This source did not publish a separate summary. Review SKILL.md before using the skill.
SKILL.md
Implementing GDPR Data Protection Controls
Overview
The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill covers implementing the technical and organizational measures required by GDPR, including data protection by design and by default, Data Protection Impact Assessments (DPIAs), data subject rights management, breach notification procedures, and cross-border data transfer mechanisms.
When to Use
When deploying or configuring implementing gdpr data protection controls capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Understanding of EU data protection law and its territorial scope
Knowledge of personal data processing activities within the organization
Familiarity with data architecture, databases, and application systems
Understanding of data flows including cross-border transfers
Core Concepts
Key GDPR Articles for Technical Controls
Article
Requirement
Art. 5
Principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability
Art. 6
Lawful basis for processing (consent, contract, legal obligation, vital interests, public task, legitimate interest)
Art. 25
Data protection by design and by default
Art. 28
Processor obligations and contractual requirements
Art. 30
Records of processing activities (ROPA)
Art. 32
Security of processing (technical and organizational measures)
Art. 33
Breach notification to supervisory authority (72 hours)
Art. 34
Communication of breach to data subjects
Art. 35
Data Protection Impact Assessment (DPIA)
Art. 37-39
Data Protection Officer (DPO) appointment and role
Art. 44-49
Cross-border data transfers (adequacy, SCCs, BCRs)
Article 32 Security Measures
The regulation requires organizations to implement measures appropriate to the risk:
Pseudonymization and encryption of personal data
Confidentiality, integrity, availability, and resilience of processing systems
Ability to restore availability and access to personal data in a timely manner
Regular testing and evaluation of technical and organizational measures
Data Subject Rights (Articles 12-22)
Right
Article
Description
Right to be informed
13-14
Transparent information about processing
Right of access
15
Obtain copy of personal data
Right to rectification
16
Correct inaccurate data
Right to erasure
17
"Right to be forgotten"
Right to restrict processing
18
Limit processing of data
Right to data portability
20
Receive data in machine-readable format
Right to object
21
Object to processing (especially direct marketing)
Automated decision-making
22
Not be subject to solely automated decisions
Workflow
Phase 1: Data Mapping and Assessment (Weeks 1-6)
Create comprehensive data inventory:
What personal data is collected
From whom (data subjects)
Why (purposes and lawful bases)
Where it's stored (systems, locations, countries)
Who has access (internal and external)
How long it's retained
What security measures protect it
Document Records of Processing Activities (ROPA) per Article 30
Identify lawful basis for each processing activity
Map cross-border data transfers and transfer mechanisms
Identify processing activities requiring DPIA
Phase 2: Gap Analysis and Risk Assessment (Weeks 7-10)
Assess current state against GDPR requirements
Perform DPIAs for high-risk processing activities
Identify security gaps in Article 32 compliance
Evaluate data retention compliance
Assess data subject rights request handling capabilities
