New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Implementing Gdpr Data Protection Controls

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer…

Apache-2.0Auto-check passedLegal & Compliance

Install Implementing Gdpr Data Protection Controls

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-gdpr-data-protection-controls -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills implementing-gdpr-data-protection-controls --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/implementing-gdpr-data-protection-controls .claude/skills/implementing-gdpr-data-protection-controls && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
implementing-gdpr-data-protection-controls
GitHub stars
34k
Token cost
~2.1k tokens
SKILL.md length
936 words
Files
8 (incl. scripts, references, assets)
Skills in repo
637
Repo updated
First seen
Licence
Apache-2.0

At a glance

Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer…

  • Works in 6 steps: Data Mapping and Assessment (Weeks 1-6) → Gap Analysis and Risk Assessment (Weeks… → Technical Controls Implementation (Weeks… → …
  • Auditing GDPR controls
  • SKILL.md covers Overview, When to Use, Prerequisites and Core Concepts, plus 4 more sections
  • Runs Python scripts from its folder

What it does

Implementing Gdpr Data Protection Controls is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer mechanisms (SCCs, BCRs, adequacy). Use when designing or auditing GDPR controls, building a DPIA, handling data subject access/erasure requests, or assessing cross-border data transfers.

Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Legal & Compliance, covering Privacy and GDPR. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Auditing GDPR controls
  • Building a DPIA
  • Handling data subject access/erasure requests
  • Assessing cross-border data transfers

Example prompts

  • “Use the implementing-gdpr-data-protection-controls skill to implement GDPR (EU 2016/679) technical and organizational measures — privacy by…”
  • “/implementing-gdpr-data-protection-controls”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Data Mapping and Assessment (Weeks 1-6)
  2. Gap Analysis and Risk Assessment (Weeks 7-10)
  3. Technical Controls Implementation (Weeks 11-24)
  4. Organizational Controls (Weeks 11-24)
  5. Documentation and Compliance Evidence (Weeks 25-30)
  6. Ongoing Compliance (Continuous)

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • gdpr-info.eu

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Implementing Gdpr Data Protection Controls loads about 2.1k tokens when it runs, and up to ~5.8k if it reads all its reference files. Until then it costs about 105 tokens; SKILL.md has 936 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~105
When it runs · the whole SKILL.md, loaded when a task matches
~2.1k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~5.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 936 words, ~2,129 tokens.

Download SKILL.mdSave it as .claude/skills/implementing-gdpr-data-protection-controls/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
implementing-gdpr-data-protection-controls
description
Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer mechanisms (SCCs, BCRs, adequacy). Use when designing or auditing GDPR controls, building a DPIA, handling data subject access/erasure requests, or assessing cross-border data transfers.
domain
cybersecurity
subdomain
compliance-governance
tags
compliance, governance, gdpr, privacy, data-protection, eu-regulation
nist_csf
GV.OC-02, GV.PO-01, PR.DS-01, PR.AA-01, ID.AM-02
version
1.0
author
mahipal
license
Apache-2.0
nist_ai_rmf
MEASURE-2.7, MAP-5.1, MANAGE-2.4, MEASURE-2.8, MEASURE-2.9
atlas_techniques
AML.T0070, AML.T0066, AML.T0082
mitre_attack
T1078, T1530, T1685.002

Implementing GDPR Data Protection Controls

Overview

The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill covers implementing the technical and organizational measures required by GDPR, including data protection by design and by default, Data Protection Impact Assessments (DPIAs), data subject rights management, breach notification procedures, and cross-border data transfer mechanisms.

When to Use

  • When deploying or configuring implementing gdpr data protection controls capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Understanding of EU data protection law and its territorial scope
  • Knowledge of personal data processing activities within the organization
  • Familiarity with data architecture, databases, and application systems
  • Understanding of data flows including cross-border transfers

Core Concepts

Key GDPR Articles for Technical Controls
ArticleRequirement
Art. 5Principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability
Art. 6Lawful basis for processing (consent, contract, legal obligation, vital interests, public task, legitimate interest)
Art. 25Data protection by design and by default
Art. 28Processor obligations and contractual requirements
Art. 30Records of processing activities (ROPA)
Art. 32Security of processing (technical and organizational measures)
Art. 33Breach notification to supervisory authority (72 hours)
Art. 34Communication of breach to data subjects
Art. 35Data Protection Impact Assessment (DPIA)
Art. 37-39Data Protection Officer (DPO) appointment and role
Art. 44-49Cross-border data transfers (adequacy, SCCs, BCRs)
Article 32 Security Measures

The regulation requires organizations to implement measures appropriate to the risk:

