GDPR/DSGVO Expert
Tools and guidance for EU General Data Protection Regulation (GDPR) and German Bundesdatenschutzgesetz (BDSG) compliance.
Table of Contents
Tools
GDPR Compliance Checker
Scans codebases for potential GDPR compliance issues including personal data patterns and risky code practices.
# Scan a project directory
python scripts/gdpr_compliance_checker.py /path/to/project
# JSON output for CI/CD integration
python scripts/gdpr_compliance_checker.py . --json --output report.json
Detects:
- Personal data patterns (email, phone, IP addresses)
- Special category data (health, biometric, religion)
- Financial data (credit cards, IBAN)
- Risky code patterns:
- Logging personal data
- Missing consent mechanisms
- Indefinite data retention
- Unencrypted sensitive data
- Disabled deletion functionality
Output:
- Compliance score (0-100)
- Risk categorization (critical, high, medium)
- Prioritized recommendations with GDPR article references
DPIA Generator
Generates Data Protection Impact Assessment documentation following Art. 35 requirements.
# Get input template
python scripts/dpia_generator.py --template > input.json
# Generate DPIA report
python scripts/dpia_generator.py --input input.json --output dpia_report.md
Features:
- Automatic DPIA threshold assessment
- Risk identification based on processing characteristics
- Legal basis requirements documentation
- Mitigation recommendations
- Markdown report generation
DPIA Triggers Assessed:
- Systematic monitoring (Art. 35(3)(c))
- Large-scale special category data (Art. 35(3)(b))
- Automated decision-making (Art. 35(3)(a))
- WP29 high-risk criteria
Data Subject Rights Tracker
Manages data subject rights requests under GDPR Articles 15-22.
# Add new request
python scripts/data_subject_rights_tracker.py add \
--type access --subject "John Doe" --email "john@example.com"
# List all requests
python scripts/data_subject_rights_tracker.py list
# Update status
python scripts/data_subject_rights_tracker.py status --id DSR-202601-0001 --update verified
# Generate compliance report
python scripts/data_subject_rights_tracker.py report --output compliance.json
# Generate response template
python scripts/data_subject_rights_tracker.py template --id DSR-202601-0001
Supported Rights:
| Right |
Article |
Deadline |
| Access |
Art. 15 |
30 days |
| Rectification |
Art. 16 |
30 days |
| Erasure |
Art. 17 |
30 days |
| Restriction |
Art. 18 |
30 days |
| Portability |
Art. 20 |
30 days |
| Objection |
Art. 21 |
30 days |
| Automated decisions |
Art. 22 |
30 days |
Features:
- Deadline tracking with overdue alerts
- Identity verification workflow
- Response template generation
- Compliance reporting
Reference Guides
GDPR Compliance Guide
references/gdpr_compliance_guide.md
Comprehensive implementation guidance covering:
- Legal bases for processing (Art. 6)
- Special category requirements (Art. 9)
- Data subject rights implementation
- Accountability requirements (Art. 30)
- International transfers (Chapter V)
- Breach notification (Art. 33-34)
German BDSG Requirements
references/german_bdsg_requirements.md
German-specific requirements including:
- DPO appointment threshold (§ 38 BDSG - 20+ employees)
- Employment data processing (§ 26 BDSG)
- Video surveillance rules (§ 4 BDSG)
- Credit scoring requirements (§ 31 BDSG)
- State data protection laws (Landesdatenschutzgesetze)
- Works council co-determination rights
DPIA Methodology
references/dpia_methodology.md
Step-by-step DPIA process:
- Threshold assessment criteria
- WP29 high-risk indicators
- Risk assessment methodology
- Mitigation measure categories
- DPO and supervisory authority consultation
- Templates and checklists
Clarify First
Before running the assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume:
Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the assessment.
Workflows
Workflow 1: New Processing Activity Assessment
Step 1: Run compliance checker on codebase
→ python scripts/gdpr_compliance_checker.py /path/to/code
Step 2: Review findings and compliance score
→ Address critical and high issues
Step 3: Determine if DPIA required
→ Check references/dpia_methodology.md threshold criteria
Step 4: If DPIA required, generate assessment
→ python scripts/dpia_generator.py --template > input.json
→ Fill in processing details
→ python scripts/dpia_generator.py --input input.json --output dpia.md
Step 5: Document in records of processing activities
Workflow 2: Data Subject Request Handling
Step 1: Log request in tracker
→ python scripts/data_subject_rights_tracker.py add --type [type] ...
Step 2: Verify identity (proportionate measures)
→ python scripts/data_subject_rights_tracker.py status --id [ID] --update verified
Step 3: Gather data from systems
→ python scripts/data_subject_rights_tracker.py status --id [ID] --update in_progress
Step 4: Generate response
→ python scripts/data_subject_rights_tracker.py template --id [ID]
Step 5: Send response and complete
→ python scripts/data_subject_rights_tracker.py status --id [ID] --update completed
Step 6: Monitor compliance
→ python scripts/data_subject_rights_tracker.py report
Workflow 3: German BDSG Compliance Check
Step 1: Determine if DPO required
→ 20+ employees processing personal data automatically
→ OR processing requires DPIA
→ OR business involves data transfer/market research
Step 2: If employees involved, review § 26 BDSG
→ Document legal basis for employee data
→ Check works council requirements
Step 3: If video surveillance, comply with § 4 BDSG
→ Install signage
→ Document necessity
→ Limit retention
Step 4: Register DPO with supervisory authority
→ See references/german_bdsg_requirements.md for authority list
Key GDPR Concepts
Legal Bases (Art. 6)
- Consent: Marketing, newsletters, analytics (must be freely given, specific, informed)
- Contract: Order fulfillment, service delivery
- Legal obligation: Tax records, employment law
- Legitimate interests: Fraud prevention, security (requires balancing test)
Special Category Data (Art. 9)
Requires explicit consent or Art. 9(2) exception:
- Health data
- Biometric data
- Racial/ethnic origin
- Political opinions
- Religious beliefs
- Trade union membership
- Genetic data
- Sexual orientation
Data Subject Rights
All rights must be fulfilled within 30 days (extendable to 90 for complex requests):
- Access: Provide copy of data and processing information
- Rectification: Correct inaccurate data
- Erasure: Delete data (with exceptions for legal obligations)
- Restriction: Limit processing while issues are resolved
- Portability: Provide data in machine-readable format
- Object: Stop processing based on legitimate interests
German BDSG Additions
| Topic |
BDSG Section |
Key Requirement |
| DPO threshold |
§ 38 |
20+ employees = mandatory DPO |
| Employment |
§ 26 |
Detailed employee data rules |
| Video |
§ 4 |
Signage and proportionality |
| Scoring |
§ 31 |
Explainable algorithms |
Cross-Reference: CCPA/CPRA US Privacy Comparison
When operating across EU and US jurisdictions, align GDPR compliance with California Consumer Privacy Act (CCPA) as amended by CPRA. Key differences to manage:
| Dimension |
GDPR |
CCPA/CPRA |
| Scope |
Any org processing EU resident data |
For-profit businesses meeting revenue/data thresholds |
| Legal basis |
6 lawful bases required (Art. 6) |
No legal basis requirement; opt-out model |
| Consent |
Opt-in by default |
Opt-out (except minors and sensitive data) |
| Data subject rights |
Access, rectification, erasure, portability, objection |
Know, delete, correct, opt-out of sale/sharing, limit sensitive data use |
| Breach notification |
72 hours to supervisory authority (Art. 33) |
"Most expedient time possible" to consumers |
| Enforcement |
DPAs with fines up to 4% global turnover |
California Privacy Protection Agency (CPPA), $2,500-$7,500 per violation |
| DPO requirement |
Mandatory in many cases (Art. 37) |
No DPO requirement |
| Children's data |
Under 16 requires parental consent (Art. 8) |
Under 16 opt-in for sale; under 13 parental consent |
Practical alignment: Build a unified privacy program that satisfies the stricter GDPR requirements by default, then layer CCPA/CPRA-specific mechanisms (e.g., "Do Not Sell or Share My Personal Information" link, annual metrics disclosure).
