GDPR and AVG (Belgian data protection law) compliance handler for agency operators, data controllers, and organizations managing data subject requests. Regis...
---
name: nex-gdpr
description: GDPR and AVG (Belgian data protection law) compliance handler for agency operators, data controllers, and organizations managing data subject requests. Register and manage all types of data subject requests (inzageverzoek, verwijderverzoek, recht op gegevensoverdracht) as required under GDPR Articles 15-21 and Belgian AVG regulations. Automatically scan and discover personal data across OpenClaw sessions, agent memory, application logs, and skill databases. Process Right of Access requests by compiling complete personal data exports in machine-readable formats. Handle Right of Erasure requests with secure 3-pass file deletion and audit logging. Support Right to Data Portability with JSON format exports. Generate compliant response letters in both Dutch (AVG) and English (GDPR) with formal documentation. Track 30-day legal response deadlines with extension options for complex requests. Maintain immutable audit trails of every action taken on data subject requests for regulatory compliance and dispute resolution. Manage data retention policies and auto-cleanup schedules. Perfect for Belgian agencies, service providers, and organizations operating under GDPR/AVG who need systematic compliance processes.
version: 1.0.0
metadata:
clawdbot:
emoji: "🛡"
requires:
bins:
- python3
env:
- OPENCLAW_SESSIONS
- NEX_GDPR_SCAN_PATHS
primaryEnv: ""
homepage: https://nex-ai.be
files:
- "nex-gdpr.py"
- "lib/*"
- "setup.sh"
---
# Nex GDPR
GDPR Data Request Handler for agency operators running OpenClaw for clients. Automate compliance with data subject rights (Articles 15-21 of GDPR/AVG). Register requests, scan for personal data, process erasure/access/portability, generate response letters, and maintain audit trails.
## When to Use
Use this skill when you need to:
- **Register and manage GDPR data subject requests** (inzageverzoek, verwijderverzoek, etc.)
- **Process Right to Access requests** (Article 15 - inzagerecht): Locate all personal data and compile export packages
- **Process Right to Erasure requests** (Article 17 - verwijderrecht): Identify and securely delete personal data
- **Process Right to Data Portability requests** (Article 20 - recht op gegevensoverdracht): Export in machine-readable format
- **Process Right to Rectification requests** (Article 16 - recht op correctie): Track and apply corrections
- **Track Right to Restriction of Processing** (Article 18 - recht op beperking)
- **Handle Right to Object** (Article 21 - recht van verzet)
- **Scan for personal data** across OpenClaw sessions, logs, and databases
- **Generate compliance response letters** in Dutch and English
- **Maintain audit trails** for every action taken
- **Monitor compliance deadlines** (30-day GDPR response deadline)
- **Manage data retention policies** and auto-cleanup
- **Export compliance reports** for documentation
Trigger phrases: "GDPR request", "data subject request", "inzageverzoek", "verwijderverzoek", "right to access", "right to erasure", "data portability", "personal data", "PII", "AVG", "persoonsgegevens", "erasure request", "portability request", "how many GDPR requests", "overdue requests", "audit trail", "compliance documentation"
Example use cases:
- "Register a new GDPR access request for jan@example.be"
- "Scan for all data related to jan@example.be"
- "Process the access request for request #42"
- "Which GDPR requests are overdue?"
- "Generate a response letter for the Jan Peeters request"
- "Show the audit trail for request #42"
- "Export compliance report for request #42"
- "Show GDPR statistics and compliance status"
## Quick Setup
If the database does not exist yet, run the setup script:
```bash
bash setup.sh
```
This creates the data directory, installs dependencies, and initializes the database.
## Available Commands
### Request Management
**Register a new request:**
```bash
nex-gdpr new --type access --name "Jan Peeters" --email "jan@example.be" --id "user_jan_123"
```
Request types: `ACCESS`, `ERASURE`, `PORTABILITY`, `RECTIFICATION`, `RESTRICTION`, `OBJECTION`
**List all requests:**
```bash
nex-gdpr list
nex-gdpr list --status VERIFIED
nex-gdpr list --type ERASURE
```
**Show request details:**
```bash
nex-gdpr show 42
```
Shows request status, deadline, findings, and audit trail.
