Agent skill

Gdpr Valid Consent

by mukul975 in mukul975/Privacy-Data-Protection-Skills

Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition.

Apache-2.0Auto-check passedLegal & Compliance

Install Gdpr Valid Consent

skills CLI
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Privacy-Data-Protection-Skills gdpr-valid-consent --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/privacy/gdpr-valid-consent .claude/skills/gdpr-valid-consent && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
gdpr-valid-consent
GitHub stars
297
Token cost
~2.2k tokens
SKILL.md length
1,139 words
Files
5 (incl. scripts, references, assets)
Skills in repo
280
Repo updated
First seen
Licence
Apache-2.0

At a glance

Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition.

  • Works in 5 steps: Freely Given (Article 7(4), Recitals… → Specific (Article 6(1)(a), Recital 32) → Informed (Article 13, Recitals 42, 60) → …
  • Tasks that involve Privacy and GDPR
  • SKILL.md covers Overview, The Five Requirements of Valid…, Consent Form Audit Checklist and Implementation Workflow, plus 1 more section
  • Runs Python scripts from its folder

What it does

Gdpr Valid Consent is an agent skill from mukul975/Privacy-Data-Protection-Skills. Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition. Covers five core requirements: freely given, specific, informed, unambiguous, and clear affirmative action. Includes pre-ticked boxes prohibition per Planet49 CJEU C-673/17, consent form audit checklist, and practical implementation patterns.

Its SKILL.md is about 2.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/standards.md` and `references/workflows.md`).

It sits in Legal & Compliance, covering Privacy and GDPR and Audit readiness. The repository describes itself as: 282+ structured privacy & data protection skills for AI agents. GDPR, CCPA, EU AI Act, HIPAA, LGPD, PIPL, DPDP Act. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Privacy and GDPR
  • Tasks that involve Audit readiness

Example prompts

  • “/gdpr-valid-consent”

Requirements

  • Python 3

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Freely Given (Article 7(4), Recitals 42-43)
  2. Specific (Article 6(1)(a), Recital 32)
  3. Informed (Article 13, Recitals 42, 60)
  4. Unambiguous Indication
  5. Clear Affirmative Action (Article 4(11), Recital 32)

What it can do on your machine

Read from SKILL.md and the folder at commit 9b2ef9e. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Gdpr Valid Consent loads about 2.2k tokens when it runs, and up to ~4.4k if it reads all its reference files. Until then it costs about 90 tokens; SKILL.md has 1,139 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~90
When it runs · the whole SKILL.md, loaded when a task matches
~2.2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Privacy-Data-Protection-Skills at commit 9b2ef9e, republished under its Apache-2.0 licence (© mukul975). 1,139 words, ~2,242 tokens.

Download SKILL.mdSave it as .claude/skills/gdpr-valid-consent/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.
name
gdpr-valid-consent
description
Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition. Covers five core requirements: freely given, specific, informed, unambiguous, and clear affirmative action. Includes pre-ticked boxes prohibition per Planet49 CJEU C-673/17, consent form audit checklist, and practical implementation patterns.
license
Apache-2.0
metadata.author
mukul975
metadata.version
1.0
metadata.domain
privacy
metadata.subdomain
consent-management
metadata.tags
gdpr-consent, article-7, valid-consent, affirmative-action, consent-audit

Overview

Valid consent under the GDPR is defined in Article 4(11) as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her." Article 7 sets out the conditions for consent, and Recital 32 clarifies that silence, pre-ticked boxes, or inactivity do not constitute consent.

The Court of Justice of the European Union (CJEU) reinforced this in Case C-673/17 (Planet49 GmbH, October 1, 2019), ruling that pre-ticked checkboxes do not constitute valid consent for placing cookies, and that consent must be specific to each processing purpose.

1. Freely Given (Article 7(4), Recitals 42-43)

Consent is not freely given if:

  • There is a clear imbalance between the data subject and the controller (e.g., employer-employee relationships, public authority-citizen relationships)
  • Consent is bundled as a non-negotiable condition of a service (the "conditionality test" under Article 7(4))
  • The data subject suffers detriment for refusing or withdrawing consent
  • There is no genuine choice or the individual feels compelled to consent

CloudVault SaaS Inc. Implementation: CloudVault SaaS Inc. separates consent for core cloud storage services from consent for analytics and marketing. Users who decline marketing consent retain full access to storage functionality. The sign-up flow explicitly states: "Declining optional data processing will not affect your access to CloudVault storage services."

