HIPAA Safe Harbor Coverage Audit
maziyarpanahi/openmed
Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.
Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills gdpr-valid-consent --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/privacy/gdpr-valid-consent .claude/skills/gdpr-valid-consent && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "gdpr-valid-consent" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/gdpr-valid-consent into .claude/skills/gdpr-valid-consent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gdpr-valid-consent", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/gdpr-valid-consentType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills gdpr-valid-consent --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/privacy/gdpr-valid-consent .agents/skills/gdpr-valid-consent && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "gdpr-valid-consent" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/gdpr-valid-consent into .agents/skills/gdpr-valid-consent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gdpr-valid-consent", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills gdpr-valid-consent --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/privacy/gdpr-valid-consent .cursor/skills/gdpr-valid-consent && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "gdpr-valid-consent" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/gdpr-valid-consent into .cursor/skills/gdpr-valid-consent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gdpr-valid-consent", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/mukul975/Privacy-Data-Protection-Skills.git --path skills/privacy/gdpr-valid-consent--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills gdpr-valid-consent --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/privacy/gdpr-valid-consent .gemini/skills/gdpr-valid-consent && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "gdpr-valid-consent" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/gdpr-valid-consent into .gemini/skills/gdpr-valid-consent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gdpr-valid-consent", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install mukul975/Privacy-Data-Protection-Skills gdpr-valid-consentInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/privacy/gdpr-valid-consent .github/skills/gdpr-valid-consent && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "gdpr-valid-consent" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/gdpr-valid-consent into .github/skills/gdpr-valid-consent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gdpr-valid-consent", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills gdpr-valid-consent --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/privacy/gdpr-valid-consent .opencode/skills/gdpr-valid-consent && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "gdpr-valid-consent" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/gdpr-valid-consent into .opencode/skills/gdpr-valid-consent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "gdpr-valid-consent", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
gdpr-valid-consentGuide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition.
Gdpr Valid Consent is an agent skill from mukul975/Privacy-Data-Protection-Skills. Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition. Covers five core requirements: freely given, specific, informed, unambiguous, and clear affirmative action. Includes pre-ticked boxes prohibition per Planet49 CJEU C-673/17, consent form audit checklist, and practical implementation patterns.
Its SKILL.md is about 2.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/standards.md` and `references/workflows.md`).
It sits in Legal & Compliance, covering Privacy and GDPR and Audit readiness. The repository describes itself as: 282+ structured privacy & data protection skills for AI agents. GDPR, CCPA, EU AI Act, HIPAA, LGPD, PIPL, DPDP Act. The licence is Apache-2.0.
5 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit 9b2ef9e. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Ships 1 file in scripts/ (Python), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Gdpr Valid Consent loads about 2.2k tokens when it runs, and up to ~4.4k if it reads all its reference files. Until then it costs about 90 tokens; SKILL.md has 1,139 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
The full file from mukul975/Privacy-Data-Protection-Skills at commit 9b2ef9e, republished under its Apache-2.0 licence (© mukul975). 1,139 words, ~2,242 tokens.
.claude/skills/gdpr-valid-consent/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.Valid consent under the GDPR is defined in Article 4(11) as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her." Article 7 sets out the conditions for consent, and Recital 32 clarifies that silence, pre-ticked boxes, or inactivity do not constitute consent.
The Court of Justice of the European Union (CJEU) reinforced this in Case C-673/17 (Planet49 GmbH, October 1, 2019), ruling that pre-ticked checkboxes do not constitute valid consent for placing cookies, and that consent must be specific to each processing purpose.
Consent is not freely given if:
CloudVault SaaS Inc. Implementation: CloudVault SaaS Inc. separates consent for core cloud storage services from consent for analytics and marketing. Users who decline marketing consent retain full access to storage functionality. The sign-up flow explicitly states: "Declining optional data processing will not affect your access to CloudVault storage services."
Consent must be:
CloudVault SaaS Inc. Implementation: CloudVault SaaS Inc. presents three separate consent requests during onboarding:
Before consenting, the data subject must be told at minimum:
CloudVault SaaS Inc. Implementation: Each consent request includes a layered notice: a short-form summary visible immediately and a "Learn More" expandable section with full Article 13 information. The language is plain English at a Flesch-Kincaid grade level of 8 or below.