  • Pseudonymization and encryption of personal data
  • Confidentiality, integrity, availability, and resilience of processing systems
  • Ability to restore availability and access to personal data in a timely manner
  • Regular testing and evaluation of technical and organizational measures
Data Subject Rights (Articles 12-22)
RightArticleDescription
Right to be informed13-14Transparent information about processing
Right of access15Obtain copy of personal data
Right to rectification16Correct inaccurate data
Right to erasure17"Right to be forgotten"
Right to restrict processing18Limit processing of data
Right to data portability20Receive data in machine-readable format
Right to object21Object to processing (especially direct marketing)
Automated decision-making22Not be subject to solely automated decisions

Workflow

Phase 1: Data Mapping and Assessment (Weeks 1-6)
  1. Create comprehensive data inventory:
    • What personal data is collected
    • From whom (data subjects)
    • Why (purposes and lawful bases)
    • Where it's stored (systems, locations, countries)
    • Who has access (internal and external)
    • How long it's retained
    • What security measures protect it
  2. Document Records of Processing Activities (ROPA) per Article 30
  3. Identify lawful basis for each processing activity
  4. Map cross-border data transfers and transfer mechanisms
  5. Identify processing activities requiring DPIA
Phase 2: Gap Analysis and Risk Assessment (Weeks 7-10)
  1. Assess current state against GDPR requirements
  2. Perform DPIAs for high-risk processing activities
  3. Identify security gaps in Article 32 compliance
  4. Evaluate data retention compliance
  5. Assess data subject rights request handling capabilities
Show full SKILL.md (422 more words)Show less
Phase 3: Technical Controls Implementation (Weeks 11-24)
  1. Encryption:
    • Data at rest: AES-256 for databases, file systems, backups
    • Data in transit: TLS 1.2+ for all personal data transfers
    • Key management: secure key storage and rotation procedures
  2. Pseudonymization:
    • Implement tokenization for sensitive identifiers
    • Separate pseudonymization keys from data stores
  3. Access Controls:
    • Role-based access control (RBAC) for personal data
    • Principle of least privilege
    • MFA for systems processing personal data
    • Regular access reviews
  4. Data Minimization:
    • Implement data collection limits at application layer
    • Default privacy settings (data protection by default)
    • Automated data retention enforcement
  5. Erasure and Portability:
    • Build data deletion workflows across all systems
    • Implement data export in machine-readable formats (JSON, CSV)
    • Cascade deletion to backups and archives
  6. Consent Management:
    • Implement granular consent collection mechanisms
    • Consent withdrawal functionality
    • Consent audit trail and versioning
  7. Breach Detection:
    • SIEM for personal data access monitoring
    • Data loss prevention (DLP) controls
    • Anomalous access detection
Phase 4: Organizational Controls (Weeks 11-24)
  1. Appoint Data Protection Officer (DPO) if required
  2. Develop data protection policies and procedures
  3. Create breach notification procedures (72-hour timeline)
  4. Establish data subject request (DSR) handling procedures
  5. Implement vendor management with Data Processing Agreements (DPAs)
  6. Deploy privacy awareness training for all staff
  7. Create data protection by design guidance for development teams
Phase 5: Documentation and Compliance Evidence (Weeks 25-30)
  1. Finalize ROPA documentation
  2. Document all DPIAs and outcomes
  3. Create data protection policies
  4. Document technical and organizational measures
  5. Establish privacy notice and consent records
  6. Create international transfer documentation (SCCs, TIAs)
Phase 6: Ongoing Compliance (Continuous)
  1. Regular DPIA reviews for new processing activities
  2. Annual data mapping refresh
  3. Periodic security measure testing (Art. 32 requirement)
  4. Data subject request tracking and SLA monitoring
  5. Breach response readiness testing
  6. Training refresh and awareness campaigns

Key Artifacts

  • Records of Processing Activities (ROPA)
  • Data Protection Impact Assessments (DPIAs)
  • Data Processing Agreements (DPAs)
  • Privacy Notices and Consent Records
  • Breach Response Procedures and Register
  • Data Subject Request Handling Procedures
  • International Data Transfer Mechanisms (SCCs, BCRs)
  • Technical and Organizational Measures Documentation

Common Pitfalls

  • Treating GDPR as only a legal/compliance exercise without technical implementation
  • Incomplete data mapping missing shadow IT or legacy systems
  • Failing to maintain consent audit trails
  • Not testing 72-hour breach notification capability
  • Ignoring cross-border transfer requirements for cloud services
  • Over-reliance on consent as lawful basis when legitimate interest applies

