GDPR Article 28(2) sub-processor approval workflow management.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill sub-processor-management -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills sub-processor-management --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/privacy/sub-processor-management .claude/skills/sub-processor-management && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "sub-processor-management" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/sub-processor-management into .claude/skills/sub-processor-management/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sub-processor-management", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/sub-processor-managementType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill sub-processor-management -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills sub-processor-management --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/privacy/sub-processor-management .agents/skills/sub-processor-management && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "sub-processor-management" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/sub-processor-management into .agents/skills/sub-processor-management/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sub-processor-management", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill sub-processor-management -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills sub-processor-management --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/privacy/sub-processor-management .cursor/skills/sub-processor-management && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "sub-processor-management" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/sub-processor-management into .cursor/skills/sub-processor-management/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sub-processor-management", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/mukul975/Privacy-Data-Protection-Skills.git --path skills/privacy/sub-processor-management--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill sub-processor-management -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills sub-processor-management --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/privacy/sub-processor-management .gemini/skills/sub-processor-management && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "sub-processor-management" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/sub-processor-management into .gemini/skills/sub-processor-management/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sub-processor-management", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install mukul975/Privacy-Data-Protection-Skills sub-processor-managementInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill sub-processor-management -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/privacy/sub-processor-management .github/skills/sub-processor-management && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "sub-processor-management" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/sub-processor-management into .github/skills/sub-processor-management/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sub-processor-management", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill sub-processor-management -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills sub-processor-management --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/privacy/sub-processor-management .opencode/skills/sub-processor-management && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "sub-processor-management" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/sub-processor-management into .opencode/skills/sub-processor-management/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sub-processor-management", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
sub-processor-managementGDPR Article 28(2) sub-processor approval workflow management.
Sub Processor Management is an agent skill from mukul975/Privacy-Data-Protection-Skills. GDPR Article 28(2) sub-processor approval workflow management. Covers prior specific and general authorization mechanisms, change notification procedures, objection windows, flow-down obligation enforcement, and sub-processor chain risk monitoring.
Its SKILL.md is about 2.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/standards.md` and `references/workflows.md`).
It sits in Legal & Compliance, covering Privacy and GDPR and Authorization and RBAC. The repository describes itself as: 282+ structured privacy & data protection skills for AI agents. GDPR, CCPA, EU AI Act, HIPAA, LGPD, PIPL, DPDP Act. The licence is Apache-2.0.
5 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 9b2ef9e. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Ships 1 file in scripts/ (Python), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Sub Processor Management loads about 2.5k tokens when it runs, and up to ~5.7k if it reads all its reference files. Until then it costs about 68 tokens; SKILL.md has 1,080 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
The full file from mukul975/Privacy-Data-Protection-Skills at commit 9b2ef9e, republished under its Apache-2.0 licence (© mukul975). 1,080 words, ~2,483 tokens.
.claude/skills/sub-processor-management/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.GDPR Article 28(2) establishes that a processor shall not engage another processor (sub-processor) without prior specific or general written authorisation of the controller. Where general authorisation is granted, the processor must inform the controller of any intended changes concerning the addition or replacement of sub-processors, giving the controller the opportunity to object. This creates an ongoing management obligation that extends through the entire processing chain.
The EDPB Guidelines 07/2020 (paragraph 93) emphasize that the controller's Article 28(1) due diligence obligation extends to oversight of sub-processor arrangements, and that the processor remains fully liable for the sub-processor's compliance.
At Summit Cloud Partners, the Sub-Processor Management Program ensures visibility and control over the entire processing chain for all vendor relationships involving personal data.
Under this model, the controller individually approves each sub-processor before engagement.
When to Use:
Process:
| Step | Action | Timeline |
|---|---|---|
| 1 | Processor identifies need for new sub-processor | — |
| 2 | Processor submits sub-processor details to controller | Pre-engagement |
| 3 | Controller conducts due diligence on proposed sub-processor | 15 business days |
| 4 | Controller issues written approval or rejection | 5 business days |
| 5 | If approved, processor executes sub-processor DPA | Before processing begins |
| 6 | Processor provides controller with confirmation of sub-processor DPA execution | 5 business days |
Under this model, the controller grants blanket authorization for sub-processing, subject to a notification and objection mechanism.
