sboghossian Import: GDPR Privacy Notice (EU)
What it does
This import adapter migrates a GDPR-compliant privacy notice skill into the mini-claude-for-legal standard format. The source skill may have been a drafting template, a review checklist, or both; the adapter detects the mode and maps it to the appropriate skill category (draft or review).
A GDPR privacy notice is a legally mandated transparency document. Articles 13 and 14 of the GDPR prescribe the minimum mandatory content depending on whether data is collected directly from the data subject (Art 13) or obtained from a third-party source (Art 14). Non-compliance can trigger GDPR enforcement and fines up to €20 million or 4% of global annual turnover (whichever is higher).
Import config
| Field | Source mapping | Default if absent |
|---|---|---|
notice_type |
Legacy type field |
art13 (direct collection) |
layered_notice |
Legacy layered boolean |
false |
language |
Legacy lang |
en |
controller_details |
Legacy controller object |
Prompt user |
dpo_contact |
Legacy dpo object |
Prompt user if DPO appointed |
retention_schedule |
Legacy retention table |
Prompt user |
legal_bases |
Legacy bases array |
Prompt user (no default — must be explicit) |
output_format |
Legacy format |
structured_markdown |
Dry-run preview
IMPORT PREVIEW — gdpr-privacy-notice-eu
Source shape : GDPR privacy-notice template
Notice type : Art 13 (direct collection)
Language : English
Layered : No
Controller : [needs population]
Legal bases : [needs population — no default]
Output : structured_markdown
GDPR Article 13 mandatory disclosure checklist
Post-import, the skill verifies or drafts all required elements:
Identity and contact details
- Name and address of controller
- Contact details of DPO (if appointed)
Purpose and legal basis
- Purpose(s) of processing
- Legal basis for each purpose (Art 6; Art 9 if special-category)
- Legitimate interests (if relied on — must be specified, not generic)
Recipients and transfers
- Categories of recipients
- Third-country transfers — adequacy decision or safeguards (SCCs, BCRs)
Retention
- Retention period or criteria used to determine it
Data subject rights
- Right of access (Art 15)
- Right to rectification (Art 16)
- Right to erasure (Art 17)
- Right to restriction (Art 18)
- Right to data portability (Art 20) — where applicable
- Right to object (Art 21) — where applicable
- Right to withdraw consent (Art 7(3)) — where processing based on consent
- Right to lodge complaint with supervisory authority
Automated decision-making
- Existence of automated decision-making including profiling (Art 22)
- Logic involved and significance of consequences
Layered notice structure
When layered_notice: true, the skill produces:
- Layer 1 (condensed — max 200 words): who is collecting, for what purpose, and how to find out more
- Layer 2 (full notice): all Art 13/14 mandatory elements
- Layer 3 (supplementary): technical annexes (retention schedule, sub-processor list)
Jurisdictional notes
| Jurisdiction | Key addition vs GDPR baseline |
|---|---|
| France (CNIL) | French language required for consumer-facing notices; CNIL recommends explicit mention of right to define post-death data directives (Loi Informatique et Libertés Art 85) |
| UK (ICO) | UK GDPR post-Brexit; ICO Right to Know format preferred; mention ICO as competent authority (not EDPB) |
| UAE (PDPL) | Federal Decree-Law 45/2021 requires privacy notice to data subject at time of collection; include UAE competent authority reference |
| Lebanon | No enacted DPL; GDPR-standard notice used contractually or as best practice |
| Egypt | Data Protection Law 151/2020; privacy notice required; Arabic language advisable for domestic data subjects |
Common import issues
| Issue | Resolution |
|---|---|
| Legal bases left blank | These cannot be defaulted — prompt user to confirm each processing purpose's legal basis explicitly |
| Retention period missing | Flag as HIGH-risk gap; a notice without retention information violates Art 13(2)(a) |
| US-style notice imported | Strip "California Privacy Rights" sections; re-map to GDPR rights catalogue |
| Multiple controllers | Add joint-controller arrangement reference (Art 26) |
Related skills
- [[import-politique-confidentialite-fr]]
- [[import-dpia-sentinel]]
- [[import-gdpr-breach-sentinel]]
- [[draft-privacy-notice-gdpr]]
- [[kb-gdpr-data-protection]]