GDPR Data Handling
FreeImplement GDPR-compliant data processing and consent management.
Free · Opens the source repo
What GDPR Data Handling does
The GDPR Data Handling skill provides a practical guide for developers and designers to implement systems that comply with the General Data Protection Regulation (GDPR). This skill is essential for anyone building applications that process personal data of EU citizens, ensuring that user data is handled with the necessary privacy controls and consent management practices. By following the guidelines outlined in this skill, users can effectively manage data subject rights and maintain compliance during their data processing activities.
This skill covers core concepts such as personal data categories, legal bases for processing, and the rights of data subjects. It details the types of personal data, ranging from basic information like names and emails to more sensitive categories that require explicit consent. The skill also outlines the legal bases under which data can be processed, helping users understand when and how to collect and use personal data legally.
In addition to theoretical knowledge, the skill offers practical implementation patterns and best practices for GDPR compliance. Users will learn to minimize data collection, document processing activities, and implement robust security measures like encryption and access controls. The skill emphasizes the importance of responding to data subject access requests (DSARs) within the required timeframe and provides strategies for conducting regular compliance audits.
This skill is particularly useful for software developers, data protection officers, and compliance teams who need to ensure that their systems are designed with privacy in mind. By integrating these practices into their workflows, users can build trust with their customers and mitigate the risks associated with non-compliance.
When to use it
Use this skill when building applications that handle EU personal data, particularly when implementing consent management and responding to data subject requests.
When not to use it
This skill may not be suitable for projects outside the scope of GDPR compliance or those that do not involve the processing of personal data.
What you can build with it
Building GDPR-Compliant Applications
Use this skill to guide the development of applications that process personal data, ensuring compliance with GDPR.
Implementing Consent Management Systems
Leverage this skill to establish effective consent management practices that align with GDPR requirements.
Conducting GDPR Compliance Reviews
Utilize the guidelines in this skill to perform thorough reviews of existing systems for GDPR compliance.
How to install GDPR Data Handling
View source1. Install with the skills CLI
npx skills add wshobson/agents/gdpr-data-handling --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by wshobsonGDPR Data Handling
Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.
When to Use This Skill
- Building systems that process EU personal data
- Implementing consent management
- Handling data subject requests (DSRs)
- Conducting GDPR compliance reviews
- Designing privacy-first architectures
- Creating data processing agreements
Core Concepts
1. Personal Data Categories
| Category | Examples | Protection Level |
|---|---|---|
| Basic | Name, email, phone | Standard |
| Sensitive (Art. 9) | Health, religion, ethnicity | Explicit consent |
| Criminal (Art. 10) | Convictions, offenses | Official authority |
| Children's | Under 16 data | Parental consent |
2. Legal Bases for Processing
Article 6 - Lawful Bases:
├── Consent: Freely given, specific, informed
├── Contract: Necessary for contract performance
├── Legal Obligation: Required by law
├── Vital Interests: Protecting someone's life
├── Public Interest: Official functions
└── Legitimate Interest: Balanced against rights
3. Data Subject Rights
Right to Access (Art. 15) ─┐
Right to Rectification (Art. 16) │
Right to Erasure (Art. 17) │ Must respond
Right to Restrict (Art. 18) │ within 1 month
Right to Portability (Art. 20) │
Right to Object (Art. 21) ─┘
Detailed worked examples and patterns
Detailed sections (starting with ## Implementation Patterns) live in references/details.md. Read that file when the navigation summary above is insufficient.
Best Practices
Do's
- Minimize data collection - Only collect what's needed
- Document everything - Processing activities, legal bases
- Encrypt PII - At rest and in transit
- Implement access controls - Need-to-know basis
- Regular audits - Verify compliance continuously
Don'ts
- Don't pre-check consent boxes - Must be opt-in
- Don't bundle consent - Separate purposes separately
- Don't retain indefinitely - Define and enforce retention
- Don't ignore DSARs - 30-day response required
- Don't transfer without safeguards - SCCs or adequacy decisions
Frequently asked questions about GDPR Data Handling
Similar skills
Spring Boot Testing
Master testing techniques for Spring Boot 4 applications.
GitHub Issues
Manage GitHub issues efficiently with MCP tools.
Geofeed Tuner
Optimize your IP geolocation feeds in CSV format.
Batch Files
Master Windows batch scripting for automation and task management.
Adobe Illustrator Scripting
Automate your Illustrator workflows with ExtendScript.
Plugin Structure
Create and organize Claude Code plugins effectively.