When to Use:
Process:
| Step | Action | Timeline |
|---|---|---|
| 1 | Processor notifies controller of intended sub-processor change | 30 days before engagement |
| 2 | Notification includes: name, location, function, data access scope | With notification |
| 3 | Controller evaluates notification and exercises objection right if needed | Within 14 days |
| 4 | If no objection, processor may engage sub-processor | After objection period expires |
| 5 | If objection raised, parties negotiate resolution | Within 30 days |
| 6 | If unresolved, either party may terminate affected services | Per DPA terms |
The EDPB has clarified that the notification mechanism must be genuine and effective — a mere listing on a website that the controller must monitor does not satisfy Article 28(2) without an active notification mechanism.
Required Notification Content:
| Field | Description | Example |
|---|---|---|
| Sub-processor legal name | Full legal entity name | "Datastream Analytics Inc." |
| Jurisdiction | Country of establishment | "United States (Delaware)" |
| Processing location | Where personal data will be processed | "AWS us-east-1, Virginia, USA" |
| Processing function | What the sub-processor will do | "Real-time event processing and aggregation" |
| Data access scope | What personal data the sub-processor accesses | "Pseudonymized usage events, IP addresses" |
| Engagement date | Proposed start date | "2026-05-01" |
| Transfer mechanism | If outside EEA, the legal transfer basis | "EU-US Data Privacy Framework certification" |
| Security certifications | Relevant certifications held | "SOC 2 Type II, ISO 27001" |
Notification Channels:
The controller's right to object must be genuine per EDPB Guidelines 07/2020 (paragraph 115). The DPA must specify:
Objection Decision Matrix:
| Concern | Action | Escalation |
|---|---|---|
| Sub-processor in jurisdiction with inadequate protection and no valid transfer mechanism | Object — require alternative sub-processor or supplementary measures | DPO review |
| Sub-processor lacks adequate security certifications | Object — request vendor provide evidence of equivalent controls | Privacy Team review |
| Sub-processor has history of data breaches | Object — require enhanced contractual safeguards or alternative | DPO review |
| Sub-processor change is administrative (name change, corporate restructure) | No objection — acknowledge notification | Privacy Team acknowledgment |
| Sub-processor adds processing location within EEA | Evaluate — generally no objection if controls equivalent | Privacy Team review |
Article 28(4) requires the processor to impose on each sub-processor, by contract, the same data protection obligations as in the controller-processor DPA. The CJEU has not yet directly interpreted the meaning of "same" obligations, but the EDPB position is that they must be materially equivalent.
Flow-Down Checklist:
| Obligation | Controller → Processor DPA | Processor → Sub-Processor DPA |
|---|---|---|
| Process only on documented instructions | Article 28(3)(a) | Must mirror |
| Confidentiality obligations | Article 28(3)(b) | Must mirror |
| Security measures (Art. 32) | Article 28(3)(c) | Must mirror or exceed |
| Further sub-processing restrictions | Article 28(3)(d) | Must cascade |
| DSR assistance | Article 28(3)(e) | Must mirror |
| Compliance assistance (Art. 32-36) | Article 28(3)(f) | Must mirror |
| Deletion/return on termination | Article 28(3)(g) | Must mirror |
| Audit rights | Article 28(3)(h) | Must provide controller with audit path |
| Breach notification | Article 33(2) | Must cascade with equivalent or shorter timeframe |
Key Consideration — Audit Rights Chain:
The controller must ultimately be able to audit the sub-processor. This can be achieved through:
Summit Cloud Partners maintains a centralized sub-processor register for all vendor relationships.
Register Fields:
| Field | Description |
|---|---|
| Primary processor | Vendor with direct DPA |
| Sub-processor name | Legal entity name |
| Sub-processor location | Country and specific processing location |
| Processing function | What the sub-processor does |
| Data access scope | Categories of personal data accessed |
| Authorization type | Specific or general authorization |
| Authorization date | Date of approval |
| DPA status | Sub-processor DPA executed / pending |
| Transfer mechanism | If applicable — SCC, adequacy, DPF |
| Certifications | Current certifications |
| Last review date | Most recent assessment |
| Risk classification | High / Standard / Low |
| KPI | Target | Measurement |
|---|---|---|
| Sub-processor notification compliance | 100% of changes notified before engagement | Quarterly audit |
| Objection response time | 100% within 14 calendar days | Continuous |
| Flow-down DPA coverage | 100% of sub-processors have executed DPAs | Quarterly audit |
| Sub-processor register accuracy | 100% match with processor-provided lists | Quarterly reconciliation |
© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 4 other files (scripts, references, assets) in skills/privacy/sub-processor-management of mukul975/Privacy-Data-Protection-Skills.
