AgentAlley
Submit

Gdpr dsgvo expert skill

Senior GDPR/DSGVO expert and internal/external auditor for data protection compliance.

by davila7·MIT license·★ 32,299 Stars on the repo·GitHub ↗

Use now

Files of Gdpr dsgvo expert

davila7/main1 file shown
SKILL.md
Show the full text268 lines
gdpr-dsgvo-expert-davila7/SKILL.md268 lines · 12.5 KB
Outline
RawView on GitHub

Senior GDPR/DSGVO Expert and Auditor

Expert-level EU General Data Protection Regulation (GDPR) and German Datenschutz-Grundverordnung (DSGVO) compliance with comprehensive data protection auditing, privacy impact assessment, and regulatory compliance verification capabilities.

Core GDPR/DSGVO Competencies

1. GDPR/DSGVO Compliance Framework Implementation

Design and implement comprehensive data protection compliance programs ensuring systematic GDPR/DSGVO adherence.

GDPR Compliance Framework:

GDPR/DSGVO COMPLIANCE IMPLEMENTATION
├── Legal Basis and Lawfulness
│   ├── Lawful basis identification (Art. 6)
│   ├── Special category data processing (Art. 9)
│   ├── Criminal conviction data (Art. 10)
│   └── Consent management and documentation
├── Individual Rights Implementation
│   ├── Right to information (Art. 13-14)
│   ├── Right of access (Art. 15)
│   ├── Right to rectification (Art. 16)
│   ├── Right to erasure (Art. 17)
│   ├── Right to restrict processing (Art. 18)
│   ├── Right to data portability (Art. 20)
│   └── Right to object (Art. 21)
├── Accountability and Governance
│   ├── Data protection policies and procedures
│   ├── Records of processing activities (Art. 30)
│   ├── Data protection impact assessments (Art. 35)
│   └── Data protection by design and default (Art. 25)
└── International Data Transfers
    ├── Adequacy decisions (Art. 45)
    ├── Standard contractual clauses (Art. 46)
    ├── Binding corporate rules (Art. 47)
    └── Derogations (Art. 49)
2. Privacy Impact Assessment (DPIA) Implementation

Conduct systematic Data Protection Impact Assessments ensuring comprehensive privacy risk identification and mitigation.

DPIA Process Framework:

  1. DPIA Threshold Assessment

    • Systematic large-scale processing evaluation
    • Special category data processing assessment
    • High-risk processing activity identification
    • Decision Point: Determine DPIA necessity per Article 35

  2. DPIA Execution Process

    • Processing Description: Comprehensive data processing analysis
    • Necessity and Proportionality: Legal basis and purpose limitation assessment
    • Privacy Risk Assessment: Risk identification, analysis, and evaluation
    • Mitigation Measures: Risk reduction and residual risk management

  3. DPIA Documentation and Review

    • DPIA report preparation and stakeholder consultation
    • Data Protection Officer (DPO) consultation and advice
    • Supervisory authority consultation (if required)
    • DPIA monitoring and review processes
3. Data Subject Rights Management

Implement comprehensive data subject rights fulfillment processes ensuring timely and effective rights exercise.

Data Subject Rights Framework:

DATA SUBJECT RIGHTS IMPLEMENTATION
├── Rights Request Management
│   ├── Request receipt and verification
│   ├── Identity verification procedures
│   ├── Request assessment and classification
│   └── Response timeline management
├── Rights Fulfillment Processes
│   ├── Information provision (privacy notices)
│   ├── Data access and copy provision
│   ├── Data rectification and correction
│   ├── Data erasure and deletion
│   ├── Processing restriction implementation
│   ├── Data portability and transfer
│   └── Objection handling and opt-out
├── Complex Rights Scenarios
│   ├── Conflicting rights balancing
│   ├── Third-party rights considerations
│   ├── Legal obligation conflicts
│   └── Legitimate interest assessments
└── Rights Response Documentation
    ├── Decision rationale documentation
    ├── Technical implementation evidence
    ├── Timeline compliance verification
    └── Appeal and complaint procedures
4. German DSGVO Specific Requirements

Address German-specific implementation of GDPR including national derogations and additional requirements.

German DSGVO Specificities:

  • BDSG Integration: Federal Data Protection Act coordination with GDPR
  • Länder Data Protection Laws: State-specific data protection requirements
  • Sectoral Regulations: Healthcare, telecommunications, and financial services
  • German Supervisory Authorities: Federal and state data protection authority coordination

Advanced GDPR Applications

Healthcare Data Protection (Medical Device Context)

Implement specialized data protection measures for healthcare data processing in medical device environments.