See also: ../ccpa-cpra-specialist/SKILL.md for full CCPA/CPRA compliance workflows and tools.
Infrastructure Privacy Controls
Cookie Consent and Tracking
Implement compliant cookie consent per GDPR Art. 6 + ePrivacy Directive:
| Category |
Examples |
Consent Required |
Default State |
| Strictly Necessary |
Session, CSRF, load balancer |
No |
Active |
| Functional |
Language preference, UI settings |
Yes |
Inactive |
| Analytics |
Google Analytics, Matomo, Hotjar |
Yes |
Inactive |
| Marketing |
Facebook Pixel, Google Ads, retargeting |
Yes |
Inactive |
Implementation requirements:
- Banner must block all non-essential cookies until explicit consent
- Pre-checked boxes are NOT valid consent (Planet49 ruling, CJEU C-673/17)
- Consent must be as easy to withdraw as to give
- Record consent proof (timestamp, version, choices made)
- Re-consent on material changes to cookie policy
Global Privacy Control (GPC) Signal
Per CCPA/CPRA regulations and emerging EU guidance:
- Detect
Sec-GPC: 1 HTTP header and navigator.globalPrivacyControl JavaScript API
- Treat GPC as valid opt-out signal for CCPA/CPRA
- For GDPR: GPC can serve as a signal of objection under Art. 21 — evaluate on a case-by-case basis
- Log GPC signal detection and honor it automatically
Data Localization and Cross-Border Transfers
| Transfer Mechanism |
Status (post-Schrems II) |
When to Use |
| EU Adequacy Decision |
Valid |
Transfers to adequate countries (e.g., Japan, UK, South Korea, US via DPF) |
| Standard Contractual Clauses (SCCs) |
Valid with TIA |
Default mechanism for non-adequate countries |
| Binding Corporate Rules (BCRs) |
Valid |
Intra-group transfers in multinationals |
| EU-US Data Privacy Framework (DPF) |
Valid (since July 2023) |
US companies certified under DPF |
| Derogations (Art. 49) |
Limited use only |
Explicit consent, contract necessity — not for systematic transfers |
Transfer Impact Assessment (TIA) requirements for SCCs:
- Map the data flow (what data, to whom, where)
- Assess recipient country legal framework (surveillance laws, access by authorities)
- Evaluate supplementary measures needed (encryption, pseudonymization, contractual)
- Document assessment and review annually
AI-Specific GDPR Requirements
Automated Decision-Making (Art. 22)
Art. 22 restricts decisions based solely on automated processing that produce legal or similarly significant effects:
| Requirement |
Implementation |
| Right not to be subject to automated decisions |
Provide human review mechanism for consequential decisions |
| Right to explanation |
Document and explain logic, significance, and consequences |
| Right to contest |
Enable data subjects to challenge automated decisions |
| Explicit consent or contract necessity |
Secure Art. 22(2) legal basis before deploying |
| Suitable safeguards |
Implement human oversight, right to express point of view |
AI transparency checklist:
AI Training Data Requirements
| Requirement |
GDPR Basis |
Action |
| Lawful basis for training data |
Art. 6 |
Legitimate interest (with DPIA) or consent |
| Purpose limitation |
Art. 5(1)(b) |
Training purpose must be compatible with original collection |
| Data minimization |
Art. 5(1)(c) |
Use minimum data necessary; prefer synthetic/anonymized data |
| Accuracy |
Art. 5(1)(d) |
Ensure training data is accurate and up-to-date |
| Storage limitation |
Art. 5(1)(e) |
Define retention for training datasets |
| Special category data |
Art. 9 |
Explicit consent or Art. 9(2)(j) research exemption for health/biometric data |
| Right to erasure |
Art. 17 |
Implement mechanism to remove individual data from training sets (or document inability) |
| Data scraping |
Art. 14 |
Inform data subjects when using publicly available data for training |
Enhanced DPIA Methodology with EU AI Act Integration
When DPIA + AI Act Conformity Assessment Overlap
For AI systems processing personal data, both GDPR Art. 35 DPIA and EU AI Act conformity assessment may apply:
| AI Risk Level (EU AI Act) |
GDPR DPIA Required? |
Combined Assessment Approach |
| Unacceptable (Art. 5) |
N/A — prohibited |
Do not deploy |
| High-risk (Annex III) |
Almost always yes |
Joint DPIA + conformity assessment |
| Limited risk (Art. 50) |
Evaluate per Art. 35 criteria |
DPIA if systematic monitoring or profiling |
| Minimal risk |
Evaluate per Art. 35 criteria |
Standard DPIA threshold assessment |
Enhanced DPIA Process for AI Systems
Step 1: AI System Classification
→ Classify under EU AI Act risk levels
→ Map to GDPR Art. 35(3) triggers
Step 2: Data Flow and Processing Analysis
→ Document training data sources and legal basis
→ Map inference data flows
→ Identify automated decision points (Art. 22)
Step 3: AI-Specific Risk Assessment
→ Bias and discrimination risk (protected groups)
→ Accuracy and reliability risk
→ Explainability and transparency gaps
→ Data quality and representativeness
→ Model drift and ongoing monitoring needs
Step 4: Fundamental Rights Impact
→ Right to non-discrimination
→ Right to privacy and data protection
→ Freedom of expression (content moderation AI)
→ Right to an effective remedy
Step 5: Combined Mitigation Measures
→ Technical: differential privacy, federated learning, model cards
→ Organizational: AI ethics board, human oversight procedures
→ Contractual: AI-specific DPA clauses with processors
→ Monitoring: continuous bias monitoring, performance drift detection
Step 6: DPO and Supervisory Authority Consultation
→ Consult DPO on combined assessment
→ Prior consultation with SA if high residual risk (Art. 36)
→ Notify national AI authority if high-risk AI system
Privacy by Design Technical Controls
Data Minimization Techniques
| Technique |
Description |
Use Case |
| Field-level encryption |
Encrypt specific PII fields at rest |
Database storage |
| Tokenization |
Replace PII with non-reversible tokens |
Payment processing, analytics |
| Data masking |
Obscure portions of data (e.g., email: j***@example.com) |
UI display, logging |
| Aggregation |
Process only aggregated/statistical data |
Analytics, reporting |
| Purpose-scoped access |
Limit data access to specific processing purposes |
Multi-purpose systems |
| Automatic expiration |
TTL-based data deletion |
Session data, temporary processing |
Pseudonymization Implementation (Recital 26, Art. 4(5))
| Method |
Reversibility |
Strength |
Best For |
| HMAC-based |
Reversible with key |
Strong |
Internal analytics with re-identification need |
| Format-preserving encryption |
Reversible with key |
Strong |
Legacy system compatibility |
| Deterministic hashing (salted) |
One-way |
Medium |
Cross-dataset linkage without PII |
| Random ID mapping |
Reversible with lookup table |
Strong |
Research datasets |
Key management for pseudonymization:
- Store re-identification keys separately from pseudonymized data
- Apply strict access controls to key material (minimum two-person rule)
- Document key rotation schedule
- Log all re-identification events
Encryption Standards
| Layer |
Minimum Standard |
Recommended |
| At rest |
AES-256 |
AES-256-GCM with envelope encryption |
| In transit |
TLS 1.2 |
TLS 1.3 |
| Database |
Transparent Data Encryption (TDE) |
Column-level encryption for PII |
| Backups |
AES-256 |
AES-256 + separate key from production |
| Key management |
Hardware-backed (HSM/KMS) |
Cloud KMS with customer-managed keys (BYOK) |
Cross-Framework Privacy Mapping
| Requirement |
GDPR Article |
