# Data Protection

> Data protection, privacy-by-design, GDPR compliance, data classification, and secure data handling practices

- Skill: `hack23/data-protection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add hack23/data-protection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hack23/data-protection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: Hack23 (https://skillmd.com/u/hack23)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/hack23/data-protection

---


# Data Protection Skill


## 🔴 AI FIRST Quality Principle

> **Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.**

## Purpose
Defines data protection practices ensuring privacy-by-design, GDPR compliance, and secure data handling across all Hack23 projects.

## Data Classification Levels
| Level | Description | Handling |
|-------|-------------|----------|
| PUBLIC | Open data, published information | No restrictions |
| INTERNAL | Operational data, system metadata | Access controlled |
| CONFIDENTIAL | Personal data, business sensitive | Encrypted, logged |
| RESTRICTED | Credentials, keys, PII aggregation | Encrypted, MFA required |

## Privacy-by-Design Principles
1. **Proactive** — Prevent privacy issues before they occur
2. **Default** — Maximum privacy as default setting
3. **Embedded** — Privacy built into design
4. **Positive-Sum** — Privacy AND functionality
5. **End-to-End** — Full lifecycle protection
6. **Transparency** — Open and documented
7. **User-Centric** — Respect user privacy

## GDPR Requirements
- Lawful basis for processing
- Data minimization (collect only what's needed)
- Purpose limitation
- Storage limitation (retention policies)
- Data subject rights (access, deletion, portability)
- Privacy impact assessments for new features

## Static Site Considerations
- No cookies without consent
- Privacy-preserving analytics only
- No tracking pixels or fingerprinting
- Secure external links (rel="noopener noreferrer")
- No PII in URLs or query parameters

## ISO 27001 Mapping
- A.5.34 — Privacy and protection of PII
- A.8.11 — Data masking
- A.8.12 — Data leakage prevention

## Related Policies
- [Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md)