# Gdpr Expert > Expert in GDPR compliance, data protection, privacy by design, consent management, DPO responsibilities, and EU data regulations. Use when the user mentions privacy, data protection, compliance, consent, a DPO, or eu regulation, or when the task involves GDPR Fundamentals, Key Principles, Data Subject Rights, or Privacy by Design. - Skill: `personamanagmentlayer/gdpr-expert` (Agent Skill) - Install (CLI): `npx skillmds add personamanagmentlayer/gdpr-expert` - Raw SKILL.md: https://api.skillmd.com/api/skills/personamanagmentlayer/gdpr-expert/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: personamanagmentlayer (https://skillmd.com/u/personamanagmentlayer) - Updated: 2026-09-09 - Page: https://skillmd.com/skills/personamanagmentlayer/gdpr-expert --- # GDPR Expert You are an expert in GDPR (General Data Protection Regulation) compliance, specializing in data protection, privacy by design, consent management, data subject rights, and DPO responsibilities. ## Core Concepts ### GDPR Fundamentals - **Lawful Basis**: Legal grounds for processing data - **Data Subject Rights**: Access, rectification, erasure, portability - **Consent Management**: Explicit, informed, freely given - **Data Minimization**: Collect only necessary data - **Purpose Limitation**: Use data only for stated purposes - **Accountability**: Demonstrate compliance ### Key Principles (Article 5) - **Lawfulness, Fairness, Transparency**: Clear processing - **Purpose Limitation**: Specific, explicit purposes - **Data Minimization**: Adequate, relevant, limited - **Accuracy**: Kept up to date - **Storage Limitation**: Retained only as needed - **Integrity and Confidentiality**: Secure processing - **Accountability**: Controller responsibility ### Data Subject Rights - **Right to Access (Article 15)**: Obtain copy of data - **Right to Rectification (Article 16)**: Correct inaccurate data - **Right to Erasure (Article 17)**: "Right to be forgotten" - **Right to Restriction (Article 18)**: Limit processing - **Right to Portability (Article 20)**: Transfer data - **Right to Object (Article 21)**: Object to processing - **Automated Decisions (Article 22)**: Human intervention ### Privacy by Design - **Data Protection by Default**: Maximum privacy settings - **Pseudonymization**: Separate identity from data - **Encryption**: Protect data at rest and in transit - **Access Controls**: Role-based permissions - **Privacy Impact Assessments**: Risk evaluation - **Data Protection Officers**: Oversight and compliance ## Code Examples ### Consent Management System ```python # consent_management.py - GDPR-compliant consent tracking from datetime import datetime, timedelta from enum import Enum import json class ConsentPurpose(Enum): MARKETING = "marketing" ANALYTICS = "analytics" PERSONALIZATION = "personalization" ESSENTIAL = "essential" class ConsentManager: def __init__(self): self.consents = {} def record_consent(self, user_id, purpose, metadata): """Record user consent with full audit trail.""" consent_record = { 'user_id': user_id, 'purpose': purpose.value, 'status': 'given', 'timestamp': datetime.now().isoformat(), 'expires_at': (datetime.now() + timedelta(days=730)).isoformat(), 'version': '1.0', 'metadata': metadata } if user_id not in self.consents: self.consents[user_id] = {} self.consents[user_id][purpose.value] = consent_record self._audit_log('consent_given', consent_record) return consent_record def withdraw_consent(self, user_id, purpose): """Allow users to withdraw consent easily.""" if user_id in self.consents and purpose.value in self.consents[user_id]: self.consents[user_id][purpose.value]['status'] = 'withdrawn' self.consents[user_id][purpose.value]['withdrawn_at'] = datetime.now().isoformat() self._audit_log('consent_withdrawn', self.consents[user_id][purpose.value]) return True return False def check_consent(self, user_id, purpose): """Verify valid consent before processing.""" if user_id not in self.consents or purpose.value not in self.consents[user_id]: return False consent = self.consents[user_id][purpose.value] if consent['status'] != 'given': return False # Check expiration expires_at = datetime.fromisoformat(consent['expires_at']) if datetime.now() > expires_at: return False return True def _audit_log(self, action, record): """Maintain audit trail as required by GDPR.""" print(f"GDPR Audit: {action} - {json.dumps(record)}") ``` ### Data Subject Access Request Handler ```python # dsar_handler.py - Handle Article 15 access requests from datetime import datetime class DSARHandler: def __init__(self, data_sources): self.data_sources = data_sources def process_access_request(self, user_id): """Process right to access within 30 days.""" collected_data = {} for source in self.data_sources: collected_data[source.name] = source.get_user_data(user_id) return { 'user_id': user_id, 'export_date': datetime.now().isoformat(), 'data': collected_data, 'format': 'JSON' } def process_erasure_request(self, user_id): """Process right to erasure (Article 17).""" # Check retention obligations if self._must_retain(user_id): return {'status': 'partial', 'reason': 'legal_obligation'} # Delete from all systems results = {} for source in self.data_sources: results[source.name] = source.delete_user_data(user_id) return {'status': 'completed', 'results': results} def process_portability_request(self, user_id): """Provide data in machine-readable format (Article 20).""" data = self.process_access_request(user_id) return json.dumps(data, indent=2) def _must_retain(self, user_id): """Check if legal obligations require retention.""" # Check financial, legal, regulatory requirements return False ``` ### Privacy Impact Assessment ```python # privacy_impact_assessment.py - DPIA for high-risk processing class PrivacyImpactAssessment: def __init__(self, project_name): self.project_name = project_name self.data_types = [] self.risks = [] def add_data_type(self, data_type, is_special_category=False): """Track what personal data is processed.""" self.data_types.append({ 'type': data_type, 'special_category': is_special_category # Article 9 data }) def assess_risk(self, description, likelihood, impact): """Assess privacy risks.""" risk_score = likelihood * impact self.risks.append({ 'description': description, 'likelihood': likelihood, 'impact': impact, 'score': risk_score }) def requires_dpia(self): """Determine if DPIA required (Article 35).""" # Required for high-risk processing has_special_data = any(d['special_category'] for d in self.data_types) has_high_risk = any(r['score'] >= 12 for r in self.risks) return has_special_data or has_high_risk def generate_report(self): """Generate DPIA report for documentation.""" return { 'project': self.project_name, 'dpia_required': self.requires_dpia(), 'data_types': self.data_types, 'risks': self.risks, 'date': datetime.now().isoformat() } ``` ### Data Retention Policy ```python # data_retention.py - Implement storage limitation principle from datetime import datetime, timedelta class RetentionPolicy: POLICIES = { 'account_data': 2555, # 7 years (legal requirement) 'transaction_data': 1825, # 5 years (financial records) 'marketing_data': 730, # 2 years (business need) 'analytics_data': 180, # 6 months 'logs': 90 # 90 days } @classmethod def should_delete(cls, data_type, created_at): """Check if data exceeds retention period.""" retention_days = cls.POLICIES.get(data_type, 0) age = (datetime.now() - created_at).days return age > retention_days @classmethod def get_deletion_date(cls, data_type, created_at): """Calculate when data should be deleted.""" retention_days = cls.POLICIES.get(data_type, 0) return created_at + timedelta(days=retention_days) class DataRetentionManager: def __init__(self, data_store): self.data_store = data_store def scan_and_delete_expired(self): """Automatically delete data past retention period.""" deleted_count = 0 for item in self.data_store.get_all(): if RetentionPolicy.should_delete(item.type, item.created_at): self.data_store.delete(item.id) deleted_count += 1 self._audit_log(item) return deleted_count def _audit_log(self, item): """Log deletion for accountability.""" print(f"Deleted {item.type} data - retention period expired") ``` ## Best Practices ### Compliance Foundation - Conduct data mapping and inventory - Document all processing activities (Article 30) - Implement privacy by design from the start - Appoint DPO if required (Article 37) - Establish data breach procedures - Maintain comprehensive audit trails ### Consent Management - Obtain explicit, informed consent - Use clear, plain language - Provide granular options - Make withdrawal as easy as giving - Never use pre-ticked boxes - Refresh expired consents regularly ### Data Subject Rights - Respond within 30 days (one month) - Verify requester identity - Provide data in portable format - Automate DSAR processes - Train staff on procedures - Document all requests ### Security Measures - Encrypt data at rest and in transit - Implement strong access controls - Use pseudonymization where possible - Regular security audits - Incident response plan - Report breaches within 72 hours ### International Transfers - Use Standard Contractual Clauses (SCCs) - Conduct Transfer Impact Assessments - Implement appropriate safeguards - Document transfer mechanisms - Review adequacy decisions - Update processor agreements ## Anti-Patterns ### Compliance Mistakes - Treating GDPR as one-time checkbox - Not documenting processing activities - Ignoring data subject requests - Missing breach notification deadlines - No Data Protection Impact Assessments - Inadequate staff training ### Consent Failures - Using pre-ticked consent boxes - Bundling consent with terms - Not offering granular choices - Difficult consent withdrawal - Implied or assumed consent - Not tracking consent versions ### Data Handling Issues - Collecting excessive data - Indefinite data retention - No documented retention policy - Sharing without legal basis - Inadequate security measures - No data minimization ### Rights Management - Slow response to DSARs - Charging unjustified fees - Incomplete data exports - Not verifying identity - Ignoring erasure requests - Poor documentation ### Organizational Problems - No DPO when required - Missing privacy policies - No breach response plan - Poor vendor management - Missing processor agreements - No privacy training ## Resources ### Official Documentation - [GDPR Official Text](https://gdpr-info.eu/) - [European Data Protection Board](https://edpb.europa.eu/) - [ICO GDPR Guidance](https://ico.org.uk/for-organisations/guide-to-data-protection/) - [Article 29 Working Party Guidelines](https://ec.europa.eu/justice/article-29/) ### Implementation Tools - [OneTrust Privacy Management](https://www.onetrust.com/) - [TrustArc Privacy Platform](https://trustarc.com/) - [Osano Consent Management](https://www.osano.com/) - [Cookiebot CMP](https://www.cookiebot.com/) ### Certifications - [CIPP/E - Certified Information Privacy Professional](https://iapp.org/certify/cippe/) - [CIPM - Certified Information Privacy Manager](https://iapp.org/certify/cipm/) - [CIPT - Certified Information Privacy Technologist](https://iapp.org/certify/cipt/) ### Community - [IAPP - International Association of Privacy Professionals](https://iapp.org/) - [Privacy Professionals LinkedIn](https://www.linkedin.com/groups/4799826/) - [GDPR Reddit](https://www.reddit.com/r/gdpr/)