CCPA/CPRA Section |
HIPAA Rule |
NIS2 Article |
| Risk assessment |
Art. 35 (DPIA) |
§1798.185 (risk assessment regs) |
§164.308(a)(1) |
Art. 21(2)(a) |
| Breach notification |
Art. 33-34 (72 hrs to SA) |
§1798.150 (to consumers) |
§164.404-408 (60 days) |
Art. 23 (24 hrs early warning) |
| Data minimization |
Art. 5(1)(c) |
§1798.100(c) (collection limitation) |
§164.502(b) (minimum necessary) |
Art. 21(2)(e) |
| Encryption |
Art. 32(1)(a) |
Implicit (reasonable security) |
§164.312(a)(2)(iv) (addressable) |
Art. 21(2)(e) |
| Access controls |
Art. 32(1)(b) |
Implicit (reasonable security) |
§164.312(a)(1) (access control) |
Art. 21(2)(d) |
| Incident response |
Art. 33-34 |
§1798.150 |
§164.308(a)(6) |
Art. 21(2)(b) |
| Supply chain security |
Art. 28 (processor agreements) |
§1798.140(ag) (service provider contracts) |
§164.308(b) (BAAs) |
Art. 21(2)(d) |
| Governance/accountability |
Art. 5(2), Art. 24 |
§1798.185 (audit regs) |
§164.308(a)(1) |
Art. 20 (governance) |
| Right to delete/erasure |
Art. 17 |
§1798.105 |
Limited (retention rules) |
N/A |
| Data portability |
Art. 20 |
§1798.130(a)(2) |
N/A |
N/A |
Cross-references: See ../information-security-manager-iso27001/SKILL.md for ISO 27001 security controls, and ../mdr-745-specialist/SKILL.md for healthcare device data protection under MDR.
Cross-Framework Privacy Integration
GDPR ↔ CCPA/CPRA Comparison
| Aspect |
GDPR |
CCPA/CPRA |
| Scope |
Any org processing EU residents' data |
$25M+ revenue, 100K+ consumers, or 50%+ revenue from selling PI |
| Legal Basis |
6 legal bases required (Art. 6) |
Opt-out model (no legal basis needed for collection) |
| Consent |
Opt-in required |
Opt-out for sale/sharing |
| Right to Delete |
Art. 17 |
§1798.105 |
| Data Portability |
Art. 20 |
§1798.130 |
| Penalties |
Up to €20M or 4% global turnover |
$2,500-$7,500 per violation |
| DPO Required |
Yes (in many cases) |
No |
| DPIA Required |
Yes (high risk processing) |
Risk assessments (CPRA) |
AI-Specific GDPR Requirements
- Automated Decision-Making (Art. 22): Right not to be subject to decisions based solely on automated processing with legal/significant effects
- AI Training Data: Legitimate interest or consent required; purpose limitation applies to model training
- Profiling: Requires explicit consent for automated profiling with significant effects
- EU AI Act Integration: High-risk AI systems processing personal data require DPIA per Art. 35 GDPR
- Cross-reference: See
eu-ai-act-specialist for AI-specific compliance
Infrastructure Privacy Controls
- Cookie Consent: TCF 2.2 compliant consent management platform (CMP)
- Global Privacy Control (GPC): Must honor GPC browser signals (also CCPA requirement)
- Data Localization: EU data residency requirements, Schrems II adequacy decisions
- Cross-Border Transfers: Standard Contractual Clauses (SCCs), adequacy decisions, binding corporate rules
- Privacy by Design Controls: Data minimization, pseudonymization, encryption at rest/transit, access logging
Cross-Framework Mapping
| Control |
GDPR |
CCPA |
HIPAA |
NIS2 |
| Privacy Notice |
Art. 13-14 |
§1798.100 |
Privacy Practices |
— |
| Data Subject Rights |
Art. 15-22 |
§1798.100-125 |
Access/Amendment |
— |
| Breach Notification |
Art. 33-34 |
§1798.150 |
§164.404-408 |
Art. 23 |
| DPO/Privacy Officer |
Art. 37-39 |
— |
Privacy Officer |
— |
| Risk Assessment |
Art. 35 (DPIA) |
Risk Assessment |
§164.308(a)(1) |
Art. 21 |
| Encryption |
Art. 32 |
Reasonable Security |
§164.312(a)(2)(iv) |
Art. 21.2.h |
| Training |
Art. 39.1.b |
— |
§164.308(a)(5) |
Art. 21.2.g |
Troubleshooting
| Problem |
Possible Cause |
Resolution |
| Compliance checker reports critical findings for special category data |
Code processes health, biometric, or religious data without explicit consent or Art. 9(2) exception |
Identify all special category data processing; secure explicit consent or document applicable Art. 9(2) exception; implement field-level encryption for sensitive fields |
| DPIA generator determines assessment required but organization has no DPIA process |
Processing triggers Art. 35(3) criteria (systematic monitoring, large-scale special categories, or automated decision-making) |
Follow the DPIA methodology in references/dpia_methodology.md; generate template with dpia_generator.py --template; consult DPO before proceeding; consider prior consultation with supervisory authority if high residual risk (Art. 36) |
| Data subject rights requests consistently exceed 30-day deadline |
Manual fulfillment without tracking system, unclear data location, or complex verification requirements |
Deploy data_subject_rights_tracker.py for automated deadline monitoring; map all personal data locations using data inventory; streamline identity verification to proportionate measures |
| Cross-border transfer mechanism invalidated or uncertain |
Reliance on deprecated mechanism or Transfer Impact Assessment not completed for SCCs |
Review current adequacy decisions (UK, Japan, South Korea, US via DPF); for SCCs, complete Transfer Impact Assessment per Schrems II requirements; document supplementary measures (encryption, pseudonymization) |
| Cookie consent banner flagged as non-compliant |
Pre-checked boxes, cookie wall blocking access, or reject button harder to find than accept |
Implement TCF 2.2 compliant CMP; ensure all non-essential cookies blocked until explicit consent; make reject as prominent as accept (per Planet49 ruling, CJEU C-673/17); record consent proof |
| GDPR compliance checker detects personal data in application logs |
Application logs contain email addresses, IP addresses, or user identifiers |
Implement log sanitization to mask or pseudonymize personal data before storage; configure logging frameworks to exclude PII fields; set log retention limits aligned with purpose |
| AI system processing personal data lacks Art. 22 safeguards |
Automated decision-making produces legal or significant effects without human review mechanism |
Implement human-in-the-loop for high-stakes decisions; provide right to explanation and right to contest; document algorithmic logic in plain language; include AI decision-making in privacy notice per Art. 13(2)(f) |
Success Criteria
- Compliance score of 80+ on codebase scan -- indicating no critical personal data exposure issues, with all high-risk patterns addressed and documented
- All data subject rights requests fulfilled within 30 days -- tracked via
data_subject_rights_tracker.py with identity verification completed, response templates generated, and compliance reports showing zero overdue requests
- DPIA completed for all high-risk processing activities -- covering Art. 35(3) triggers, WP29 criteria, risk mitigation measures, and DPO consultation; prior SA consultation documented where required
- Records of Processing Activities (Art. 30) maintained and current -- covering all processing activities with purposes, legal bases, data categories, recipients, retention periods, and transfer mechanisms
- Cross-border transfer mechanisms validated -- adequacy decisions, SCCs with TIA, or BCRs in place for all international data flows, reviewed annually
- Cookie consent implementation compliant -- non-essential cookies blocked until explicit consent, reject as easy as accept, consent proof recorded with timestamp and version, GPC signal honored