### Data Discovery & Scanning
**Scan for user data:**
```bash
nex-gdpr scan "jan@example.be"
nex-gdpr scan --request 42
```
Scans OpenClaw sessions, agent memory, logs, and databases for personal data.
**Show findings for a request:**
```bash
nex-gdpr findings 42
```
### Request Processing
**Process a request:**
```bash
nex-gdpr process 42
```
Automatically:
- Scans for all user data
- For ACCESS: Creates export ZIP package
- For ERASURE: Securely deletes personal data (with logging)
- For PORTABILITY: Exports machine-readable JSON format
- Marks request as COMPLETED
**Verify request identity:**
```bash
nex-gdpr verify 42 --method "email confirmation"
```
**Deny a request:**
```bash
nex-gdpr deny 42 --reason "Identity could not be verified"
```
**Complete a request:**
```bash
nex-gdpr complete 42
```
### Compliance & Monitoring
**Show overdue requests:**
```bash
nex-gdpr overdue
```
Highlights requests past the 30-day GDPR response deadline.
**Generate response letter:**
```bash
nex-gdpr letter 42
```
Outputs formal response letter in Dutch and English (Article 15-21 compliant).
**Export compliance report:**
```bash
nex-gdpr export 42
```
Exports complete request report (JSON) with findings and audit trail.
**Show audit trail:**
```bash
nex-gdpr audit 42
```
Displays all actions taken on the request (verification, processing, approvals).
**Show GDPR statistics:**
```bash
nex-gdpr stats
```
Displays request counts by status/type, overdue requests, PII findings, and data volumes.
### Data Retention
**Show retention policies:**
```bash
nex-gdpr retention show
```
**Set retention policy:**
```bash
nex-gdpr retention set --type sessions --days 180 --auto-delete
```
**Run cleanup:**
```bash
nex-gdpr cleanup --dry-run
nex-gdpr cleanup --execute
```
## Architecture
### Storage
- **SQLite Database** at `~/.nex-gdpr/gdpr.db`
- Tables: `requests`, `data_findings`, `audit_trail`, `retention_policies`
- Indexes on status, type, deadline for fast queries
### Data Scanning
- **OpenClaw Sessions**: Scans `.openclaw/sessions` and `.claw/sessions`
- **Agent Memory**: Scans `.nex-memory` directory
- **Logs**: Scans `.nex-logs` for user references
- **Other Databases**: Scans other nex-* skill databases
- **PII Detection**: Email, phone, national numbers, VAT numbers
### Request Processing
- **ACCESS**: Creates ZIP export of all found data
- **ERASURE**: Securely deletes files (3-pass overwrite)
- **PORTABILITY**: Exports JSON format with metadata
- **RECTIFICATION**: Tracks corrections to personal data
- All actions logged with timestamps and actor information
### Compliance
- **30-day Response Deadline**: Automatically calculated from GDPR Article 12
- **60-day Extension**: For complex requests (logged and tracked)
- **Audit Trail**: Every action recorded (scanning, verification, processing, completion)
- **Response Letters**: Generated in Dutch (AVG) and English (GDPR)
- **Retention Policies**: Configurable per data type (default 1 year, audit 7 years)
## Data Locations Scanned
The scanner searches the following locations for personal data:
- `~/.openclaw/sessions` - OpenClaw session files
- `~/.claw/sessions` - Alternative Claw sessions
- `~/.nex-memory` - Agent memory files
- `~/.nex-logs` - Application logs
- `~/.nex-uploads` - Uploaded files
- Other nex-* skill databases (life-logger, inbox, notes, etc.)