2. Specific (Article 6(1)(a), Recital 32)

Consent must be:

  • Granular: separate consent for each distinct purpose
  • Named: the controller and any third-party controllers must be specifically identified
  • Purpose-limited: clearly linked to a defined processing purpose

CloudVault SaaS Inc. Implementation: CloudVault SaaS Inc. presents three separate consent requests during onboarding:

  • "Allow CloudVault SaaS Inc. to analyze your file usage patterns to recommend storage optimization" (Purpose: Service improvement)
  • "Allow CloudVault SaaS Inc. to send you product update emails" (Purpose: Direct marketing)
  • "Allow CloudVault SaaS Inc. to share anonymized usage statistics with Datalytics Partners Ltd. for industry benchmarking" (Purpose: Third-party analytics)
3. Informed (Article 13, Recitals 42, 60)

Before consenting, the data subject must be told at minimum:

  • The identity of the controller (CloudVault SaaS Inc., registered at 42 Innovation Drive, Dublin, D02 YX88, Ireland)
  • The purpose of each processing operation for which consent is sought
  • The type of data collected
  • The right to withdraw consent at any time
  • Information about automated decision-making, including profiling (Article 22(2)(c))
  • Risks of data transfers to third countries without an adequacy decision or appropriate safeguards (relevant if Article 49(1)(a) explicit consent applies)

CloudVault SaaS Inc. Implementation: Each consent request includes a layered notice: a short-form summary visible immediately and a "Learn More" expandable section with full Article 13 information. The language is plain English at a Flesch-Kincaid grade level of 8 or below.

4. Unambiguous Indication

The data subject's intention must be clear. According to Recital 32:

  • Consent requires a clear affirmative act
  • Silence, pre-ticked boxes, or inactivity do not constitute consent (confirmed in CJEU C-673/17 Planet49)
  • Scrolling or continued browsing of a website does not meet this standard (EDPB Guidelines 05/2020, paragraph 86)

CloudVault SaaS Inc. Implementation: CloudVault SaaS Inc. uses unticked checkboxes for each consent purpose. The "Create Account" button is active regardless of consent choices. No default-on toggles are used. The UI state is logged to demonstrate that the user actively engaged each toggle.

5. Clear Affirmative Action (Article 4(11), Recital 32)

Acceptable forms of affirmative action include:

  • Ticking an unticked checkbox
  • Choosing technical settings on an information society service
  • Typing a consent statement
  • Signing a written declaration (including electronic signatures under eIDAS Regulation (EU) No 910/2014)

CloudVault SaaS Inc. Implementation: CloudVault SaaS Inc. records the specific UI interaction (checkbox tick, toggle switch activation) along with a timestamp, the user's session ID, the IP address, the version of the consent text displayed, and the user agent string.

Show full SKILL.md (494 more words)Show less
#Audit ItemGDPR ReferencePass/Fail Criteria
1Consent is separated from terms of serviceArt. 7(2)Consent request is clearly distinguishable from other matters
2No pre-ticked boxes or default-on togglesArt. 4(11), Recital 32, CJEU C-673/17All consent mechanisms start in the "off" state
3Granular consent per purposeRecital 32, EDPB Guidelines 05/2020Separate opt-in for each distinct processing purpose
4Controller identity statedArt. 7(2), Art. 13(1)(a)Full legal name and contact details of data controller visible
5Purpose clearly describedArt. 13(1)(c)Each purpose described in plain language without legal jargon
6Data types specifiedArt. 13(1)(d)Categories of personal data listed for each purpose
7Third-party recipients namedArt. 13(1)(e)Specific third parties (not categories) identified by name
8Withdrawal mechanism explainedArt. 7(3)Clear statement that consent can be withdrawn at any time with instructions
9No detriment for refusalArt. 7(4), Recital 42Service access not conditional on optional consent
10Withdrawal as easy as givingArt. 7(3)Withdrawal requires equal or fewer steps than initial consent
11Age verification presentArt. 8Age gate or verification for services directed at children
12Language is plain and clearArt. 7(2), Recital 42Flesch-Kincaid grade level 8 or below, no legal jargon
13Consent records storedArt. 7(1)Timestamp, version, purpose, mechanism, identity recorded
14Re-consent mechanism for purpose changesArt. 13(3)Process exists to obtain fresh consent when purposes change
15No cookie walls blocking accessEDPB Guidelines 05/2020 para 39Content accessible regardless of cookie consent choices

Implementation Workflow

  1. Map Processing Activities — Identify every processing activity that relies on consent as its lawful basis under Article 6(1)(a). Document the purpose, data categories, recipients, and retention period for each.