- DPO appointed and registered where required -- including German BDSG Section 38 threshold (20+ employees processing personal data automatically), with supervisory authority notification
Scope & Limitations
In Scope:
- Codebase scanning for personal data patterns and risky processing practices
- DPIA generation following Art. 35 requirements with threshold assessment and risk mitigation
- Data subject rights request tracking (Art. 15-22) with deadline monitoring and response templates
- German BDSG-specific requirements (DPO threshold, employment data, video surveillance, credit scoring)
- Cross-border transfer mechanism assessment (adequacy decisions, SCCs, BCRs, DPF)
- AI-specific GDPR requirements (Art. 22 automated decisions, training data governance, profiling)
- Cross-framework privacy mapping (GDPR, CCPA/CPRA, HIPAA, NIS2)
Out of Scope:
- Legal advice on specific legal basis selection or legitimate interest balancing tests -- consult DPO and legal counsel
- Supervisory authority notification or interaction for breach reporting (Art. 33-34)
- Implementation of cookie consent management platforms or consent management code
- GDPR representative appointment logistics for non-EU organizations (Art. 27)
- Binding Corporate Rules (BCR) application or approval process
- German Landesdatenschutzgesetze (state-level data protection laws) beyond general guidance
Important Notes:
- GDPR enforcement fines reached EUR 2.3 billion in 2025, a 38% year-over-year increase; healthcare violations spiked with average penalties of EUR 203,000
- The EU AI Act creates dual obligations for AI systems processing personal data -- both DPIA (GDPR Art. 35) and conformity assessment (AI Act) may apply simultaneously
- Dark patterns in consent interfaces are under heightened enforcement scrutiny; regulators are penalizing cookie walls, manipulative UI, and buried reject options
Integration Points
| Skill |
Integration |
When to Use |
ccpa-cpra-privacy-expert |
Unified privacy program covering both GDPR and CCPA/CPRA; cross-framework mapping |
When organization processes data of both EU residents and California consumers |
eu-ai-act-specialist |
Combined DPIA + AI Act conformity assessment for high-risk AI systems processing personal data |
When AI system triggers both GDPR Art. 35 DPIA and EU AI Act high-risk classification |
information-security-manager-iso27001 |
ISO 27001 security controls support GDPR Art. 32 security of processing requirements |
When implementing technical and organizational measures for personal data protection |
infrastructure-compliance-auditor |
Technical privacy controls validation (encryption, access controls, logging, data masking) |
When assessing infrastructure supporting GDPR privacy-by-design requirements |
dora-compliance-expert |
DORA complements GDPR for financial sector ICT systems processing personal data |
When financial entity must align DORA ICT security with GDPR data protection requirements |
Tool Reference
gdpr_compliance_checker.py
Scans codebases for potential GDPR compliance issues including personal data patterns and risky code practices.
| Flag |
Required |
Description |
<project_dir> |
Yes |
Path to project directory to scan |
--json |
No |
Output results in JSON format for CI/CD integration |
--output <file> |
No |
Export report to specified file path |
Detects: Email, phone, IP address, credit card, IBAN, German ID patterns; special category data (health, biometric, religion); risky code patterns (logging PII, missing consent, indefinite retention, unencrypted sensitive data, disabled deletion). Output: Compliance score (0-100), risk categorization (critical/high/medium), and prioritized recommendations with GDPR article references.
dpia_generator.py
Generates Data Protection Impact Assessment documentation following Art. 35 requirements.
| Flag |
Required |
Description |
--template |
No |
Generate blank DPIA input template to stdout |
--input <file> |
Yes (unless --template or --interactive) |
Path to JSON processing activity description |
--output <file> |
No |
Export DPIA report to specified file path (markdown format) |
--interactive |
No |
Launch interactive mode for guided DPIA creation |
Features: Automatic DPIA threshold assessment against Art. 35(3) triggers and WP29 criteria, risk identification based on processing characteristics, legal basis documentation, mitigation recommendations, and markdown report generation.
data_subject_rights_tracker.py
Manages data subject rights requests under GDPR Articles 15-22 with deadline tracking and response templates.
| Subcommand |
Description |
add |
Add new request (--type, --subject, --email required) |
list |
List all tracked requests |
status |
View or update request status (--id required, --update to change status) |
report |
Generate compliance report (--output for file export) |
template |
Generate response template for specific request (--id required) |
| Flag |
Description |
--type <right> |
Right type: access, rectification, erasure, restriction, portability, objection, automated |
--subject <name> |
Data subject name |
--email <email> |
Data subject email address |
--id <request_id> |
Request identifier (e.g., DSR-202601-0001) |
--update <status> |
New status: received, verified, in_progress, completed, denied, extended |
--output <file> |
Export report or template to specified file path |
Features: 30-day deadline tracking with overdue alerts, identity verification workflow, response template generation per right type, and compliance reporting with metrics.
1---
2name: gdpr-dsgvo-expert
3description: >
4 GDPR and German DSGVO compliance. Use for GDPR compliance assessments, privacy
5 audits, scanning codebases for privacy risks, DPIA generation, data protection
6 planning, and data subject rights management.
7license: MIT + Commons Clause
8metadata:
9 version: 1.0.0
10 author: borghei
11 category: compliance
12 domain: privacy-compliance
13 updated: 2026-03-31
14 tags: [gdpr, dsgvo, dpia, data-protection, privacy]
15---
16
17# GDPR/DSGVO Expert
18
19Tools and guidance for EU General Data Protection Regulation (GDPR) and German Bundesdatenschutzgesetz (BDSG) compliance.
20
21---
22
23## Table of Contents
24
25- [Tools](#tools)
26 - [GDPR Compliance Checker](#gdpr-compliance-checker)
27 - [DPIA Generator](#dpia-generator)
28 - [Data Subject Rights Tracker](#data-subject-rights-tracker)
29- [Reference Guides](#reference-guides)
30- [Workflows](#workflows)
31
32---
33
34## Tools
35
36### GDPR Compliance Checker
37
38Scans codebases for potential GDPR compliance issues including personal data patterns and risky code practices.
39
40```bash
41# Scan a project directory
42python scripts/gdpr_compliance_checker.py /path/to/project
43
44# JSON output for CI/CD integration
45python scripts/gdpr_compliance_checker.py . --json --output report.json
46```
47
48**Detects:**
49- Personal data patterns (email, phone, IP addresses)
50- Special category data (health, biometric, religion)
51- Financial data (credit cards, IBAN)
52- Risky code patterns:
53 - Logging personal data
54 - Missing consent mechanisms
55 - Indefinite data retention
56 - Unencrypted sensitive data
57 - Disabled deletion functionality
58
59**Output:**
60- Compliance score (0-100)
61- Risk categorization (critical, high, medium)
62- Prioritized recommendations with GDPR article references
63
64---
65
66### DPIA Generator
67
68Generates Data Protection Impact Assessment documentation following Art. 35 requirements.
