Breach Notification Triage
ahmadvh/octochains
Determines whether a security incident involves personal data, triggers regulatory breach-notification obligations (e.g.
Vendor breach notification cascade management per GDPR Article 33(2).
Install Vendor Breach Cascade
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-breach-cascade -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-breach-cascade --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/privacy/vendor-breach-cascade .claude/skills/vendor-breach-cascade && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "vendor-breach-cascade" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-breach-cascade into .claude/skills/vendor-breach-cascade/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-breach-cascade", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-breach-cascadeType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-breach-cascade -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-breach-cascade --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/privacy/vendor-breach-cascade .agents/skills/vendor-breach-cascade && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "vendor-breach-cascade" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-breach-cascade into .agents/skills/vendor-breach-cascade/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-breach-cascade", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-breach-cascade -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-breach-cascade --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/privacy/vendor-breach-cascade .cursor/skills/vendor-breach-cascade && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "vendor-breach-cascade" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-breach-cascade into .cursor/skills/vendor-breach-cascade/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-breach-cascade", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/mukul975/Privacy-Data-Protection-Skills.git --path skills/privacy/vendor-breach-cascade--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-breach-cascade -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-breach-cascade --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/privacy/vendor-breach-cascade .gemini/skills/vendor-breach-cascade && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "vendor-breach-cascade" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-breach-cascade into .gemini/skills/vendor-breach-cascade/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-breach-cascade", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-breach-cascadeInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-breach-cascade -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/privacy/vendor-breach-cascade .github/skills/vendor-breach-cascade && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "vendor-breach-cascade" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-breach-cascade into .github/skills/vendor-breach-cascade/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-breach-cascade", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-breach-cascade -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills vendor-breach-cascade --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/privacy/vendor-breach-cascade .opencode/skills/vendor-breach-cascade && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "vendor-breach-cascade" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/vendor-breach-cascade into .opencode/skills/vendor-breach-cascade/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "vendor-breach-cascade", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
vendor-breach-cascade- GitHub stars
- 301
- Token cost
- ~2.8k tokens
- SKILL.md length
- 1,154 words
- Files
- 5 (incl. scripts, references, assets)
- Skills in repo
- 280
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Vendor breach notification cascade management per GDPR Article 33(2).
- Works in 5 steps: Initial Notification Receipt (T+0 to T+2… → Assessment and Investigation (T+2 to… → Regulatory Notification Decision (T+24… → …
- Tasks that involve Privacy and GDPR
- SKILL.md covers Overview, Notification Chain, Cascade Response Protocol and Liability Allocation, plus 2 more sections
- Runs Python scripts from its folder
What it does
Vendor Breach Cascade is an agent skill from mukul975/Privacy-Data-Protection-Skills. Vendor breach notification cascade management per GDPR Article 33(2). Covers processor-to-controller notification without undue delay, escalation paths, coordinated multi-party breach response, liability allocation, and regulatory notification coordination.
Its SKILL.md is about 2.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/standards.md` and `references/workflows.md`).
It sits in Legal & Compliance, covering Privacy and GDPR and Security operations. The repository describes itself as: 282+ structured privacy & data protection skills for AI agents. GDPR, CCPA, EU AI Act, HIPAA, LGPD, PIPL, DPDP Act. The licence is Apache-2.0.
When your agent uses it
- Tasks that involve Privacy and GDPR
- Tasks that involve Security operations
Example prompts
- “/vendor-breach-cascade”
Requirements
- Python 3
Workflow steps
5 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 9b2ef9e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Vendor Breach Cascade loads about 2.8k tokens when it runs, and up to ~5.6k if it reads all its reference files. Until then it costs about 70 tokens; SKILL.md has 1,154 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from mukul975/Privacy-Data-Protection-Skills at commit 9b2ef9e, republished under its Apache-2.0 licence (© mukul975). 1,154 words, ~2,803 tokens.
Download SKILL.mdSave it as
.claude/skills/vendor-breach-cascade/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.- name
- vendor-breach-cascade
- description
- Vendor breach notification cascade management per GDPR Article 33(2). Covers processor-to-controller notification without undue delay, escalation paths, coordinated multi-party breach response, liability allocation, and regulatory notification coordination.
- license
- Apache-2.0
- metadata.author
- mukul975
- metadata.version
- 1.0
- metadata.domain
- privacy
- metadata.subdomain
- vendor-privacy-management
- metadata.tags
- vendor-breach, art-33, breach-cascade, notification-chain, incident-response
Vendor Breach Notification Cascade
Overview
GDPR Article 33(2) requires that a processor notify the controller "without undue delay after becoming aware of a personal data breach." This obligation creates a notification cascade: the processor must notify the controller promptly, enabling the controller to assess and notify the supervisory authority within 72 hours per Article 33(1), and to notify affected data subjects per Article 34 where there is a high risk to their rights and freedoms.