  2. Design Consent Mechanism — Create granular, unticked consent controls. Ensure the UI clearly separates each purpose. Follow EDPB Guidelines 05/2020 on consent.

  3. Draft Consent Language — Write concise, plain-language descriptions for each purpose. Include all Article 13 information in a layered format. Test readability at Flesch-Kincaid grade level 8 or below.

  4. Implement Record-Keeping — Build a consent receipt system that captures: timestamp (ISO 8601), consent version hash, purpose identifier, mechanism type (checkbox/toggle/signature), data subject identifier, and the exact text presented.

  5. Build Withdrawal Mechanism — Implement one-click withdrawal accessible from the user's account dashboard. Ensure withdrawal triggers downstream processing cessation within 24 hours.

  6. Run Audit — Use the checklist above to audit the consent implementation. Document findings and remediation actions.

  7. Schedule Re-Audit — Set a recurring audit cadence (quarterly recommended) and after any UI changes that affect consent flows.

Key Regulatory References

  • GDPR Article 4(11) — Definition of consent
  • GDPR Article 6(1)(a) — Consent as lawful basis
  • GDPR Article 7 — Conditions for consent
  • GDPR Article 8 — Conditions applicable to child's consent
  • GDPR Recitals 32, 33, 42, 43 — Guidance on consent requirements
  • CJEU Case C-673/17 (Planet49 GmbH) — Pre-ticked boxes ruling
  • EDPB Guidelines 05/2020 on consent under Regulation 2016/679
  • eIDAS Regulation (EU) No 910/2014 — Electronic signatures for consent

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references, assets) in skills/privacy/gdpr-valid-consent of mukul975/Privacy-Data-Protection-Skills.

  • SKILL.md
  • assets/template.md
  • references/standards.md
  • references/workflows.md
  • scripts/process.py

Open the folder on GitHubat commit 9b2ef9e

Compare with similar skills

Gdpr Valid Consent next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Gdpr Valid Consent compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Gdpr Valid Consent this skillmukul975/Privacy-Data-Protection-Skills297—~2.2kAutomated safety check: PassApache-2.0
HIPAA Safe Harbor Coverage Auditmaziyarpanahi/openmed5.5k—~1.7kAutomated safety check: PassApache-2.0
Compliance Osalirezarezvani/claude-skills28k—~3.3kAutomated safety check: PassMIT
Implementing Complianceancoleman/ai-design-components526—~4kAutomated safety check: PassMIT
Compliance Checklistmohitagw15856/pm-claude-skills1.4k—~1.2kAutomated safety check: PassMIT
Compliance Checklist Generationseb1n/awesome-ai-agent-skills206—~2.5kAutomated safety check: PassMIT

Similar skills

  • Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.

    5.5k GitHub stars~1.7k tokensUpdated today
    Legal & ComplianceAuto-check passed
  • Compliance Os

    alirezarezvani/claude-skills

    Compliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across…

    28k GitHub stars~3.3k tokensUpdated 1 mo ago
    Legal & ComplianceAuto-check passed
  • Implementing Compliance

    ancoleman/ai-design-components

    Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection.

    526 GitHub stars~4k tokensUpdated 10 mo ago
    Legal & ComplianceAuto-check passed
  • Compliance Checklist

    mohitagw15856/pm-claude-skills

    Generate a prioritised compliance checklist for GDPR, SOC 2, ISO 27001, FCA, HIPAA, or other frameworks with a gap analysis.

    1.4k GitHub stars~1.2k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed
  • Compliance Checklist Generation

    seb1n/awesome-ai-agent-skills

    Build evidence-oriented readiness checklists for frameworks such as SOC 2, HIPAA, PCI DSS, and GDPR, with gaps and remediation priorities.

    206 GitHub stars~2.5k tokensUpdated 2 mo ago
    Legal & ComplianceAuto-check passed
  • C15t

    c15t/c15t

    Work with c15t consent management docs, APIs, and integrations for Next.js, React, and JavaScript.