69
70```bash
71# Get input template
72python scripts/dpia_generator.py --template > input.json
73
74# Generate DPIA report
75python scripts/dpia_generator.py --input input.json --output dpia_report.md
76```
77
78**Features:**
79- Automatic DPIA threshold assessment
80- Risk identification based on processing characteristics
81- Legal basis requirements documentation
82- Mitigation recommendations
83- Markdown report generation
84
85**DPIA Triggers Assessed:**
86- Systematic monitoring (Art. 35(3)(c))
87- Large-scale special category data (Art. 35(3)(b))
88- Automated decision-making (Art. 35(3)(a))
89- WP29 high-risk criteria
90
91---
92
93### Data Subject Rights Tracker
94
95Manages data subject rights requests under GDPR Articles 15-22.
96
97```bash
98# Add new request
99python scripts/data_subject_rights_tracker.py add \
100 --type access --subject "John Doe" --email "john@example.com"
101
102# List all requests
103python scripts/data_subject_rights_tracker.py list
104
105# Update status
106python scripts/data_subject_rights_tracker.py status --id DSR-202601-0001 --update verified
107
108# Generate compliance report
109python scripts/data_subject_rights_tracker.py report --output compliance.json
110
111# Generate response template
112python scripts/data_subject_rights_tracker.py template --id DSR-202601-0001
113```
114
115**Supported Rights:**
116
117| Right | Article | Deadline |
118|-------|---------|----------|
119| Access | Art. 15 | 30 days |
120| Rectification | Art. 16 | 30 days |
121| Erasure | Art. 17 | 30 days |
122| Restriction | Art. 18 | 30 days |
123| Portability | Art. 20 | 30 days |
124| Objection | Art. 21 | 30 days |
125| Automated decisions | Art. 22 | 30 days |
126
127**Features:**
128- Deadline tracking with overdue alerts
129- Identity verification workflow
130- Response template generation
131- Compliance reporting
132
133---
134
135## Reference Guides
136
137### GDPR Compliance Guide
138`references/gdpr_compliance_guide.md`
139
140Comprehensive implementation guidance covering:
141- Legal bases for processing (Art. 6)
142- Special category requirements (Art. 9)
143- Data subject rights implementation
144- Accountability requirements (Art. 30)
145- International transfers (Chapter V)
146- Breach notification (Art. 33-34)
147
148### German BDSG Requirements
149`references/german_bdsg_requirements.md`
150
151German-specific requirements including:
152- DPO appointment threshold (§ 38 BDSG - 20+ employees)
153- Employment data processing (§ 26 BDSG)
154- Video surveillance rules (§ 4 BDSG)
155- Credit scoring requirements (§ 31 BDSG)
156- State data protection laws (Landesdatenschutzgesetze)
157- Works council co-determination rights
158
159### DPIA Methodology
160`references/dpia_methodology.md`
161
162Step-by-step DPIA process:
163- Threshold assessment criteria
164- WP29 high-risk indicators
165- Risk assessment methodology
166- Mitigation measure categories
167- DPO and supervisory authority consultation
168- Templates and checklists
169
170---
171
172## Clarify First
173
174Before running the assessment, confirm these inputs. If any is unknown or vague, ASK — do not assume:
175
176- [ ] **Task** — codebase compliance scan, DPIA generation, or data-subject-rights tracking (selects the tool and workflow)
177- [ ] **Role and jurisdiction** — controller vs processor; GDPR-only vs German BDSG applies (BDSG adds the DPO threshold, §26 employment, and §4 video rules)
178- [ ] **Processing characteristics** — high-risk processing such as profiling, AI, or large-scale special-category data (determines whether a DPIA is required)
179
180Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the assessment.
181
182## Workflows
183
184### Workflow 1: New Processing Activity Assessment
185
186```
187Step 1: Run compliance checker on codebase
188 → python scripts/gdpr_compliance_checker.py /path/to/code
189
190Step 2: Review findings and compliance score
191 → Address critical and high issues
192
193Step 3: Determine if DPIA required
194 → Check references/dpia_methodology.md threshold criteria
195
196Step 4: If DPIA required, generate assessment
197 → python scripts/dpia_generator.py --template > input.json
198 → Fill in processing details
199 → python scripts/dpia_generator.py --input input.json --output dpia.md
200
201Step 5: Document in records of processing activities
202```
203
204### Workflow 2: Data Subject Request Handling
205
206```
207Step 1: Log request in tracker
208 → python scripts/data_subject_rights_tracker.py add --type [type] ...
209
210Step 2: Verify identity (proportionate measures)
211 → python scripts/data_subject_rights_tracker.py status --id [ID] --update verified
212
213Step 3: Gather data from systems
214 → python scripts/data_subject_rights_tracker.py status --id [ID] --update in_progress
215
216Step 4: Generate response
217 → python scripts/data_subject_rights_tracker.py template --id [ID]
218
219Step 5: Send response and complete
220 → python scripts/data_subject_rights_tracker.py status --id [ID] --update completed
221
222Step 6: Monitor compliance
223 → python scripts/data_subject_rights_tracker.py report
224```
225
226### Workflow 3: German BDSG Compliance Check
227
228```
229Step 1: Determine if DPO required
230 → 20+ employees processing personal data automatically
231 → OR processing requires DPIA
232 → OR business involves data transfer/market research
233
234Step 2: If employees involved, review § 26 BDSG
235 → Document legal basis for employee data
236 → Check works council requirements
237
238Step 3: If video surveillance, comply with § 4 BDSG
239 → Install signage
240 → Document necessity
241 → Limit retention
242
243Step 4: Register DPO with supervisory authority
244 → See references/german_bdsg_requirements.md for authority list
245```
246
247---
248
249## Key GDPR Concepts
250
251### Legal Bases (Art. 6)
252
253- **Consent**: Marketing, newsletters, analytics (must be freely given, specific, informed)
254- **Contract**: Order fulfillment, service delivery
255- **Legal obligation**: Tax records, employment law
256- **Legitimate interests**: Fraud prevention, security (requires balancing test)
257
258### Special Category Data (Art. 9)
259
260Requires explicit consent or Art. 9(2) exception:
261- Health data
262- Biometric data
263- Racial/ethnic origin
264- Political opinions
265- Religious beliefs
266- Trade union membership
267- Genetic data
268- Sexual orientation
269
270### Data Subject Rights
271
272All rights must be fulfilled within **30 days** (extendable to 90 for complex requests):
273- **Access**: Provide copy of data and processing information
274- **Rectification**: Correct inaccurate data
275- **Erasure**: Delete data (with exceptions for legal obligations)
276- **Restriction**: Limit processing while issues are resolved
277- **Portability**: Provide data in machine-readable format
278- **Object**: Stop processing based on legitimate interests
279
280### German BDSG Additions
281
282| Topic | BDSG Section | Key Requirement |
283|-------|--------------|-----------------|
284| DPO threshold | § 38 | 20+ employees = mandatory DPO |
285| Employment | § 26 | Detailed employee data rules |
286| Video | § 4 | Signage and proportionality |
287| Scoring | § 31 | Explainable algorithms |
288
289---
290
291## Cross-Reference: CCPA/CPRA US Privacy Comparison
292
293When operating across EU and US jurisdictions, align GDPR compliance with California Consumer Privacy Act (CCPA) as amended by CPRA. Key differences to manage:
294
295| Dimension | GDPR | CCPA/CPRA |
296|-----------|------|-----------|
297| Scope | Any org processing EU resident data | For-profit businesses meeting revenue/data thresholds |
298| Legal basis | 6 lawful bases required (Art. 6) | No legal basis requirement; opt-out model |
299| Consent | Opt-in by default | Opt-out (except minors and sensitive data) |
300| Data subject rights | Access, rectification, erasure, portability, objection | Know, delete, correct, opt-out of sale/sharing, limit sensitive data use |
301| Breach notification | 72 hours to supervisory authority (Art. 33) | "Most expedient time possible" to consumers |
302| Enforcement | DPAs with fines up to 4% global turnover | California Privacy Protection Agency (CPPA), $2,500-$7,500 per violation |
303| DPO requirement | Mandatory in many cases (Art. 37) | No DPO requirement |
304| Children's data | Under 16 requires parental consent (Art. 8) | Under 16 opt-in for sale; under 13 parental consent |
305
306**Practical alignment:** Build a unified privacy program that satisfies the stricter GDPR requirements by default, then layer CCPA/CPRA-specific mechanisms (e.g., "Do Not Sell or Share My Personal Information" link, annual metrics disclosure).