References

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/implementing-gdpr-data-protection-controls of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Implementing Gdpr Data Protection Controls next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Implementing Gdpr Data Protection Controls compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Implementing Gdpr Data Protection Controls this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2.1kAutomated safety check: PassApache-2.0
C15tc15t/c15t1.9k1 repos~1.6kAutomated safety check: PassApache-2.0
HIPAA Safe Harbor Coverage Auditmaziyarpanahi/openmed5.5k—~1.7kAutomated safety check: PassApache-2.0
Korean Privacy Termskimlawtech/korean-privacy-terms586—~2.9kAutomated safety check: PassApache-2.0
Gdpr ComplianceSushegaad/Claude-Skills-Governance-Risk-and-Compliance9421 repos~3.9kAutomated safety check: PassMIT
Hipaa ComplianceSushegaad/Claude-Skills-Governance-Risk-and-Compliance9421 repos~2.3kAutomated safety check: PassMIT

Similar skills

  • C15t

    c15t/c15t

    Work with c15t consent management docs, APIs, and integrations for Next.js, React, and JavaScript.

    1.9k GitHub starsUsed in 1 repo~1.6k tokens
    Legal & ComplianceAuto-check passed

  • HIPAA Safe Harbor Coverage Audit

    maziyarpanahi/openmed

    Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.

    5.5k GitHub stars~1.7k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed

  • Korean Privacy Terms

    kimlawtech/korean-privacy-terms

    처리방침·이용약관 자동 생성 스킬 패키지 (v4.0). An agent skill from kimlawtech/korean-privacy-terms.

    586 GitHub stars~2.9k tokensUpdated 1 mo ago
    Legal & ComplianceAuto-check passed

  • Gdpr Compliance

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    Expert GDPR compliance assistant covering all four core workflows: (1) auditing code and systems for GDPR violations, (2) drafting GDPR-compliant documents such as privacy policies, Data Processing…

    942 GitHub starsUsed in 1 repo~3.9k tokens
    Legal & ComplianceAuto-check passed

  • Hipaa Compliance

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    Expert HIPAA compliance assistant for healthcare and software contexts.

    942 GitHub starsUsed in 1 repo~2.3k tokens
    Legal & ComplianceAuto-check passed

  • Pii Contract Analyze

    gregmos/PII-Shield

    Universal legal document processor with PII anonymization. An agent skill from gregmos/PII-Shield.

    149 GitHub stars~8.9k tokensUpdated 3 mo ago
    Legal & ComplianceAuto-check: notes

More from mukul975/Anthropic-Cybersecurity-Skills

All 637 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Implementing Gdpr Data Protection Controls

What does Implementing Gdpr Data Protection Controls do?

Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer…. Implementing Gdpr Data Protection Controls is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer mechanisms (SCCs, BCRs, adequacy).

When should I use Implementing Gdpr Data Protection Controls?

Implementing Gdpr Data Protection Controls fits situations like: auditing GDPR controls; building a DPIA; handling data subject access/erasure requests; assessing cross-border data transfers.

How do I install Implementing Gdpr Data Protection Controls in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-gdpr-data-protection-controls -a claude-code`. Or copy the skill folder (skills/implementing-gdpr-data-protection-controls in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/implementing-gdpr-data-protection-controls in your project. Claude Code loads it when a task matches its description.

How do I install Implementing Gdpr Data Protection Controls in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-gdpr-data-protection-controls -a codex`. Or copy the skill folder (skills/implementing-gdpr-data-protection-controls in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/implementing-gdpr-data-protection-controls in your project. Codex loads it when a task matches its description.

Can I use Implementing Gdpr Data Protection Controls in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-gdpr-data-protection-controls -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/implementing-gdpr-data-protection-controls, .gemini/skills/implementing-gdpr-data-protection-controls, .github/skills/implementing-gdpr-data-protection-controls and .opencode/skills/implementing-gdpr-data-protection-controls in your project.

What does Implementing Gdpr Data Protection Controls need to run?

Going by SKILL.md and its folder, Implementing Gdpr Data Protection Controls needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Implementing Gdpr Data Protection Controls access the network?

SKILL.md names 1 domain. As links in the text: gdpr-info.eu. This is read from the text; nothing was executed.

Is Implementing Gdpr Data Protection Controls safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Implementing Gdpr Data Protection Controls use?

Implementing Gdpr Data Protection Controls is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Implementing Gdpr Data Protection Controls use?

About 2.1k tokens (SKILL.md is roughly 8.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 3.7k tokens, read only when the agent opens those files.

What are the alternatives to Implementing Gdpr Data Protection Controls?

Skills that share tags, products or a category with Implementing Gdpr Data Protection Controls: C15t (c15t/c15t, 1.9k stars), HIPAA Safe Harbor Coverage Audit (maziyarpanahi/openmed, 5.5k stars), Korean Privacy Terms (kimlawtech/korean-privacy-terms, 586 stars) and Gdpr Compliance (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 942 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Implementing Gdpr Data Protection Controls?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,922 GitHub stars. The repository holds 637 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.