# Gdpr

> Assess GDPR compliance — lawful basis, data mapping, DPIA, rights, transfers, DPO, breach notification

- Skill: `bromso/gdpr` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bromso/gdpr`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bromso/gdpr/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: bromso (https://skillmd.com/u/bromso)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bromso/gdpr

---


# GDPR Assessment

Assess EU General Data Protection Regulation (GDPR) compliance for "$ARGUMENTS". Evaluate lawful basis, data mapping, data subject rights, international transfers, and breach readiness.

## Prerequisites

Read `.metapowers/compliance/$ARGUMENTS/00-scope.md`. If this file does not exist, tell the user:

> Phase 0 (Scope) has not been completed for "$ARGUMENTS". Run `/compliance:regulatory-landscape $ARGUMENTS` first, or use `--skip-checks` to bypass.

If `--skip-checks` is present in $ARGUMENTS, skip this check.

## Process

1. **Read context files:**
   - Read `plugins/compliance/shared/grc-lifecycle-guide.md` for GRC methodology reference
   - Read `plugins/compliance/shared/assessment-template.md` for output structure
   - Read `.metapowers/compliance/$ARGUMENTS/00-scope.md` for scope and control framework context

2. **Lawful basis assessment (Art 6/9):**
   - Identify each processing activity and its claimed lawful basis
   - Assess validity of consent mechanisms (freely given, specific, informed, unambiguous)
   - Evaluate legitimate interest balancing tests where applicable
   - Review special category data processing (Art 9) and additional conditions
   - Document lawful basis per processing activity in a matrix

3. **Data mapping and records of processing (Art 30):**
   - Assess data inventory completeness (what personal data, categories of data subjects)
   - Map data flows (collection points, storage locations, processing systems, recipients)
   - Evaluate retention periods and deletion schedules
   - Review records of processing activities for controllers and processors
   - Identify gaps in data lineage documentation

4. **Data Protection Impact Assessment (Art 35):**
   - Identify high-risk processing requiring DPIA (profiling, large-scale monitoring, sensitive data)
   - Assess existing DPIAs for completeness and quality
   - Evaluate whether prior consultation with supervisory authority is required (Art 36)
   - Review DPIA methodology and risk scoring approach

5. **Data subject rights procedures:**
   - Assess processes for: access (Art 15), rectification (Art 16), erasure (Art 17), restriction (Art 18), portability (Art 20), objection (Art 21)
   - Evaluate response timelines (one month, extension procedures)
   - Review identity verification procedures for requests
   - Assess automated decision-making and profiling safeguards (Art 22)

6. **International transfers:**
   - Map all transfers outside the EEA
   - Assess transfer mechanisms: adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs)
   - Evaluate Schrems II compliance (Transfer Impact Assessments, supplementary measures)
   - Review derogations relied upon (Art 49)

7. **DPO and governance:**
   - Assess whether DPO appointment is required (Art 37)
   - Evaluate DPO independence, resources, and reporting line
   - Review privacy by design and by default implementation (Art 25)

8. **Breach notification readiness:**
   - Assess breach detection capabilities
   - Evaluate notification procedures (72 hours to supervisory authority, without undue delay to data subjects)
   - Review breach severity assessment methodology
   - Check breach register maintenance

9. **Write the artifact** to `.metapowers/compliance/$ARGUMENTS/01-assess/gdpr.md` following the assessment template structure with:
   - **Lawful Basis Matrix** — processing activity to legal basis mapping with validity assessment
   - **Data Mapping Assessment** — data inventory completeness and flow documentation
   - **DPIA Status** — high-risk processing identified and DPIA coverage
   - **Rights Procedures** — readiness score per right
   - **Transfer Mechanisms** — transfer map with mechanism and Schrems II compliance
   - **Governance** — DPO status, privacy by design maturity
   - **Breach Readiness** — detection, notification, and documentation capability
   - **Evidence Inventory** — existing evidence and evidence gaps
   - **Remediation Priorities** — ranked list of gaps to address

## Output

The GDPR assessment written to `.metapowers/compliance/$ARGUMENTS/01-assess/gdpr.md`. Present a summary to the user highlighting:
- Overall compliance score across all assessment areas
- Lawful basis coverage and any unsupported processing activities
- Top 3 gaps requiring remediation
- International transfer risk areas