307
308> **See also:** `../ccpa-cpra-specialist/SKILL.md` for full CCPA/CPRA compliance workflows and tools.
309
310---
311
312## Infrastructure Privacy Controls
313
314### Cookie Consent and Tracking
315
316Implement compliant cookie consent per GDPR Art. 6 + ePrivacy Directive:
317
318| Category | Examples | Consent Required | Default State |
319|----------|----------|------------------|---------------|
320| Strictly Necessary | Session, CSRF, load balancer | No | Active |
321| Functional | Language preference, UI settings | Yes | Inactive |
322| Analytics | Google Analytics, Matomo, Hotjar | Yes | Inactive |
323| Marketing | Facebook Pixel, Google Ads, retargeting | Yes | Inactive |
324
325**Implementation requirements:**
326- Banner must block all non-essential cookies until explicit consent
327- Pre-checked boxes are NOT valid consent (Planet49 ruling, CJEU C-673/17)
328- Consent must be as easy to withdraw as to give
329- Record consent proof (timestamp, version, choices made)
330- Re-consent on material changes to cookie policy
331
332### Global Privacy Control (GPC) Signal
333
334Per CCPA/CPRA regulations and emerging EU guidance:
335- Detect `Sec-GPC: 1` HTTP header and `navigator.globalPrivacyControl` JavaScript API
336- Treat GPC as valid opt-out signal for CCPA/CPRA
337- For GDPR: GPC can serve as a signal of objection under Art. 21 — evaluate on a case-by-case basis
338- Log GPC signal detection and honor it automatically
339
340### Data Localization and Cross-Border Transfers
341
342| Transfer Mechanism | Status (post-Schrems II) | When to Use |
343|---------------------|--------------------------|-------------|
344| EU Adequacy Decision | Valid | Transfers to adequate countries (e.g., Japan, UK, South Korea, US via DPF) |
345| Standard Contractual Clauses (SCCs) | Valid with TIA | Default mechanism for non-adequate countries |
346| Binding Corporate Rules (BCRs) | Valid | Intra-group transfers in multinationals |
347| EU-US Data Privacy Framework (DPF) | Valid (since July 2023) | US companies certified under DPF |
348| Derogations (Art. 49) | Limited use only | Explicit consent, contract necessity — not for systematic transfers |
349
350**Transfer Impact Assessment (TIA) requirements for SCCs:**
3511. Map the data flow (what data, to whom, where)
3522. Assess recipient country legal framework (surveillance laws, access by authorities)
3533. Evaluate supplementary measures needed (encryption, pseudonymization, contractual)
3544. Document assessment and review annually
355
356---
357
358## AI-Specific GDPR Requirements
359
360### Automated Decision-Making (Art. 22)
361
362Art. 22 restricts decisions based solely on automated processing that produce legal or similarly significant effects:
363
364| Requirement | Implementation |
365|-------------|----------------|
366| Right not to be subject to automated decisions | Provide human review mechanism for consequential decisions |
367| Right to explanation | Document and explain logic, significance, and consequences |
368| Right to contest | Enable data subjects to challenge automated decisions |
369| Explicit consent or contract necessity | Secure Art. 22(2) legal basis before deploying |
370| Suitable safeguards | Implement human oversight, right to express point of view |
371
372**AI transparency checklist:**
373- [ ] Document algorithmic logic in plain language
374- [ ] Implement human-in-the-loop for high-stakes decisions (credit, employment, insurance)
375- [ ] Provide opt-out mechanism for fully automated decisions
376- [ ] Conduct and document bias testing (protected characteristics under Art. 9)
377- [ ] Log all automated decisions with reasoning for auditability
378- [ ] Include AI decision-making in privacy notice (Art. 13(2)(f), Art. 14(2)(g))
379
380### AI Training Data Requirements
381
382| Requirement | GDPR Basis | Action |
383|-------------|------------|--------|
384| Lawful basis for training data | Art. 6 | Legitimate interest (with DPIA) or consent |
385| Purpose limitation | Art. 5(1)(b) | Training purpose must be compatible with original collection |
386| Data minimization | Art. 5(1)(c) | Use minimum data necessary; prefer synthetic/anonymized data |
387| Accuracy | Art. 5(1)(d) | Ensure training data is accurate and up-to-date |
388| Storage limitation | Art. 5(1)(e) | Define retention for training datasets |
389| Special category data | Art. 9 | Explicit consent or Art. 9(2)(j) research exemption for health/biometric data |
390| Right to erasure | Art. 17 | Implement mechanism to remove individual data from training sets (or document inability) |
391| Data scraping | Art. 14 | Inform data subjects when using publicly available data for training |
392
393---
394
395## Enhanced DPIA Methodology with EU AI Act Integration
396
397### When DPIA + AI Act Conformity Assessment Overlap
398
399For AI systems processing personal data, both GDPR Art. 35 DPIA and EU AI Act conformity assessment may apply:
400
401| AI Risk Level (EU AI Act) | GDPR DPIA Required? | Combined Assessment Approach |
402|---------------------------|----------------------|------------------------------|
403| Unacceptable (Art. 5) | N/A — prohibited | Do not deploy |
404| High-risk (Annex III) | Almost always yes | Joint DPIA + conformity assessment |
405| Limited risk (Art. 50) | Evaluate per Art. 35 criteria | DPIA if systematic monitoring or profiling |
406| Minimal risk | Evaluate per Art. 35 criteria | Standard DPIA threshold assessment |
407
408### Enhanced DPIA Process for AI Systems
409
410```
411Step 1: AI System Classification
412 → Classify under EU AI Act risk levels
413 → Map to GDPR Art. 35(3) triggers
414
415Step 2: Data Flow and Processing Analysis
416 → Document training data sources and legal basis
417 → Map inference data flows
418 → Identify automated decision points (Art. 22)
419
420Step 3: AI-Specific Risk Assessment
421 → Bias and discrimination risk (protected groups)
422 → Accuracy and reliability risk
423 → Explainability and transparency gaps
424 → Data quality and representativeness
425 → Model drift and ongoing monitoring needs
426
427Step 4: Fundamental Rights Impact
428 → Right to non-discrimination
429 → Right to privacy and data protection
430 → Freedom of expression (content moderation AI)
431 → Right to an effective remedy
432
433Step 5: Combined Mitigation Measures
434 → Technical: differential privacy, federated learning, model cards
435 → Organizational: AI ethics board, human oversight procedures
436 → Contractual: AI-specific DPA clauses with processors
437 → Monitoring: continuous bias monitoring, performance drift detection
438
439Step 6: DPO and Supervisory Authority Consultation
440 → Consult DPO on combined assessment
441 → Prior consultation with SA if high residual risk (Art. 36)
442 → Notify national AI authority if high-risk AI system
443```
444
445---
446
447## Privacy by Design Technical Controls
448
449### Data Minimization Techniques
450
451| Technique | Description | Use Case |
452|-----------|-------------|----------|
453| Field-level encryption | Encrypt specific PII fields at rest | Database storage |
454| Tokenization | Replace PII with non-reversible tokens | Payment processing, analytics |
455| Data masking | Obscure portions of data (e.g., email: j***@example.com) | UI display, logging |
456| Aggregation | Process only aggregated/statistical data | Analytics, reporting |
457| Purpose-scoped access | Limit data access to specific processing purposes | Multi-purpose systems |
458| Automatic expiration | TTL-based data deletion | Session data, temporary processing |
459
460### Pseudonymization Implementation (Recital 26, Art. 4(5))
461
462| Method | Reversibility | Strength | Best For |