The data subject's intention must be clear. According to Recital 32:
CloudVault SaaS Inc. Implementation: CloudVault SaaS Inc. uses unticked checkboxes for each consent purpose. The "Create Account" button is active regardless of consent choices. No default-on toggles are used. The UI state is logged to demonstrate that the user actively engaged each toggle.
Acceptable forms of affirmative action include:
CloudVault SaaS Inc. Implementation: CloudVault SaaS Inc. records the specific UI interaction (checkbox tick, toggle switch activation) along with a timestamp, the user's session ID, the IP address, the version of the consent text displayed, and the user agent string.
| # | Audit Item | GDPR Reference | Pass/Fail Criteria |
|---|---|---|---|
| 1 | Consent is separated from terms of service | Art. 7(2) | Consent request is clearly distinguishable from other matters |
| 2 | No pre-ticked boxes or default-on toggles | Art. 4(11), Recital 32, CJEU C-673/17 | All consent mechanisms start in the "off" state |
| 3 | Granular consent per purpose | Recital 32, EDPB Guidelines 05/2020 | Separate opt-in for each distinct processing purpose |
| 4 | Controller identity stated | Art. 7(2), Art. 13(1)(a) | Full legal name and contact details of data controller visible |
| 5 | Purpose clearly described | Art. 13(1)(c) | Each purpose described in plain language without legal jargon |
| 6 | Data types specified | Art. 13(1)(d) | Categories of personal data listed for each purpose |
| 7 | Third-party recipients named | Art. 13(1)(e) | Specific third parties (not categories) identified by name |
| 8 | Withdrawal mechanism explained | Art. 7(3) | Clear statement that consent can be withdrawn at any time with instructions |
| 9 | No detriment for refusal | Art. 7(4), Recital 42 | Service access not conditional on optional consent |
| 10 | Withdrawal as easy as giving | Art. 7(3) | Withdrawal requires equal or fewer steps than initial consent |
| 11 | Age verification present | Art. 8 | Age gate or verification for services directed at children |
| 12 | Language is plain and clear | Art. 7(2), Recital 42 | Flesch-Kincaid grade level 8 or below, no legal jargon |
| 13 | Consent records stored | Art. 7(1) | Timestamp, version, purpose, mechanism, identity recorded |
| 14 | Re-consent mechanism for purpose changes | Art. 13(3) | Process exists to obtain fresh consent when purposes change |
| 15 | No cookie walls blocking access | EDPB Guidelines 05/2020 para 39 | Content accessible regardless of cookie consent choices |
Map Processing Activities — Identify every processing activity that relies on consent as its lawful basis under Article 6(1)(a). Document the purpose, data categories, recipients, and retention period for each.
Design Consent Mechanism — Create granular, unticked consent controls. Ensure the UI clearly separates each purpose. Follow EDPB Guidelines 05/2020 on consent.
Draft Consent Language — Write concise, plain-language descriptions for each purpose. Include all Article 13 information in a layered format. Test readability at Flesch-Kincaid grade level 8 or below.
Implement Record-Keeping — Build a consent receipt system that captures: timestamp (ISO 8601), consent version hash, purpose identifier, mechanism type (checkbox/toggle/signature), data subject identifier, and the exact text presented.
Build Withdrawal Mechanism — Implement one-click withdrawal accessible from the user's account dashboard. Ensure withdrawal triggers downstream processing cessation within 24 hours.
Run Audit — Use the checklist above to audit the consent implementation. Document findings and remediation actions.
Schedule Re-Audit — Set a recurring audit cadence (quarterly recommended) and after any UI changes that affect consent flows.
© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 4 other files (scripts, references, assets) in skills/privacy/gdpr-valid-consent of mukul975/Privacy-Data-Protection-Skills.