The EDPB Guidelines 9/2022 on personal data breach notification emphasize that "without undue delay" for processor-to-controller notification should be interpreted strictly — the processor should notify as soon as it has established that a breach has occurred, even if full details are not yet available. DPA-specific timeframes (e.g., 24 hours) may be contractually imposed.
At Summit Cloud Partners, the Vendor Breach Notification Cascade Protocol ensures rapid, coordinated response when a vendor reports a personal data breach.
Notification Chain
Required Notifications and Timeframes
BREACH OCCURS AT VENDOR (PROCESSOR)
│
├─► T+0: Vendor detects breach
│
├─► T+[DPA timeframe]: Vendor notifies Summit Cloud Partners
│ (DPA standard: within 24 hours of becoming aware)
│ Required content per DPA:
│ ├─ Nature of the breach
│ ├─ Categories and approximate number of data subjects
│ ├─ Categories and approximate number of records
│ ├─ DPO/contact point name and details
│ ├─ Description of likely consequences
│ └─ Measures taken or proposed
│
├─► T+0 to T+72h (from controller awareness): Summit Cloud Partners
│ assesses and decides on supervisory authority notification
│ (Article 33(1): within 72 hours, unless unlikely to result
│ in risk to data subjects)
│
├─► If high risk to data subjects: Summit Cloud Partners notifies
│ affected data subjects per Article 34
│
└─► If sub-processors involved: Vendor ensures sub-processor
cascade notification (sub-processor → processor → controller)Timeframe Requirements
| Notification | GDPR Requirement | Summit Cloud Partners DPA Standard |
|---|---|---|
| Processor → Controller | "Without undue delay" (Art. 33(2)) | Within 24 hours of becoming aware |
| Controller → Supervisory Authority | Within 72 hours (Art. 33(1)) | Within 72 hours |
| Controller → Data Subjects | "Without undue delay" (Art. 34(1)) | As soon as practicable after SA notification |
| Sub-processor → Processor | Per sub-processor DPA | Within 12 hours of becoming aware |
Cascade Response Protocol
Phase 1: Initial Notification Receipt (T+0 to T+2 hours)
Upon receiving breach notification from vendor:
| Step | Action | Responsible | Timeframe |
|---|---|---|---|
| 1.1 | Log notification in breach register | Privacy Team on-call | Immediate |
| 1.2 | Verify notification came from authorized vendor contact | Privacy Team | 15 minutes |
| 1.3 | Acknowledge receipt to vendor | Privacy Team | 30 minutes |
| 1.4 | Alert Summit Cloud Partners Breach Response Team | Privacy Team | 30 minutes |
| 1.5 | Classify initial severity | Breach Response Team Lead | 1 hour |
| 1.6 | Activate appropriate response level | Breach Response Team Lead | 1 hour |
Severity Classification:
| Level | Criteria | Response Level |
|---|---|---|
| Critical | Special category data exposed; > 10,000 data subjects; criminal access confirmed | Full incident response — all hands |
| High | Sensitive data exposed; 1,000-10,000 data subjects; active threat | Expanded response team |
| Medium | Standard personal data exposed; < 1,000 data subjects; contained | Core response team |
| Low | Limited exposure; pseudonymized data; no evidence of access | Privacy Team + InfoSec lead |
Phase 2: Assessment and Investigation (T+2 to T+24 hours)
| Step | Action | Responsible |
|---|---|---|
| 2.1 | Request detailed incident report from vendor | Privacy Team |
| 2.2 | Identify affected Summit Cloud Partners data and data subjects | Privacy Team + IT |
| 2.3 | Assess whether breach is "likely to result in a risk" (Art. 33(1) threshold) | DPO |
| 2.4 | Assess whether breach results in "high risk" (Art. 34(1) threshold) | DPO |
| 2.5 | Coordinate with vendor on containment confirmation | InfoSec Team |
| 2.6 | Determine if other controllers are affected (multi-tenant breach) | Privacy Team |
| 2.7 | Engage legal counsel if liability implications exist | Legal Team |
| 2.8 | Draft preliminary supervisory authority notification (if threshold met) | DPO + Legal |
Vendor Information Requests:
| Information Required | Purpose |
|---|---|
| Root cause analysis (even preliminary) | Understand attack vector and likelihood of ongoing risk |
| Exact data categories compromised | Assess risk to data subjects |
| Exact data subject count or best estimate | Determine notification scope |
| Timeline: when breach occurred, when detected, when contained | Assess detection capability |
| Containment measures implemented | Verify threat neutralized |
| Evidence of data exfiltration (yes/confirmed no/unknown) | Critical for risk assessment |
| Impact on other clients (for multi-tenant breach) | Coordination requirement |
| Forensic investigation status and expected completion | Planning input |
Phase 3: Regulatory Notification Decision (T+24 to T+48 hours)
| Decision | Criteria | Action |
|---|---|---|
| Notify SA | Breach likely to result in risk to data subjects | File notification within 72 hours of awareness |
| Do not notify SA | Breach unlikely to result in risk (documented assessment) | Document decision and rationale; retain in breach register |
| Notify in phases | Cannot provide full details within 72 hours | File initial notification within 72 hours; provide updates as available |
Article 33(3) Notification Content:
| Required Element | Description |
|---|---|
| (a) | Nature of the breach including categories and approximate number of data subjects and records |
| (b) | Name and contact details of DPO or other contact point |
| (c) | Likely consequences of the breach |
| (d) | Measures taken or proposed to address the breach and mitigate effects |
Show full SKILL.md (488 more words)Show less
Phase 4: Data Subject Notification (if required)
Article 34(1) requires notification to data subjects when the breach "is likely to result in a high risk to the rights and freedoms of natural persons."