463|--------|---------------|----------|----------|
464| HMAC-based | Reversible with key | Strong | Internal analytics with re-identification need |
465| Format-preserving encryption | Reversible with key | Strong | Legacy system compatibility |
466| Deterministic hashing (salted) | One-way | Medium | Cross-dataset linkage without PII |
467| Random ID mapping | Reversible with lookup table | Strong | Research datasets |
468
469**Key management for pseudonymization:**
470- Store re-identification keys separately from pseudonymized data
471- Apply strict access controls to key material (minimum two-person rule)
472- Document key rotation schedule
473- Log all re-identification events
474
475### Encryption Standards
476
477| Layer | Minimum Standard | Recommended |
478|-------|------------------|-------------|
479| At rest | AES-256 | AES-256-GCM with envelope encryption |
480| In transit | TLS 1.2 | TLS 1.3 |
481| Database | Transparent Data Encryption (TDE) | Column-level encryption for PII |
482| Backups | AES-256 | AES-256 + separate key from production |
483| Key management | Hardware-backed (HSM/KMS) | Cloud KMS with customer-managed keys (BYOK) |
484
485---
486
487## Cross-Framework Privacy Mapping
488
489| Requirement | GDPR Article | CCPA/CPRA Section | HIPAA Rule | NIS2 Article |
490|-------------|-------------|-------------------|------------|--------------|
491| Risk assessment | Art. 35 (DPIA) | §1798.185 (risk assessment regs) | §164.308(a)(1) | Art. 21(2)(a) |
492| Breach notification | Art. 33-34 (72 hrs to SA) | §1798.150 (to consumers) | §164.404-408 (60 days) | Art. 23 (24 hrs early warning) |
493| Data minimization | Art. 5(1)(c) | §1798.100(c) (collection limitation) | §164.502(b) (minimum necessary) | Art. 21(2)(e) |
494| Encryption | Art. 32(1)(a) | Implicit (reasonable security) | §164.312(a)(2)(iv) (addressable) | Art. 21(2)(e) |
495| Access controls | Art. 32(1)(b) | Implicit (reasonable security) | §164.312(a)(1) (access control) | Art. 21(2)(d) |
496| Incident response | Art. 33-34 | §1798.150 | §164.308(a)(6) | Art. 21(2)(b) |
497| Supply chain security | Art. 28 (processor agreements) | §1798.140(ag) (service provider contracts) | §164.308(b) (BAAs) | Art. 21(2)(d) |
498| Governance/accountability | Art. 5(2), Art. 24 | §1798.185 (audit regs) | §164.308(a)(1) | Art. 20 (governance) |
499| Right to delete/erasure | Art. 17 | §1798.105 | Limited (retention rules) | N/A |
500| Data portability | Art. 20 | §1798.130(a)(2) | N/A | N/A |
501
502> **Cross-references:** See `../information-security-manager-iso27001/SKILL.md` for ISO 27001 security controls, and `../mdr-745-specialist/SKILL.md` for healthcare device data protection under MDR.
503
504---
505
506## Cross-Framework Privacy Integration
507
508### GDPR ↔ CCPA/CPRA Comparison
509
510| Aspect | GDPR | CCPA/CPRA |
511|--------|------|-----------|
512| Scope | Any org processing EU residents' data | $25M+ revenue, 100K+ consumers, or 50%+ revenue from selling PI |
513| Legal Basis | 6 legal bases required (Art. 6) | Opt-out model (no legal basis needed for collection) |
514| Consent | Opt-in required | Opt-out for sale/sharing |
515| Right to Delete | Art. 17 | §1798.105 |
516| Data Portability | Art. 20 | §1798.130 |
517| Penalties | Up to €20M or 4% global turnover | $2,500-$7,500 per violation |
518| DPO Required | Yes (in many cases) | No |
519| DPIA Required | Yes (high risk processing) | Risk assessments (CPRA) |
520
521### AI-Specific GDPR Requirements
522
523- **Automated Decision-Making (Art. 22):** Right not to be subject to decisions based solely on automated processing with legal/significant effects
524- **AI Training Data:** Legitimate interest or consent required; purpose limitation applies to model training
525- **Profiling:** Requires explicit consent for automated profiling with significant effects
526- **EU AI Act Integration:** High-risk AI systems processing personal data require DPIA per Art. 35 GDPR
527- **Cross-reference:** See `eu-ai-act-specialist` for AI-specific compliance
528
529### Infrastructure Privacy Controls
530
531- **Cookie Consent:** TCF 2.2 compliant consent management platform (CMP)
532- **Global Privacy Control (GPC):** Must honor GPC browser signals (also CCPA requirement)
533- **Data Localization:** EU data residency requirements, Schrems II adequacy decisions
534- **Cross-Border Transfers:** Standard Contractual Clauses (SCCs), adequacy decisions, binding corporate rules
535- **Privacy by Design Controls:** Data minimization, pseudonymization, encryption at rest/transit, access logging
536
537### Cross-Framework Mapping
538
539| Control | GDPR | CCPA | HIPAA | NIS2 |
540|---------|------|------|-------|------|
541| Privacy Notice | Art. 13-14 | §1798.100 | Privacy Practices | — |
542| Data Subject Rights | Art. 15-22 | §1798.100-125 | Access/Amendment | — |
543| Breach Notification | Art. 33-34 | §1798.150 | §164.404-408 | Art. 23 |
544| DPO/Privacy Officer | Art. 37-39 | — | Privacy Officer | — |
545| Risk Assessment | Art. 35 (DPIA) | Risk Assessment | §164.308(a)(1) | Art. 21 |
546| Encryption | Art. 32 | Reasonable Security | §164.312(a)(2)(iv) | Art. 21.2.h |
547| Training | Art. 39.1.b | — | §164.308(a)(5) | Art. 21.2.g |
548
549---
550
551## Troubleshooting
552
553| Problem | Possible Cause | Resolution |
554|---------|---------------|------------|
555| Compliance checker reports critical findings for special category data | Code processes health, biometric, or religious data without explicit consent or Art. 9(2) exception | Identify all special category data processing; secure explicit consent or document applicable Art. 9(2) exception; implement field-level encryption for sensitive fields |
556| DPIA generator determines assessment required but organization has no DPIA process | Processing triggers Art. 35(3) criteria (systematic monitoring, large-scale special categories, or automated decision-making) | Follow the DPIA methodology in `references/dpia_methodology.md`; generate template with `dpia_generator.py --template`; consult DPO before proceeding; consider prior consultation with supervisory authority if high residual risk (Art. 36) |
557| Data subject rights requests consistently exceed 30-day deadline | Manual fulfillment without tracking system, unclear data location, or complex verification requirements | Deploy `data_subject_rights_tracker.py` for automated deadline monitoring; map all personal data locations using data inventory; streamline identity verification to proportionate measures |
558| Cross-border transfer mechanism invalidated or uncertain | Reliance on deprecated mechanism or Transfer Impact Assessment not completed for SCCs | Review current adequacy decisions (UK, Japan, South Korea, US via DPF); for SCCs, complete Transfer Impact Assessment per Schrems II requirements; document supplementary measures (encryption, pseudonymization) |
559| Cookie consent banner flagged as non-compliant | Pre-checked boxes, cookie wall blocking access, or reject button harder to find than accept | Implement TCF 2.2 compliant CMP; ensure all non-essential cookies blocked until explicit consent; make reject as prominent as accept (per Planet49 ruling, CJEU C-673/17); record consent proof |
560| GDPR compliance checker detects personal data in application logs | Application logs contain email addresses, IP addresses, or user identifiers | Implement log sanitization to mask or pseudonymize personal data before storage; configure logging frameworks to exclude PII fields; set log retention limits aligned with purpose |