Configurable via environment variables:
```bash
export OPENCLAW_SESSIONS="/custom/sessions/path"
export NEX_GDPR_SCAN_PATHS="/path1:/path2:/path3"
```
## GDPR Articles Supported
- **Article 15**: Right of access by the data subject
- **Article 16**: Right to rectification
- **Article 17**: Right to erasure (right to be forgotten)
- **Article 18**: Right to restrict processing
- **Article 20**: Right to data portability
- **Article 21**: Right to object
## Privacy & Security
- All personal data exports are encrypted and stored in `~/.nex-gdpr/exports/`
- Erasure operations use secure deletion (3-pass overwrite)
- Audit trail cannot be modified (append-only)
- All operations require explicit status changes
- No automatic external sharing (all data stays local)
## Configuration
Configuration is stored in `lib/config.py`:
- `DATA_DIR`: `~/.nex-gdpr` (customizable)
- `RESPONSE_DEADLINE_DAYS`: 30 (GDPR requirement)
- `EXTENSION_DAYS`: 60 (for complex requests)
- `DEFAULT_RETENTION_DAYS`: 365 (1 year default)
## Exit Codes
- `0`: Success
- `1`: Error or validation failure
## Notes
- Designed for agency operators managing multiple clients under GDPR
- All timestamps are ISO 8601 format with timezone
- Data findings include PII detection (email, phone, national numbers)
- Retention cleanup is manual (scheduled via cron or trigger command)
- Export packages are ZIP files with manifest and data files
- Responses are compliant with Belgian GDPR (AVG) regulations
## Support
For issues or questions:
- Homepage: https://nex-ai.be
- License: MIT-0 (free and open source)
don't have the plugin yet? install it then click "run inline in claude" again.
structured 6 required components with explicit decision points for edge cases (missing identity verification, unavailable data sources, locked files, failed scans), formalized all 14 command procedures with specific inputs and outputs, added environment variable documentation, detailed storage paths and file formats, and clarified outcome signals for each operation.
run this skill to register, track, and process GDPR data subject requests (Articles 15-21) and Belgian AVG compliance obligations. use it when a data subject asks for access to their personal data, deletion, portability, rectification, processing restriction, or objection. the skill scans OpenClaw sessions, agent memory, logs, and databases to discover personal data, generates compliant response letters in dutch and english, processes erasure with secure deletion, exports machine-readable formats, maintains immutable audit trails, and monitors 30-day legal deadlines. designed for belgian agencies, service providers, and data controllers running multiple client operations.
environment variables:
OPENCLAW_SESSIONS: path to openclaw session files (default: ~/.openclaw/sessions or ~/.claw/sessions)NEX_GDPR_SCAN_PATHS: colon-separated list of additional paths to scan for personal data (e.g., /custom/path1:/custom/path2)external connections:
runtime requirements:
~/.nex-gdpr/ directory (writable, created by setup.sh)initial setup:
run bash setup.sh once to create data directory, install python dependencies, and initialize the sqlite database at ~/.nex-gdpr/gdpr.db. this creates tables: requests, data_findings, audit_trail, retention_policies.
inputs: request type (ACCESS, ERASURE, PORTABILITY, RECTIFICATION, RESTRICTION, OBJECTION), data subject name, email, optional internal user id.
command:
nex-gdpr new --type <TYPE> --name "<NAME>" --email "<EMAIL>" --id "<USER_ID>"
outputs: request id (integer), status set to PENDING, deadline calculated as today + 30 days (iso 8601), all fields stored in requests table, audit trail entry created.
inputs: either email address or request id.
command:
nex-gdpr scan "<EMAIL>"
nex-gdpr scan --request <ID>
scanning locations:
~/.openclaw/sessions and ~/.claw/sessions (openclaw session files)~/.nex-memory (agent memory)~/.nex-logs (application logs)~/.nex-uploads (uploaded files)NEX_GDPR_SCAN_PATHS env varpii detection patterns: email addresses, phone numbers, national id numbers, vat numbers, names in context.
