gdpr-data-handling

SKILL.md

GDPR Data Handling

Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.

When to Use This Skill

Building systems that process EU personal data

Implementing consent management

Handling data subject requests (DSRs)

Conducting GDPR compliance reviews

Designing privacy-first architectures

Creating data processing agreements

Core Concepts

1. Personal Data Categories

Category
Examples
Protection Level

Basic
Name, email, phone
Standard

Sensitive (Art. 9)
Health, religion, ethnicity
Explicit consent

Criminal (Art. 10)
Convictions, offenses
Official authority

Children's
Under 16 data
Parental consent

2. Legal Bases for Processing

Article 6 - Lawful Bases:
├── Consent: Freely given, specific, informed
├── Contract: Necessary for contract performance
├── Legal Obligation: Required by law
├── Vital Interests: Protecting someone's life
├── Public Interest: Official functions
└── Legitimate Interest: Balanced against rights

3. Data Subject Rights

Right to Access (Art. 15)      ─┐
Right to Rectification (Art. 16) │
Right to Erasure (Art. 17)       │ Must respond
Right to Restrict (Art. 18)      │ within 1 month
Right to Portability (Art. 20)   │
Right to Object (Art. 21)       ─┘

Detailed worked examples and patterns

Detailed sections (starting with ## Implementation Patterns) live in references/details.md. Read that file when the navigation summary above is insufficient.

Best Practices

Do's

Minimize data collection - Only collect what's needed

Document everything - Processing activities, legal bases

Encrypt PII - At rest and in transit

Implement access controls - Need-to-know basis

Regular audits - Verify compliance continuously

Don'ts

Don't pre-check consent boxes - Must be opt-in

Don't bundle consent - Separate purposes separately

Don't retain indefinitely - Define and enforce retention

Don't ignore DSARs - 30-day response required

Don't transfer without safeguards - SCCs or adequacy decisions