Ccpa Right To Delete

What it does

When your agent uses it

• Tasks that involve Privacy and GDPR

Example prompts

• “Use the ccpa-right-to-delete skill to implement CCPA Section 1798.105 right to delete and CPRA amendments including service provider obligations…”
• “/ccpa-right-to-delete”

Requirements

• Python 3

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

1. 1Extended to service providers and contractors: Businesses must direct service providers and contractors to delete, not just notify them.
2. 2Third-party notification: Businesses must notify third parties to whom personal information was sold or shared to also delete.
3. 3CPPA enforcement: The California Privacy Protection Agency has rulemaking and enforcement authority.
4. 4Expanded definitions: "Sharing" (for cross-context behavioral advertising) added alongside "selling."

What it can do on your machine

Read from SKILL.md and the folder at commit 9b2ef9e. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Python), which the agent can run.

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Ccpa Right To Delete loads about 4.2k tokens when it runs, and up to ~5.9k if it reads all its reference files. Until then it costs about 93 tokens; SKILL.md has 1,469 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~93

When it runs · the whole SKILL.md, loaded when a task matches

~4.2k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~5.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Privacy-Data-Protection-Skills at commit 9b2ef9e, republished under its Apache-2.0 licence (© mukul975). 1,469 words, ~4,234 tokens.

name

ccpa-right-to-delete

description

Implements CCPA Section 1798.105 right to delete and CPRA amendments including service provider obligations, statutory exceptions for legal, security, and internal uses, consumer identity verification procedures, and 45-day response timeline management. Activate for CCPA deletion, CPRA right to delete, California privacy, consumer deletion queries.

license

Apache-2.0

metadata.author

mukul975

metadata.version

1.0

metadata.domain

privacy

metadata.subdomain

data-retention-deletion

metadata.tags

ccpa-right-to-delete, cpra, california-privacy, consumer-deletion, service-provider-obligations

[Deletion Request Received]
         │
         ▼
[For Each Category of Personal Information Held]
   │
   ├── [Does any exception under §1798.105(d) apply?]
   │     │
   │     ├── No exception ──► DELETE this category
   │     │
   │     ├── Exception (d)(1) — Active transaction/relationship?
   │     │     └── [Is the consumer's transaction/service still active?]
   │     │           ├── Yes ──► RETAIN (document: active relationship)
   │     │           └── No ──► DELETE (transaction complete)
   │     │
   │     ├── Exception (d)(2) — Security?
   │     │     └── [Is data part of active security investigation?]
   │     │           ├── Yes ──► RETAIN (document: investigation ref)
   │     │           └── No ──► DELETE
   │     │
   │     ├── Exception (d)(7) — Legal obligation?
   │     │     └── [Is there a specific statutory retention requirement?]
   │     │           ├── Yes ──► RETAIN (document: cite statute + period)
   │     │           └── No ──► DELETE
   │     │
   │     └── [Other exceptions: assess per criteria above]
   │
   ▼
[Partial Deletion Decision]
   - Delete all categories where no exception applies
   - Retain categories where valid exception applies
   - Document each retained category with exception citation
   - Inform consumer of partial deletion with explanation

[Deletion Request Received]
         │
         ▼
[Does consumer have an account?]
   │
   ├── Yes ──► [Is consumer logged in?]
   │             ├── Yes ──► Verified (account-based)
   │             └── No ──► Request login; if unable, proceed to non-account verification
   │
   └── No ──► [Non-account verification]
               │
               ├── [Request 2 data points for standard verification]
               │     ├── Match ──► Verified
               │     └── No match ──► Request additional data or deny (document reason)
               │
               └── [If sensitive data or high-risk deletion]
                     ├── [Request 3 data points + signed declaration]
                     ├── Match ──► Verified
                     └── No match ──► Deny with right to appeal

DELETION REQUEST RESPONSE — Orion Data Vault Corp
---------------------------------------------------
Consumer Reference: DEL-CA-2026-0089
Request Date: [YYYY-MM-DD]
Verification Date: [YYYY-MM-DD]
Response Date: [YYYY-MM-DD]

STATUS: [Completed / Partially Completed / Denied]

PERSONAL INFORMATION DELETED:
- Category 1: [Description] — DELETED from business systems
- Category 2: [Description] — DELETED from business systems
- Category 3: [Description] — DELETED from business systems

SERVICE PROVIDERS/CONTRACTORS DIRECTED TO DELETE:
- [Service Provider Name] — Directed [date], confirmed [date]
- [Contractor Name] — Directed [date], confirmed [date]

THIRD PARTIES NOTIFIED (if PI was sold or shared):
- [Third Party Name] — Notified [date]

EXCEPTIONS APPLIED (if any):
- Category [X]: Retained under §1798.105(d)(7) — legal obligation
  (Specific statute: [cite statute and retention period])
- Category [Y]: Retained under §1798.105(d)(1) — active transaction
  (Transaction expected to complete: [date])

CONSUMER RIGHTS:
- You may appeal this decision by contacting [contact information]
- You may file a complaint with the California Privacy Protection Agency
  at [CPPA contact information]
- This deletion does not prevent you from exercising other rights under
  the CCPA, including the right to know and the right to opt-out

CCPA SERVICE PROVIDER ADDENDUM — Key Clauses
----------------------------------------------

1. DELETION OBLIGATIONS
   Service Provider shall, upon receipt of direction from Business to
   delete a consumer's personal information:
   (a) Delete the personal information from its systems within [15]
       business days of receiving the direction;
   (b) Direct any sub-service providers to delete the personal information;
   (c) Confirm deletion to Business in writing within [20] business days;
   (d) Retain no copies of the deleted personal information except as
       permitted by an applicable exception under Cal. Civ. Code §1798.105(d).

2. EXCEPTION NOTIFICATION
   If Service Provider determines that an exception under §1798.105(d)
   applies to any portion of the personal information, Service Provider
   shall notify Business within [5] business days, specifying the exception
   relied upon, the categories of personal information affected, and the
   expected retention period.

3. AUDIT RIGHTS
   Business shall have the right to audit Service Provider's deletion
   processes and verify that deletion has been completed as directed.

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references, assets) in skills/privacy/ccpa-right-to-delete of mukul975/Privacy-Data-Protection-Skills.

• SKILL.md
• assets/template.md
• references/standards.md
• references/workflows.md
• scripts/process.py

Open the folder on GitHubat commit 9b2ef9e