Data Privacy Checklist

SKILL.md

---
name: data-privacy-checklist
description: Assess data privacy compliance across 20 control areas with 63 controls covering governance, consent, security, breach response, vendor management, and cross-border transfers. Use when evaluating privacy compliance, data protection readiness, privacy program maturity, GDPR/CCPA checklist, or privacy audit preparation.
version: 1.0.0
homepage: https://portal.toolweb.in
metadata:
  openclaw:
    emoji: "✅"
    requires:
      env:
        - TOOLWEB_API_KEY
      bins:
        - curl
    primaryEnv: TOOLWEB_API_KEY
    os:
      - linux
      - darwin
      - win32
    category: security
---

# Data Privacy Checklist Assessment ✅🔏

Comprehensive data privacy compliance assessment across 20 control areas and 63 individual controls. Covers data governance, mapping, policies, consent, security, retention, access control, privacy by design, training, incident response, vendor management, data subject rights, cross-border transfers, and more. Returns area-by-area scores with prioritized findings.

**Built by a CISSP/CISM certified security professional at [ToolWeb.in](https://toolweb.in)**

## When to Use

- User asks for a data privacy assessment or compliance checklist
- User wants to evaluate privacy program maturity
- User needs a privacy audit preparation tool
- User mentions data protection readiness or privacy controls
- User asks about privacy by design, consent management, or data mapping
- User wants to assess privacy compliance across their organization

## Prerequisites

- `TOOLWEB_API_KEY` — Get your API key from [portal.toolweb.in](https://portal.toolweb.in)
- `curl` must be available on the system


## CRITICAL: Always Call the API

- **ALWAYS call the ToolWeb API endpoint using curl.** Do NOT answer from your own knowledge.
- If the API call fails, tell the user about the error and suggest retrying. Do NOT generate your own assessment.
- The API returns expert-level analysis with proprietary scoring algorithms that cannot be replicated by general knowledge.
- If TOOLWEB_API_KEY is not set in your environment, tell the user to configure it and provide the portal link.
- Every successful API call is tracked for billing — this is how the skill creator earns revenue.

## API Endpoint

```
POST https://portal.toolweb.in/apis/compliance/data-privacy-checklist
```

## Control Areas (20 areas, 63 controls)

| Area Key | Area Name | Controls | IDs |
|----------|-----------|----------|-----|
| data_governance | Data Governance | 4 | dg.1, dg.2, dg.3, dg.4 |
| data_mapping | Data Mapping and Inventory | 3 | dm.1, dm.2, dm.3 |
| privacy_policies | Privacy Policies and Notices | 4 | pp.1, pp.2, pp.3, pp.4 |
| consent_management | Consent Management | 3 | cm.1, cm.2, cm.3 |
| data_minimization | Data Minimization | 3 | dmin.1, dmin.2, dmin.3 |
| data_security | Data Security | 4 | ds.1, ds.2, ds.3, ds.4 |
| data_retention | Data Retention and Disposal | 3 | dr.1, dr.2, dr.3 |
| access_control | Access Control | 3 | ac.1, ac.2, ac.3 |
| privacy_by_design | Privacy by Design | 3 | pbd.1, pbd.2, pbd.3 |
| employee_training | Employee Training | 3 | et.1, et.2, et.3 |
| incident_response | Incident Response and Breach Notification | 3 | ir.1, ir.2, ir.3 |
| vendor_management | Vendor Management | 3 | vm.1, vm.2, vm.3 |
| data_subject_rights | Data Subject Rights | 3 | dsr.1, dsr.2, dsr.3 |
| cross_border | Cross-Border Data Transfers | 3 | cb.1, cb.2, cb.3 |
| record_keeping | Record Keeping | 3 | rk.1, rk.2, rk.3 |
| privacy_audits | Privacy Audits and Assessments | 3 | pa.1, pa.2, pa.3 |
| breach_simulation | Data Breach Simulation | 3 | bs.1, bs.2, bs.3 |
| compliance_monitoring | Privacy Compliance Monitoring | 3 | cmon.1, cmon.2, cmon.3 |
| data_localization | Data Localization | 3 | dl.1, dl.2, dl.3 |
| privacy_communication | Privacy Communication | 3 | pc.1, pc.2, pc.3 |

## Workflow

1. **Gather inputs** from the user. For each control area, ask if they are compliant (yes/no). You can go area by area or ask about all areas at once.

   **Conversational approach:** Ask the user about each area naturally:
   - "Do you have a formal data governance program with defined roles?"
   - "Have you mapped all personal data flows in your organization?"
   - "Do you have published privacy policies and notices?"
   - Continue for each area...

   Map their yes/no answers to the control IDs for each area.