    1.9k GitHub starsUsed in 1 repo~1.6k tokens
    Legal & ComplianceAuto-check passed

More from mukul975/Privacy-Data-Protection-Skills

All 280 skills in this repo
  • Age Gating Services

    mukul975/Privacy-Data-Protection-Skills

    Implements age-gating mechanisms for online services to restrict access based on user age.

    297 GitHub stars~3.7k tokensUpdated 6 mo ago
    Auto-check passed
  • AI Data Retention

    mukul975/Privacy-Data-Protection-Skills

    Manages AI model retention and machine unlearning requirements.

    297 GitHub stars~1.9k tokensUpdated 6 mo ago
    Auto-check passed
  • AI Dpia

    mukul975/Privacy-Data-Protection-Skills

    Conducts Data Protection Impact Assessments for AI and ML systems per EDPB Guidelines 04/2025 on AI processing.

    297 GitHub stars~3.4k tokensUpdated 6 mo ago
    Auto-check passed
  • Dpia Mitigation Plan

    mukul975/Privacy-Data-Protection-Skills

    Structures risk mitigation planning and residual risk tracking for Data Protection Impact Assessments under GDPR Article 35(7)(d).

    297 GitHub stars~846 tokensUpdated 6 mo ago
    Auto-check passed
  • Gdpr Accountability

    mukul975/Privacy-Data-Protection-Skills

    Guides implementation of the GDPR accountability principle under Articles 5(2) and 24, including documentation requirements for policies, DPIAs, RoPA, training records, and breach logs.

    297 GitHub stars~1.9k tokensUpdated 6 mo ago
    Auto-check passed
  • Pia Threshold Screening

    mukul975/Privacy-Data-Protection-Skills

    Conducts pre-DPIA threshold screening to determine whether a full Data Protection Impact Assessment is required under GDPR Article 35.

    297 GitHub stars~880 tokensUpdated 6 mo ago
    Auto-check passed

Questions about Gdpr Valid Consent

What does Gdpr Valid Consent do?

Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition. Gdpr Valid Consent is an agent skill from mukul975/Privacy-Data-Protection-Skills. Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition.

When should I use Gdpr Valid Consent?

Gdpr Valid Consent fits situations like: tasks that involve Privacy and GDPR; tasks that involve Audit readiness.

How do I install Gdpr Valid Consent in Claude Code?

Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a claude-code`. Or copy the skill folder (skills/privacy/gdpr-valid-consent in mukul975/Privacy-Data-Protection-Skills) into .claude/skills/gdpr-valid-consent in your project. Claude Code loads it when a task matches its description.

How do I install Gdpr Valid Consent in Codex?

Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a codex`. Or copy the skill folder (skills/privacy/gdpr-valid-consent in mukul975/Privacy-Data-Protection-Skills) into .agents/skills/gdpr-valid-consent in your project. Codex loads it when a task matches its description.

Can I use Gdpr Valid Consent in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/gdpr-valid-consent, .gemini/skills/gdpr-valid-consent, .github/skills/gdpr-valid-consent and .opencode/skills/gdpr-valid-consent in your project.

What does Gdpr Valid Consent need to run?

Going by SKILL.md and its folder, Gdpr Valid Consent needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Gdpr Valid Consent access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Gdpr Valid Consent safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Gdpr Valid Consent use?

Gdpr Valid Consent is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Gdpr Valid Consent use?

About 2.2k tokens (SKILL.md is roughly 9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.2k tokens, read only when the agent opens those files.

What are the alternatives to Gdpr Valid Consent?

Skills that share tags, products or a category with Gdpr Valid Consent: HIPAA Safe Harbor Coverage Audit (maziyarpanahi/openmed, 5.5k stars), Compliance Os (alirezarezvani/claude-skills, 28k stars), Implementing Compliance (ancoleman/ai-design-components, 526 stars) and Compliance Checklist (mohitagw15856/pm-claude-skills, 1.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Gdpr Valid Consent?

mukul975 (a GitHub user) maintains it in mukul975/Privacy-Data-Protection-Skills, which has 297 GitHub stars. The repository holds 280 skills in this directory. The repository was last updated on March 16, 2026.

Source: mukul975/Privacy-Data-Protection-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.