561| AI system processing personal data lacks Art. 22 safeguards | Automated decision-making produces legal or significant effects without human review mechanism | Implement human-in-the-loop for high-stakes decisions; provide right to explanation and right to contest; document algorithmic logic in plain language; include AI decision-making in privacy notice per Art. 13(2)(f) |
562
563---
564
565## Success Criteria
566
567- **Compliance score of 80+ on codebase scan** -- indicating no critical personal data exposure issues, with all high-risk patterns addressed and documented
568- **All data subject rights requests fulfilled within 30 days** -- tracked via `data_subject_rights_tracker.py` with identity verification completed, response templates generated, and compliance reports showing zero overdue requests
569- **DPIA completed for all high-risk processing activities** -- covering Art. 35(3) triggers, WP29 criteria, risk mitigation measures, and DPO consultation; prior SA consultation documented where required
570- **Records of Processing Activities (Art. 30) maintained and current** -- covering all processing activities with purposes, legal bases, data categories, recipients, retention periods, and transfer mechanisms
571- **Cross-border transfer mechanisms validated** -- adequacy decisions, SCCs with TIA, or BCRs in place for all international data flows, reviewed annually
572- **Cookie consent implementation compliant** -- non-essential cookies blocked until explicit consent, reject as easy as accept, consent proof recorded with timestamp and version, GPC signal honored
573- **DPO appointed and registered where required** -- including German BDSG Section 38 threshold (20+ employees processing personal data automatically), with supervisory authority notification
574
575---
576
577## Scope & Limitations
578
579**In Scope:**
580- Codebase scanning for personal data patterns and risky processing practices
581- DPIA generation following Art. 35 requirements with threshold assessment and risk mitigation
582- Data subject rights request tracking (Art. 15-22) with deadline monitoring and response templates
583- German BDSG-specific requirements (DPO threshold, employment data, video surveillance, credit scoring)
584- Cross-border transfer mechanism assessment (adequacy decisions, SCCs, BCRs, DPF)
585- AI-specific GDPR requirements (Art. 22 automated decisions, training data governance, profiling)
586- Cross-framework privacy mapping (GDPR, CCPA/CPRA, HIPAA, NIS2)
587
588**Out of Scope:**
589- Legal advice on specific legal basis selection or legitimate interest balancing tests -- consult DPO and legal counsel
590- Supervisory authority notification or interaction for breach reporting (Art. 33-34)
591- Implementation of cookie consent management platforms or consent management code
592- GDPR representative appointment logistics for non-EU organizations (Art. 27)
593- Binding Corporate Rules (BCR) application or approval process
594- German Landesdatenschutzgesetze (state-level data protection laws) beyond general guidance
595
596**Important Notes:**
597- GDPR enforcement fines reached EUR 2.3 billion in 2025, a 38% year-over-year increase; healthcare violations spiked with average penalties of EUR 203,000
598- The EU AI Act creates dual obligations for AI systems processing personal data -- both DPIA (GDPR Art. 35) and conformity assessment (AI Act) may apply simultaneously
599- Dark patterns in consent interfaces are under heightened enforcement scrutiny; regulators are penalizing cookie walls, manipulative UI, and buried reject options
600
601---
602
603## Integration Points
604
605| Skill | Integration | When to Use |
606|-------|-------------|-------------|
607| `ccpa-cpra-privacy-expert` | Unified privacy program covering both GDPR and CCPA/CPRA; cross-framework mapping | When organization processes data of both EU residents and California consumers |
608| `eu-ai-act-specialist` | Combined DPIA + AI Act conformity assessment for high-risk AI systems processing personal data | When AI system triggers both GDPR Art. 35 DPIA and EU AI Act high-risk classification |
609| `information-security-manager-iso27001` | ISO 27001 security controls support GDPR Art. 32 security of processing requirements | When implementing technical and organizational measures for personal data protection |
610| `infrastructure-compliance-auditor` | Technical privacy controls validation (encryption, access controls, logging, data masking) | When assessing infrastructure supporting GDPR privacy-by-design requirements |
611| `dora-compliance-expert` | DORA complements GDPR for financial sector ICT systems processing personal data | When financial entity must align DORA ICT security with GDPR data protection requirements |
612
613---
614
615## Tool Reference
616
617### gdpr_compliance_checker.py
618
619Scans codebases for potential GDPR compliance issues including personal data patterns and risky code practices.
620
621| Flag | Required | Description |
622|------|----------|-------------|
623| `<project_dir>` | Yes | Path to project directory to scan |
624| `--json` | No | Output results in JSON format for CI/CD integration |
625| `--output <file>` | No | Export report to specified file path |
626
627**Detects:** Email, phone, IP address, credit card, IBAN, German ID patterns; special category data (health, biometric, religion); risky code patterns (logging PII, missing consent, indefinite retention, unencrypted sensitive data, disabled deletion). **Output:** Compliance score (0-100), risk categorization (critical/high/medium), and prioritized recommendations with GDPR article references.
628
629### dpia_generator.py
630
631Generates Data Protection Impact Assessment documentation following Art. 35 requirements.
632
633| Flag | Required | Description |
634|------|----------|-------------|
635| `--template` | No | Generate blank DPIA input template to stdout |
636| `--input <file>` | Yes (unless `--template` or `--interactive`) | Path to JSON processing activity description |
637| `--output <file>` | No | Export DPIA report to specified file path (markdown format) |
638| `--interactive` | No | Launch interactive mode for guided DPIA creation |
639
640**Features:** Automatic DPIA threshold assessment against Art. 35(3) triggers and WP29 criteria, risk identification based on processing characteristics, legal basis documentation, mitigation recommendations, and markdown report generation.
641
642### data_subject_rights_tracker.py
643
644Manages data subject rights requests under GDPR Articles 15-22 with deadline tracking and response templates.
645
646| Subcommand | Description |
647|------------|-------------|
648| `add` | Add new request (`--type`, `--subject`, `--email` required) |
649| `list` | List all tracked requests |
650| `status` | View or update request status (`--id` required, `--update` to change status) |
651| `report` | Generate compliance report (`--output` for file export) |
652| `template` | Generate response template for specific request (`--id` required) |
653
654| Flag | Description |
655|------|-------------|
656| `--type <right>` | Right type: `access`, `rectification`, `erasure`, `restriction`, `portability`, `objection`, `automated` |
657| `--subject <name>` | Data subject name |
658| `--email <email>` | Data subject email address |
659| `--id <request_id>` | Request identifier (e.g., `DSR-202601-0001`) |
660| `--update <status>` | New status: `received`, `verified`, `in_progress`, `completed`, `denied`, `extended` |
661| `--output <file>` | Export report or template to specified file path |
662
663**Features:** 30-day deadline tracking with overdue alerts, identity verification workflow, response template generation per right type, and compliance reporting with metrics.
borghei