outputs: findings list with file path, data type (email, phone, name, etc.), context snippet, file modification date. all results stored in data_findings table. audit trail entry logged with finding count.
inputs: request id, verification method (email confirmation, phone verification, documented identity proof, etc.).
command:
nex-gdpr verify <ID> --method "<METHOD>"
outputs: request status changed to VERIFIED (or IDENTITY_FAILED if verification failed). audit trail entry with verification timestamp and method. must complete before processing.
inputs: verified request id.
command:
nex-gdpr process <ID>
automatic sub-steps by request type:
for ACCESS requests:
~/.nex-gdpr/exports/<ID>_access_<TIMESTAMP>.zipfor ERASURE requests:
for PORTABILITY requests:
{"request_id": <ID>, "subject_email": "<EMAIL>", "export_date": "<ISO8601>", "data": [{"type": "<TYPE>", "value": "<VALUE>", "source": "<FILE>", "date_found": "<ISO8601>"}]}~/.nex-gdpr/exports/<ID>_portability_<TIMESTAMP>.jsonfor RECTIFICATION requests:
for RESTRICTION requests:
for OBJECTION requests:
outputs: processed data (zip, json, or report), status updated, audit trail with processing timestamp and actor.
inputs: request id (must be at VERIFIED or COMPLETED status).
command:
nex-gdpr letter <ID>
outputs: formal response letter (dutch and english versions) in plain text. letter includes:
letters saved to ~/.nex-gdpr/letters/<ID>_<LANGUAGE>_<TIMESTAMP>.txt.
inputs: request id.
command:
nex-gdpr audit <ID>
outputs: chronological list of all actions on the request. each entry includes: timestamp (iso 8601), action type (register, scan, verify, process, deny, complete), actor (user, system), details, and status change if applicable. audit trail is append-only (no modifications).
inputs: optional filters (status, type, overdue).
commands:
nex-gdpr list
nex-gdpr list --status VERIFIED
nex-gdpr list --type ERASURE
nex-gdpr overdue
outputs: table of matching requests with id, type, status, deadline, data subject email, and days remaining. sorted by deadline (ascending).
inputs: request id.
command:
nex-gdpr show <ID>
outputs: full request details including id, type, status, data subject name/email, registration date, deadline, findings count, verification status, processing status, and compact audit trail.
inputs: request id, reason (string).
command:
nex-gdpr deny <ID> --reason "<REASON>"
outputs: status set to DENIED, reason stored in audit trail, audit trail entry logged with timestamp. response letter can still be generated to explain denial.
inputs: request id (must be processed or verified, depending on type).
command:
nex-gdpr complete <ID>
outputs: status set to COMPLETED, completion timestamp recorded, audit trail entry created. marks request as closed.
inputs: request id.
command:
nex-gdpr export <ID>
outputs: json file at ~/.nex-gdpr/exports/<ID>_report_<TIMESTAMP>.json containing: request metadata, all findings, audit trail entries, response letters (if generated), processing status, and compliance checklist.
inputs: data type (sessions, logs, uploads, memory, audit), retention days, auto-delete flag.
commands:
nex-gdpr retention show
nex-gdpr retention set --type sessions --days 180 --auto-delete
outputs: retention policy stored in database. defaults are: sessions 180 days, logs 90 days, uploads 365 days, memory 90 days, audit trail 2555 days (7 years, non-deletable). auto-delete flag enables automatic cleanup when policy expires.
inputs: none (uses retention policies).
commands:
nex-gdpr cleanup --dry-run
nex-gdpr cleanup --execute
dry-run: outputs files that would be deleted without deleting.
execute: deletes files older than retention period, securely overwrites (3-pass), logs each deletion in audit trail. audit trail entries are never deleted.
outputs: cleanup report with count of files deleted, space freed, any errors encountered.
inputs: none.
command:
nex-gdpr stats
outputs: dashboard showing request counts by status (PENDING, VERIFIED, COMPLETED, DENIED, OVERDUE), counts by type, total pii findings discovered, data volume scanned, overdue request count, and average response time.
decision: should i register the request?
decision: is the data subject's identity verified?
decision: can i process this request?
decision: should i process the request now or extend the deadline?
decision: what if scan finds no personal data?
data_findings is empty, create audit trail entry noting "no personal data found". generate response letter confirming zero findings. mark request as COMPLETED. no export or deletion needed.decision: what if identity verification fails?
decision: what if database is not initialized?
