AutoGineer
Generated banner for Gdpr Data Handling
Generated logo for Gdpr Data Handling

Gdpr Data Handling

Seth HobsonCommunityCreated by Seth Hobson

  • Skill
  • Guidelines
  • Business and productivity
  • MIT
  • No issues found
Download ZIP

From the author

Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.
— the description by Seth Hobson

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a comprehensive framework for ensuring GDPR compliance when building systems that process EU personal data. It covers core concepts such as data categorization, legal bases for processing, and the rights of data subjects. The guide includes best practices for data minimization, encryption, and access control, alongside specific implementation patterns for managing user consent and handling Data Subject Access Requests (DSARs).

What it does

  • Defines categories of personal data and their respective protection levels.
  • Outlines the six legal bases for processing data under Article 6.
  • Details the rights of data subjects, including access, erasure, and portability.
  • Provides a JavaScript-based consent management service pattern.
  • Offers an HTML template for a GDPR-compliant consent UI.
  • Establishes best practices for data minimization, retention, and audit logging.

When to use it

  • When building or updating systems that process personal data of EU residents.
  • When designing privacy-first architectures.
  • When implementing or auditing consent management workflows.
  • When establishing procedures for handling Data Subject Access Requests (DSARs).
  • When creating data processing agreements or conducting compliance reviews.

Advantages

  • Provides actionable implementation patterns for developers.
  • Clarifies complex legal requirements into practical technical steps.
  • Promotes privacy-by-design principles.
  • Helps ensure timely responses to data subject rights requests.

Usage examples

“How should I structure my database to track user consent for marketing emails?”
The agent provides a schema example including fields for purpose, timestamp, source, and audit logs to ensure proof of consent.
“What are the requirements for a GDPR-compliant cookie banner?”
The agent provides an HTML structure with clear opt-in checkboxes and links to privacy policies, emphasizing that necessary cookies should be enabled by default while others require explicit consent.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/wshobson/gdpr-data-handling/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip gdpr-data-handling.zip -d .agents/skills

Documentation by Seth Hobson

GDPR Data Handling

Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.

When to Use This Skill

  • Building systems that process EU personal data

  • Implementing consent management

  • Handling data subject requests (DSRs)

  • Conducting GDPR compliance reviews

  • Designing privacy-first architectures

  • Creating data processing agreements

Core Concepts

1. Personal Data Categories
CategoryExamplesProtection Level
BasicName, email, phoneStandard
Sensitive (Art. 9)Health, religion, ethnicityExplicit consent
Criminal (Art. 10)Convictions, offensesOfficial authority
Children'sUnder 16 dataParental consent
2. Legal Bases for Processing
Article 6 - Lawful Bases:
├── Consent: Freely given, specific, informed
├── Contract: Necessary for contract performance
├── Legal Obligation: Required by law
├── Vital Interests: Protecting someone's life
├── Public Interest: Official functions
└── Legitimate Interest: Balanced against rights
3. Data Subject Rights
Right to Access (Art. 15)      ─┐
Right to Rectification (Art. 16) │
Right to Erasure (Art. 17)       │ Must respond
Right to Restrict (Art. 18)      │ within 1 month
Right to Portability (Art. 20)   │
Right to Object (Art. 21)       ─┘

Detailed worked examples and patterns

Detailed sections (starting with ## Implementation Patterns) live in references/details.md. Read that file when the navigation summary above is insufficient.

Best Practices

Do's

  • Minimize data collection - Only collect what's needed

  • Document everything - Processing activities, legal bases

  • Encrypt PII - At rest and in transit

  • Implement access controls - Need-to-know basis

  • Regular audits - Verify compliance continuously

Don'ts

  • Don't pre-check consent boxes - Must be opt-in

  • Don't bundle consent - Separate purposes separately

  • Don't retain indefinitely - Define and enforce retention

  • Don't ignore DSARs - 30-day response required

  • Don't transfer without safeguards - SCCs or adequacy decisions

Files

SKILL.md

GDPR Data Handling

Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.

When to Use This Skill

  • Building systems that process EU personal data

  • Implementing consent management

  • Handling data subject requests (DSRs)

  • Conducting GDPR compliance reviews

  • Designing privacy-first architectures

  • Creating data processing agreements

Core Concepts

1. Personal Data Categories
CategoryExamplesProtection Level
BasicName, email, phoneStandard
Sensitive (Art. 9)Health, religion, ethnicityExplicit consent
Criminal (Art. 10)Convictions, offensesOfficial authority
Children'sUnder 16 dataParental consent
2. Legal Bases for Processing
Article 6 - Lawful Bases:
├── Consent: Freely given, specific, informed
├── Contract: Necessary for contract performance
├── Legal Obligation: Required by law
├── Vital Interests: Protecting someone's life
├── Public Interest: Official functions
└── Legitimate Interest: Balanced against rights
3. Data Subject Rights
Right to Access (Art. 15)      ─┐
Right to Rectification (Art. 16) │
Right to Erasure (Art. 17)       │ Must respond
Right to Restrict (Art. 18)      │ within 1 month
Right to Portability (Art. 20)   │
Right to Object (Art. 21)       ─┘

Detailed worked examples and patterns

Detailed sections (starting with ## Implementation Patterns) live in references/details.md. Read that file when the navigation summary above is insufficient.

Best Practices

Do's

  • Minimize data collection - Only collect what's needed

  • Document everything - Processing activities, legal bases

  • Encrypt PII - At rest and in transit

  • Implement access controls - Need-to-know basis

  • Regular audits - Verify compliance continuously

Don'ts

  • Don't pre-check consent boxes - Must be opt-in

  • Don't bundle consent - Separate purposes separately

  • Don't retain indefinitely - Define and enforce retention

  • Don't ignore DSARs - 30-day response required

  • Don't transfer without safeguards - SCCs or adequacy decisions

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Created by
Seth Hobson
Publisher
Seth Hobson (Community)
Source
wshobson/agents · plugins/hr-legal-compliance/skills/gdpr-data-handling · commit 4bde316
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Seth Hobson or Seth Hobson.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download gdpr-data-handling.zip