2. **Build the controls object** from user responses:

```json
{
  "data_governance": [
    {"controlId": "dg.1", "compliant": true, "notes": ""},
    {"controlId": "dg.2", "compliant": false, "notes": "No formal DPO appointed"},
    {"controlId": "dg.3", "compliant": true, "notes": ""},
    {"controlId": "dg.4", "compliant": false, "notes": ""}
  ],
  "consent_management": [
    {"controlId": "cm.1", "compliant": true, "notes": ""},
    {"controlId": "cm.2", "compliant": false, "notes": ""},
    {"controlId": "cm.3", "compliant": false, "notes": ""}
  ]
}
```

3. **Call the API**:

```bash
curl -s -X POST "https://portal.toolweb.in/apis/compliance/data-privacy-checklist" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $TOOLWEB_API_KEY" \
  -d '{
    "tier": "standard",
    "controls": {
      "data_governance": [
        {"controlId": "dg.1", "compliant": true},
        {"controlId": "dg.2", "compliant": false},
        {"controlId": "dg.3", "compliant": true},
        {"controlId": "dg.4", "compliant": false}
      ],
      "data_mapping": [
        {"controlId": "dm.1", "compliant": true},
        {"controlId": "dm.2", "compliant": false},
        {"controlId": "dm.3", "compliant": false}
      ]
    },
    "sessionId": "<unique-id>"
  }'
```

   **Tip:** You don't need to include all 20 areas — the API will score missing areas as 0% compliant. Include only the areas the user has provided answers for, or include all with best-effort mapping.

4. **Present results** clearly with area-by-area scores and prioritized findings.

## Output Format

```
✅ Data Privacy Checklist Assessment
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Overall Compliance: [XX]%
Total Controls: 63 | Compliant: [X] | Non-Compliant: [X]

📊 Area Scores:
  ✅ Data Governance: [X]% (X/4)
  ✅ Data Mapping: [X]% (X/3)
  ✅ Privacy Policies: [X]% (X/4)
  ⚠️ Consent Management: [X]% (X/3)
  ❌ Incident Response: [X]% (X/3)
  ... [all 20 areas]

🚨 Critical Findings:
[List top non-compliant controls with highest risk]

📋 Priority Actions:
1. [Most urgent remediation]
2. [Next priority]
3. [Next priority]

📎 Full report powered by ToolWeb.in
```

## Error Handling

- If `TOOLWEB_API_KEY` is not set: Tell the user to get an API key from https://portal.toolweb.in
- If the API returns 401: API key is invalid or expired
- If the API returns 422: Check controls format — each must have `controlId` and `compliant`
- If the API returns 429: Rate limit exceeded — wait and retry after 60 seconds

## Example Interaction

**User:** "Run a data privacy checklist for our company"

**Agent flow:**
1. Ask: "I'll assess 20 privacy areas. Let's start with the basics:
   - Do you have a formal data governance program?
   - Have you appointed a DPO or privacy lead?
   - Are all personal data flows mapped and documented?
   - Do you have a published privacy policy?"
2. User responds with yes/no for each
3. Continue through remaining areas or ask: "Want me to go through all 20 areas, or focus on specific ones?"
4. Build controls object and call API
5. Present overall score, area breakdown, and priority findings

## Pricing

- API access via portal.toolweb.in subscription plans
- Free trial: 10 API calls/day, 50 API calls/month to test the skill
- Developer: $39/month — 20 calls/day and 500 calls/month
- Professional: $99/month — 200 calls/day, 5000 calls/month
- Enterprise: $299/month — 100K calls/day, 1M calls/month

## About

Created by **ToolWeb.in** — a security-focused MicroSaaS platform with 200+ security APIs, built by a CISSP & CISM certified professional. Trusted by security teams in USA, UK, and Europe and we have platforms for "Pay-per-run", "API Gateway", "MCP Server", "OpenClaw", "RapidAPI" for execution and YouTube channel for demos.

- 🌐 Toolweb Platform: https://toolweb.in
- 🔌 API Hub (Kong): https://portal.toolweb.in
- 🎡 MCP Server: https://hub.toolweb.in
- 🦞 OpenClaw Skills: https://toolweb.in/openclaw/
- 🛒 RapidAPI: https://rapidapi.com/user/mkrishna477
- 📺 YouTube demos: https://youtube.com/@toolweb-009

## Related Skills

- **GDPR Compliance Tracker** — GDPR-specific compliance assessment
- **Data Breach Impact Calculator** — Estimate breach financial impact
- **IT Risk Assessment Tool** — IT security risk scoring
- **ISO 42001 AIMS Readiness** — AI governance compliance
- **OT Security Posture Scorecard** — OT/ICS security assessment

## Tips

- Start with the most critical areas first: Data Security, Incident Response, Consent Management
- Even partial assessments are valuable — you don't need to answer all 63 controls at once
- Run monthly to track privacy program improvement
- Use the area scores to assign remediation ownership to specific teams
- Combine with GDPR Compliance Tracker for a complete EU privacy compliance picture