Open the folder on GitHubat commit 9b2ef9e
Sub Processor Management next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Sub Processor Management this skillmukul975/Privacy-Data-Protection-Skills | 295 | — | ~2.5k | Automated safety check: Pass | Apache-2.0 | |
| Cis ControlsSushegaad/Claude-Skills-Governance-Risk-and-Compliance | 939 | 1 repos | ~4.2k | Automated safety check: Pass | MIT | |
| Tos Clause Scannerzebbern/claude-code-guide | 4.6k | 1 repos | ~3.3k | Automated safety check: Pass | MIT | |
| Healthcare Phi Complianceaffaan-m/ECC | 274k | 1 repos | ~1.4k | Automated safety check: Pass | MIT | |
| Reidentifying Textmaziyarpanahi/openmed | 5.5k | — | ~1.8k | Automated safety check: Pass | Apache-2.0 | |
| Policy OpaAgentSecOps/SecOpsAgentKit | 219 | 1 repos | ~3.5k | Automated safety check: Pass | Custom licence |
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inventory, data protection…
zebbern/claude-code-guide
Audit Terms of Service, user agreements, and privacy policies for consumer risks, producing a structured report that flags unfair clauses, data traps, and liability issues.
affaan-m/ECC
Protected Health Information (PHI) and PII compliance patterns for healthcare applications: data classification, row-level access control, tamper-proof audit trails, schema tagging, and common leak…
maziyarpanahi/openmed
Reversibly de-identify clinical text with OpenMed and later restore the original PHI from a saved mapping.
AgentSecOps/SecOpsAgentKit
Policy-as-code enforcement and compliance validation using Open Policy Agent (OPA).
qualixar/superlocalmemory
Enterprise compliance and governed workspace behavior for SuperLocalMemory.
mukul975/Privacy-Data-Protection-Skills
Implements age-gating mechanisms for online services to restrict access based on user age.
mukul975/Privacy-Data-Protection-Skills
Manages AI model retention and machine unlearning requirements.
mukul975/Privacy-Data-Protection-Skills
Structures risk mitigation planning and residual risk tracking for Data Protection Impact Assessments under GDPR Article 35(7)(d).
mukul975/Privacy-Data-Protection-Skills
Guides implementation of the GDPR accountability principle under Articles 5(2) and 24, including documentation requirements for policies, DPIAs, RoPA, training records, and breach logs.
mukul975/Privacy-Data-Protection-Skills
Conducts pre-DPIA threshold screening to determine whether a full Data Protection Impact Assessment is required under GDPR Article 35.
mukul975/Privacy-Data-Protection-Skills
Designs and implements data retention schedules compliant with GDPR Article 5(1)(e) storage limitation principle.
Categories
GDPR Article 28(2) sub-processor approval workflow management. Sub Processor Management is an agent skill from mukul975/Privacy-Data-Protection-Skills. GDPR Article 28(2) sub-processor approval workflow management.
Sub Processor Management fits situations like: tasks that involve Privacy and GDPR; tasks that involve Authorization and RBAC.
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill sub-processor-management -a claude-code`. Or copy the skill folder (skills/privacy/sub-processor-management in mukul975/Privacy-Data-Protection-Skills) into .claude/skills/sub-processor-management in your project. Claude Code loads it when a task matches its description.
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill sub-processor-management -a codex`. Or copy the skill folder (skills/privacy/sub-processor-management in mukul975/Privacy-Data-Protection-Skills) into .agents/skills/sub-processor-management in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill sub-processor-management -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sub-processor-management, .gemini/skills/sub-processor-management, .github/skills/sub-processor-management and .opencode/skills/sub-processor-management in your project.
Going by SKILL.md and its folder, Sub Processor Management needs Python for the scripts in its folder. Our summary lists: Python 3.
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
Sub Processor Management is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
About 2.5k tokens (SKILL.md is roughly 9.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 3.2k tokens, read only when the agent opens those files.
Skills that share tags, products or a category with Sub Processor Management: Cis Controls (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 939 stars), Tos Clause Scanner (zebbern/claude-code-guide, 4.6k stars), Healthcare Phi Compliance (affaan-m/ECC, 274k stars) and Reidentifying Text (maziyarpanahi/openmed, 5.5k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
mukul975 (a GitHub user) maintains it in mukul975/Privacy-Data-Protection-Skills, which has 295 GitHub stars. The repository holds 278 skills in this directory. The repository was last updated on March 16, 2026.
Source: mukul975/Privacy-Data-Protection-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.
