Data Protection

What it does

When your agent uses it

• Tasks that involve Privacy and GDPR

Example prompts

• “/data-protection”

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

1. 1Proactive, not reactive — Embed privacy into political data imports
2. 2Privacy as default — Minimize personal data collection
3. 3Privacy embedded in design — Use pseudonymization where possible
4. 4Full functionality — Privacy without sacrificing analysis quality
5. 5End-to-end security — Encrypt data at rest and in transit
6. 6Visibility and transparency — Document all data processing activities
7. 7Respect for user privacy — Provide data access and deletion mechanisms

What it can do on your machine

Read from SKILL.md and the folder at commit 6a9797b. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are java).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • github.com
  • gdpr-info.eu
  • csrc.nist.gov

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Data Protection loads about 1.8k tokens when it runs. Until then it costs about 30 tokens; SKILL.md has 421 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~30

When it runs · the whole SKILL.md, loaded when a task matches

~1.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Hack23/cia at commit 6a9797b, republished under its Apache-2.0 licence (© Hack23). 421 words, ~1,752 tokens.

name

data-protection

description

Data classification (CIA triad), GDPR privacy by design, encryption standards, data lifecycle management

license

Apache-2.0

Classification Levels (Hack23 ISMS)
│
├─ PUBLIC
│  ├─ Parliamentary voting records
│  ├─ Published committee documents
│  ├─ Official election results
│  └─ World Bank economic indicators
│
├─ INTERNAL
│  ├─ Aggregated analysis results
│  ├─ Risk scoring algorithms
│  ├─ Platform usage analytics
│  └─ System configuration data
│
├─ CONFIDENTIAL
│  ├─ User account credentials
│  ├─ Session tokens and API keys
│  ├─ Audit logs with user actions
│  └─ Internal security assessments
│
└─ RESTRICTED
   ├─ Database credentials
   ├─ Encryption keys (KMS)
   ├─ AWS access credentials
   └─ Security incident data

Data Classification Decision
│
├─→ Is it publicly available from official sources?
│   ├─ YES → PUBLIC
│   └─ NO ↓
│
├─→ Does it contain personal identifiers?
│   ├─ YES → CONFIDENTIAL (minimum)
│   └─ NO ↓
│
├─→ Is it a credential, key, or secret?
│   ├─ YES → RESTRICTED
│   └─ NO ↓
│
└─→ Is it internal analysis or configuration?
    ├─ YES → INTERNAL
    └─ NO → Assess case-by-case

// ✅ SECURE: Minimize personal data in analysis
@Service
public class PoliticianAnalysisService {

    public PoliticianSummary analyzePolitician(String personId) {
        // Only retrieve fields needed for analysis
        PoliticianData data = repository.findPublicDataById(personId);

        // Never include unnecessary personal details
        return PoliticianSummary.builder()
            .personId(personId)
            .votingRecord(data.getVotingRecord())
            .committeeAssignments(data.getCommittees())
            .partyAffiliation(data.getParty())
            .build();
        // Excluded: personal address, phone, private email
    }
}

// ❌ INSECURE: Over-collection of personal data
public PoliticianData getAllPersonalData(String personId) {
    return repository.findById(personId); // Returns ALL fields
}

Encryption Requirements by Classification
│
├─ PUBLIC → No encryption required
├─ INTERNAL → AES-256 recommended
├─ CONFIDENTIAL → AES-256 required (AWS KMS)
└─ RESTRICTED → AES-256 + envelope encryption (KMS CMK)

// Column-level encryption for sensitive fields
@Entity
@Table(name = "application_user")
public class ApplicationUser {

    @Column(name = "username")
    private String username; // PUBLIC - no encryption

    @Column(name = "email")
    @Convert(converter = EncryptedStringConverter.class)
    private String email; // CONFIDENTIAL - encrypted

    @Column(name = "password_hash")
    private String passwordHash; // Already hashed (bcrypt)
}

// Implement secure deletion for user data
@Service
public class DataDeletionService {

    @Transactional
    public void deleteUserAccount(Long userId) {
        // 1. Remove personal data
        userRepository.anonymizeUser(userId);

        // 2. Delete session data
        sessionRepository.deleteByUserId(userId);

        // 3. Audit the deletion (GDPR compliance)
        auditService.logDeletion(userId, "GDPR erasure request");

        // 4. Remove from caches
        cacheManager.evict("user:" + userId);
    }
}

© Hack23, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .github/skills/data-protection of Hack23/cia.

Open the folder on GitHubat commit 6a9797b