Open the folder on GitHubat commit 9b2ef9e
Gdpr Valid Consent next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Gdpr Valid Consent this skillmukul975/Privacy-Data-Protection-Skills | 297 | — | ~2.2k | Automated safety check: Pass | Apache-2.0 | |
| HIPAA Safe Harbor Coverage Auditmaziyarpanahi/openmed | 5.5k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| Compliance Osalirezarezvani/claude-skills | 28k | — | ~3.3k | Automated safety check: Pass | MIT | |
| Implementing Complianceancoleman/ai-design-components | 526 | — | ~4k | Automated safety check: Pass | MIT | |
| Compliance Checklistmohitagw15856/pm-claude-skills | 1.4k | — | ~1.2k | Automated safety check: Pass | MIT | |
| Compliance Checklist Generationseb1n/awesome-ai-agent-skills | 206 | — | ~2.5k | Automated safety check: Pass | MIT |
maziyarpanahi/openmed
Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.
alirezarezvani/claude-skills
Compliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across…
ancoleman/ai-design-components
Implement and maintain compliance with SOC 2, HIPAA, PCI-DSS, and GDPR using unified control mapping, policy-as-code enforcement, and automated evidence collection.
mohitagw15856/pm-claude-skills
Generate a prioritised compliance checklist for GDPR, SOC 2, ISO 27001, FCA, HIPAA, or other frameworks with a gap analysis.
seb1n/awesome-ai-agent-skills
Build evidence-oriented readiness checklists for frameworks such as SOC 2, HIPAA, PCI DSS, and GDPR, with gaps and remediation priorities.
c15t/c15t
Work with c15t consent management docs, APIs, and integrations for Next.js, React, and JavaScript.
mukul975/Privacy-Data-Protection-Skills
Implements age-gating mechanisms for online services to restrict access based on user age.
mukul975/Privacy-Data-Protection-Skills
Manages AI model retention and machine unlearning requirements.
mukul975/Privacy-Data-Protection-Skills
Conducts Data Protection Impact Assessments for AI and ML systems per EDPB Guidelines 04/2025 on AI processing.
mukul975/Privacy-Data-Protection-Skills
Structures risk mitigation planning and residual risk tracking for Data Protection Impact Assessments under GDPR Article 35(7)(d).
mukul975/Privacy-Data-Protection-Skills
Guides implementation of the GDPR accountability principle under Articles 5(2) and 24, including documentation requirements for policies, DPIAs, RoPA, training records, and breach logs.
mukul975/Privacy-Data-Protection-Skills
Conducts pre-DPIA threshold screening to determine whether a full Data Protection Impact Assessment is required under GDPR Article 35.
Categories
Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition. Gdpr Valid Consent is an agent skill from mukul975/Privacy-Data-Protection-Skills. Guide for implementing GDPR-valid consent under Article 7 conditions and Article 4(11) definition.
Gdpr Valid Consent fits situations like: tasks that involve Privacy and GDPR; tasks that involve Audit readiness.
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a claude-code`. Or copy the skill folder (skills/privacy/gdpr-valid-consent in mukul975/Privacy-Data-Protection-Skills) into .claude/skills/gdpr-valid-consent in your project. Claude Code loads it when a task matches its description.
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a codex`. Or copy the skill folder (skills/privacy/gdpr-valid-consent in mukul975/Privacy-Data-Protection-Skills) into .agents/skills/gdpr-valid-consent in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill gdpr-valid-consent -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/gdpr-valid-consent, .gemini/skills/gdpr-valid-consent, .github/skills/gdpr-valid-consent and .opencode/skills/gdpr-valid-consent in your project.
Going by SKILL.md and its folder, Gdpr Valid Consent needs Python for the scripts in its folder. Our summary lists: Python 3.
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
Gdpr Valid Consent is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
About 2.2k tokens (SKILL.md is roughly 9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.2k tokens, read only when the agent opens those files.
Skills that share tags, products or a category with Gdpr Valid Consent: HIPAA Safe Harbor Coverage Audit (maziyarpanahi/openmed, 5.5k stars), Compliance Os (alirezarezvani/claude-skills, 28k stars), Implementing Compliance (ancoleman/ai-design-components, 526 stars) and Compliance Checklist (mohitagw15856/pm-claude-skills, 1.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
mukul975 (a GitHub user) maintains it in mukul975/Privacy-Data-Protection-Skills, which has 297 GitHub stars. The repository holds 280 skills in this directory. The repository was last updated on March 16, 2026.
Source: mukul975/Privacy-Data-Protection-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.