovak-to-english-gdpr-translation/) | Translates legal articles from Slovak to English with strict terminology mappings for GDPR terms ('prevádzkova… |
| [`Special Category Data Classification — GDPR Art. 9`](skills/special-category-data/) | Identifies and classifies GDPR Art. 9 special category data including racial origin, political opinions, relig… |
| [`Sub-Processor Management`](skills/sub-processor-management/) | GDPR Article 28(2) sub-processor approval workflow management. Covers prior specific and general authorization… |
| [`Implementing Supplementary Measures`](skills/supplementary-measures/) | Guides implementation of technical, contractual, and organisational supplementary measures for international d… |
| [`Terms of Service Analyzer`](skills/terms-analyzer/) | Analyze terms of service and privacy policies to identify concerning clauses, hidden permissions, and user rig… |
| [`Terms Recon`](skills/terms-recon/) | Survey existing privacy and legal docs for completeness and GDPR compliance. |
| [`Conducting Transfer Impact Assessment`](skills/transfer-impact-assessment/) | Guides the post-Schrems II Transfer Impact Assessment process following EDPB Recommendations 01/2020 six-step… |
| [`Implementing Transparent Communication`](skills/transparent-communication/) | Implements GDPR Article 12 transparent information and communication requirements, covering concise, intelligi… |
| [`/use-case-triage`](skills/use-case-triage/) | Quickly determine whether a processing activity needs a PIA, a mandatory GDPR DPIA, or can proceed — surfaces… |
| [`/vendor-ai-review`](skills/vendor-ai-review-anthropics/) | Review vendor AI terms — agreement, addendum, or ToS AI provisions — against your governance positions; flag t… |
| [`Vendor Privacy Audit`](skills/vendor-privacy-audit/) | On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collecti… |
| [`Vendor Privacy Due Diligence`](skills/vendor-privacy-due-diligence/) | Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical contro… |