Exemptions (Article 34(3)):
- Controller has applied encryption or other measures rendering data unintelligible
- Controller has taken subsequent measures ensuring high risk is no longer likely
- It would involve disproportionate effort (in which case, public communication required)
Notification Content:
- Nature of the breach in clear, plain language
- DPO/contact point name and details
- Likely consequences
- Measures taken and recommended actions for data subjects
Phase 5: Coordinated Response and Remediation
| Activity | Responsible | Timeline |
|---|---|---|
| Monitor vendor's ongoing investigation | Privacy Team | Ongoing |
| Request and review vendor's root cause analysis | Privacy Team + InfoSec | Within 30 days |
| Assess vendor's remediation plan | Privacy Team + InfoSec | Within 30 days |
| Verify remediation implementation | InfoSec | Within 60 days |
| Update vendor risk score | Privacy Team | Immediate |
| Evaluate contractual remedies | Legal Team | Within 30 days |
| Conduct lessons-learned review | Breach Response Team | Within 90 days |
Liability Allocation
DPA Liability Provisions
The DPA should address breach-related liability:
| Provision | Description |
|---|---|
| Processor indemnification | Processor indemnifies controller for losses caused by processor breach (including fines to the extent legally permissible) |
| Cooperation obligation | Processor must cooperate fully with controller's investigation and regulatory notifications |
| Forensic costs | Allocation of forensic investigation costs |
| Notification costs | Allocation of data subject notification costs |
| Credit monitoring | Allocation of credit monitoring / identity protection costs for affected data subjects |
| Regulatory engagement | Processor must participate in regulatory inquiries |
| Limitation of liability | Carve-out for data protection breaches from general liability caps (where negotiable) |
GDPR Liability Framework
- Article 82(1): Any person who has suffered material or non-material damage as a result of GDPR infringement has the right to compensation from the controller or processor.
- Article 82(2): A processor is liable only where it has not complied with processor-specific GDPR obligations or has acted outside or contrary to controller instructions.
- Article 82(3): A controller or processor is exempt from liability if it can prove it is not responsible for the event giving rise to the damage.
- Article 82(4): Where multiple controllers or processors are involved, each is liable for the entirety of the damage — with contribution rights against co-liable parties.
Multi-Vendor Breach Coordination
When a breach at a sub-processor or infrastructure provider affects multiple processors and controllers:
| Role | Responsibilities |
|---|---|
| Sub-processor | Notify all affected processors; provide consistent information |
| Processor (Vendor) | Notify all affected controllers; coordinate information flow |
| Controller (Summit Cloud Partners) | Assess own impact; make own regulatory notification decisions |
| Lead Supervisory Authority | May coordinate cross-border notifications if multiple EU/EEA controllers affected |
Key Regulatory References
- GDPR Article 33(1) — Controller notification to supervisory authority within 72 hours
- GDPR Article 33(2) — Processor notification to controller "without undue delay"
- GDPR Article 33(3) — Content of supervisory authority notification
- GDPR Article 34 — Communication of breach to data subjects
- GDPR Article 82 — Right to compensation and liability
- EDPB Guidelines 9/2022 — Personal data breach notification under GDPR
- EDPB Guidelines 01/2021 — Examples regarding data breach notification
© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 4 other files (scripts, references, assets) in skills/privacy/vendor-breach-cascade of mukul975/Privacy-Data-Protection-Skills.