~/.nex-gdpr/gdpr.db does not exist, run setup.sh before executing any other commands. setup is idempotent (safe to re-run).decision: should audit trail entries be deleted?
decision: what if erasure encounters a locked or permission-denied file?
decision: what if scan encounters network timeout or unavailable data source?
decision: what if request id does not exist?
decision: what if retention policy deletes data but audit trail references it?
request registration: integer request id assigned, unique, stored in requests table.
data scanning: json array of findings, each with: {"type": "email|phone|national_id|vat|name", "value": "<MASKED_VALUE>", "source": "<FILE_PATH>", "date_found": "<ISO8601>", "context_snippet": "<TEXT>"}. stored in data_findings table.
access export: zip file at ~/.nex-gdpr/exports/<ID>_access_<TIMESTAMP>.zip containing manifest.json and data files (copies). manifest includes request id, export date, findings count, file listing.
erasure report: text report listing all files securely deleted (3-pass overwrite), deletion timestamps, and any failures. stored in audit trail.
portability export: json file at ~/.nex-gdpr/exports/<ID>_portability_<TIMESTAMP>.json with schema: {"request_id": <ID>, "subject_email": "<EMAIL>", "export_date": "<ISO8601>", "data": [...]}. machine-readable, no encryption required (but can be encrypted by user).
response letter: plain text file (dutch and english versions) at ~/.nex-gdpr/letters/<ID>_<LANGUAGE>_<TIMESTAMP>.txt. includes article reference, deadline, findings summary, compliance statement, contact info.
audit trail: json array of audit entries, each with: {"timestamp": "<ISO8601>", "action": "<ACTION_TYPE>", "actor": "<USER|SYSTEM>", "request_id": <ID>, "details": "<TEXT>", "status_before": "<STATUS>", "status_after": "<STATUS>"}. stored in audit_trail table. append-only, no modifications.
compliance report: json file at ~/.nex-gdpr/exports/<ID>_report_<TIMESTAMP>.json containing request metadata, all findings, full audit trail, response letters, processing timeline, and compliance checklist.
request list: table output (stdout) with columns: id, type, status, deadline, email, days_remaining. sortable by column.
statistics: dashboard output (stdout) showing counts by status/type, overdue count, total pii findings, scan volume, average response time.
error output: stderr message describing validation failure, file access error, database error, etc. exit code 1 on error.
exit codes: 0 for success, 1 for error.
you know this skill worked when:
nex-gdpr list shows the new request with id, status PENDING, and correct deadline 30 days from today.nex-gdpr findings <ID> displays discovered personal data (emails, phone numbers, etc.) with file locations and context.nex-gdpr show <ID> shows status changed to VERIFIED.~/.nex-gdpr/exports/<ID>_access_*.zip and is readable; nex-gdpr show <ID> shows status COMPLETED.nex-gdpr show <ID> shows status COMPLETED.~/.nex-gdpr/exports/<ID>_portability_*.json and contains all found data in machine-readable format..txt file exists in ~/.nex-gdpr/letters/ with correct dutch and english versions, includes GDPR/AVG article references.nex-gdpr audit <ID> displays chronological log of every action (register, scan, verify, process, complete) with timestamps.nex-gdpr overdue returns empty if all requests are on track; shows overdue requests if any exist (deadline passed).nex-gdpr cleanup --execute deletes old data according to policy; audit trail logs each deletion.credits: original skill design from clawhub. enriched per implexa quality standards.