- SKILL.md
- assets/template.md
- references/standards.md
- references/workflows.md
- scripts/process.py
Open the folder on GitHubat commit 9b2ef9e
Compare with similar skills
Vendor Breach Cascade next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Vendor Breach Cascade this skillmukul975/Privacy-Data-Protection-Skills | 301 | — | ~2.8k | Automated safety check: Pass | Apache-2.0 | |
| Breach Notification Triageahmadvh/octochains | 377 | — | ~861 | Automated safety check: Pass | Custom licence | |
| Audit Reportharness/harness-skills | 115 | — | ~1.3k | Automated safety check: Pass | Apache-2.0 | |
| Cis ControlsSushegaad/Claude-Skills-Governance-Risk-and-Compliance | 946 | 1 repos | ~4.2k | Automated safety check: Pass | MIT | |
| Incident Reporting Navigatordavila7/claude-code-templates | 33k | 1 repos | ~4.7k | Automated safety check: Pass | CC-BY-4.0 | |
| C15tc15t/c15t | 1.9k | 1 repos | ~1.6k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Audit Report
harness/harness-skills
Generate audit reports and compliance trails using Harness audit trail data via MCP v2 tools.
Cis Controls
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inventory, data protection…
Incident Reporting Navigator
davila7/claude-code-templates
A skill your agent uses when a security incident, data breach, or actively exploited vulnerability raises the question "who must we notify, where, and by when?" Screens one incident across the EU…
C15t
c15t/c15t
Work with c15t consent management docs, APIs, and integrations for Next.js, React, and JavaScript.
HIPAA Safe Harbor Coverage Audit
maziyarpanahi/openmed
Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.
More from mukul975/Privacy-Data-Protection-Skills
All 280 skills in this repoAge Gating Services
mukul975/Privacy-Data-Protection-Skills
Implements age-gating mechanisms for online services to restrict access based on user age.
AI Data Retention
mukul975/Privacy-Data-Protection-Skills
Manages AI model retention and machine unlearning requirements.
AI Dpia
mukul975/Privacy-Data-Protection-Skills
Conducts Data Protection Impact Assessments for AI and ML systems per EDPB Guidelines 04/2025 on AI processing.
Dpia Mitigation Plan
mukul975/Privacy-Data-Protection-Skills
Structures risk mitigation planning and residual risk tracking for Data Protection Impact Assessments under GDPR Article 35(7)(d).
Gdpr Accountability
mukul975/Privacy-Data-Protection-Skills
Guides implementation of the GDPR accountability principle under Articles 5(2) and 24, including documentation requirements for policies, DPIAs, RoPA, training records, and breach logs.
Pia Threshold Screening
mukul975/Privacy-Data-Protection-Skills
Conducts pre-DPIA threshold screening to determine whether a full Data Protection Impact Assessment is required under GDPR Article 35.
Related
Categories
Questions about Vendor Breach Cascade
What does Vendor Breach Cascade do?
Vendor breach notification cascade management per GDPR Article 33(2). Vendor Breach Cascade is an agent skill from mukul975/Privacy-Data-Protection-Skills. Vendor breach notification cascade management per GDPR Article 33(2).
When should I use Vendor Breach Cascade?
Vendor Breach Cascade fits situations like: tasks that involve Privacy and GDPR; tasks that involve Security operations.
How do I install Vendor Breach Cascade in Claude Code?
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-breach-cascade -a claude-code`. Or copy the skill folder (skills/privacy/vendor-breach-cascade in mukul975/Privacy-Data-Protection-Skills) into .claude/skills/vendor-breach-cascade in your project. Claude Code loads it when a task matches its description.
How do I install Vendor Breach Cascade in Codex?
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-breach-cascade -a codex`. Or copy the skill folder (skills/privacy/vendor-breach-cascade in mukul975/Privacy-Data-Protection-Skills) into .agents/skills/vendor-breach-cascade in your project. Codex loads it when a task matches its description.
Can I use Vendor Breach Cascade in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill vendor-breach-cascade -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/vendor-breach-cascade, .gemini/skills/vendor-breach-cascade, .github/skills/vendor-breach-cascade and .opencode/skills/vendor-breach-cascade in your project.
What does Vendor Breach Cascade need to run?
Going by SKILL.md and its folder, Vendor Breach Cascade needs Python for the scripts in its folder. Our summary lists: Python 3.
Does Vendor Breach Cascade access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Vendor Breach Cascade safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Vendor Breach Cascade use?
Vendor Breach Cascade is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Vendor Breach Cascade use?
About 2.8k tokens (SKILL.md is roughly 11k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.8k tokens, read only when the agent opens those files.
What are the alternatives to Vendor Breach Cascade?
Skills that share tags, products or a category with Vendor Breach Cascade: Breach Notification Triage (ahmadvh/octochains, 377 stars), Audit Report (harness/harness-skills, 115 stars), Cis Controls (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars) and Incident Reporting Navigator (davila7/claude-code-templates, 33k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Vendor Breach Cascade?
mukul975 (a GitHub user) maintains it in mukul975/Privacy-Data-Protection-Skills, which has 301 GitHub stars. The repository holds 280 skills in this directory. The repository was last updated on March 16, 2026.
Source: mukul975/Privacy-Data-Protection-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.