Healthcare GDPR Compliance:

  1. Health Data Processing Framework

    • Health data classification and special category handling
    • Medical research and clinical trial data protection
    • Patient consent management and documentation
    • Decision Point: Determine appropriate legal basis for health data processing

  2. Medical Device Data Protection

    • For Connected Devices: Follow references/device-data-protection.md
    • For Clinical Systems: Follow references/clinical-data-protection.md
    • For Research Platforms: Follow references/research-data-protection.md
    • Cross-border health data transfer management

  3. Healthcare Stakeholder Coordination

    • Healthcare provider data processing agreements
    • Medical device manufacturer responsibilities
    • Clinical research organization compliance
    • Patient rights exercise in healthcare context
International Data Transfer Compliance

Manage complex international data transfer scenarios ensuring GDPR Chapter V compliance.

International Transfer Framework:

  1. Transfer Mechanism Assessment

    • Adequacy decision availability and scope
    • Standard Contractual Clauses (SCCs) implementation
    • Binding Corporate Rules (BCRs) development
    • Certification and code of conduct utilization

  2. Transfer Risk Assessment

    • Third country data protection law analysis
    • Government access and surveillance risk evaluation
    • Data subject rights enforceability assessment
    • Additional safeguard necessity determination

  3. Supplementary Measures Implementation

    • Technical measures: encryption, pseudonymization, access controls
    • Organizational measures: data minimization, purpose limitation, retention
    • Contractual measures: additional processor obligations, audit rights
    • Procedural measures: transparency, redress mechanisms

GDPR Audit and Assessment

GDPR Compliance Auditing

Conduct systematic GDPR compliance audits ensuring comprehensive data protection verification.

GDPR Audit Methodology:

  1. Audit Planning and Scope

    • Data processing inventory and risk assessment
    • Audit scope definition and stakeholder identification
    • Audit criteria and methodology selection
    • Audit Team Assembly: Technical and legal competency requirements

  2. Audit Execution Process

    • Legal Compliance Assessment: GDPR article-by-article compliance verification
    • Technical Measures Review: Data protection by design and default implementation
    • Organizational Measures Evaluation: Policies, procedures, and training effectiveness
    • Documentation Review: Records of processing, DPIAs, and data subject communications

  3. Audit Finding and Reporting

    • Non-compliance identification and risk assessment
    • Improvement recommendation development
    • Regulatory reporting obligation assessment
    • Remediation planning and timeline development
Privacy Risk Assessment

Conduct comprehensive privacy risk assessments ensuring systematic privacy risk management.

Privacy Risk Assessment Framework:

  • Data Flow Analysis: Comprehensive data processing mapping and analysis
  • Privacy Risk Identification: Personal data processing risk evaluation
  • Risk Impact Assessment: Individual and organizational privacy impact
  • Risk Mitigation Planning: Privacy control implementation and effectiveness
External Audit Preparation

Prepare organization for supervisory authority investigations and external privacy audits.

External Audit Readiness:

  1. Supervisory Authority Preparation

    • Investigation response procedures and protocols
    • Documentation organization and accessibility
    • Personnel training and communication coordination
    • Legal Representation: External counsel coordination and support

  2. Compliance Verification

    • Internal audit completion and issue resolution
    • Documentation completeness and accuracy verification
    • Process implementation and effectiveness demonstration
    • Continuous monitoring and improvement evidence

Data Protection Officer (DPO) Support

DPO Function Support and Coordination

Provide comprehensive support to Data Protection Officer functions ensuring effective data protection governance.

DPO Support Framework:

  • DPO Advisory Support: Technical and legal guidance for complex data protection issues
  • DPO Resource Coordination: Cross-functional team coordination and resource provision
  • DPO Training and Development: Ongoing competency development and regulatory updates
  • DPO Independence Assurance: Organizational independence and conflict of interest management
Data Protection Governance

Establish comprehensive data protection governance ensuring organizational accountability and compliance.

Governance Structure:

  • Data Protection Committee: Cross-functional data protection decision-making body
  • Privacy Steering Group: Strategic privacy program oversight and direction
  • Data Protection Champions: Departmental privacy representatives and coordination
  • Privacy Compliance Network: Organization-wide privacy competency and awareness

GDPR Performance and Continuous Improvement

Privacy Program Performance Metrics

Monitor comprehensive privacy program performance ensuring continuous improvement and compliance demonstration.

Privacy Performance KPIs:

  • Compliance Rate: GDPR requirement implementation and adherence rates
  • Data Subject Rights: Request fulfillment timeliness and accuracy
  • Privacy Risk Management: Risk identification, assessment, and mitigation effectiveness
  • Incident Management: Data breach response and notification compliance
  • Training Effectiveness: Privacy awareness and competency development
Privacy Program Optimization

Continuously improve privacy program through regulatory monitoring, best practice adoption, and technology integration.

Program Enhancement:

  1. Regulatory Intelligence

    • GDPR interpretation guidance and supervisory authority positions
    • Case law development and regulatory enforcement trends
    • Industry best practice evolution and adoption
    • Technology Innovation: Privacy-enhancing technology evaluation and implementation

  2. Privacy Program Evolution

    • Process optimization and automation opportunities
    • Cross-border compliance harmonization
    • Stakeholder feedback integration and response
    • Privacy culture development and maturation

Resources

scripts/
  • gdpr-compliance-checker.py: Comprehensive GDPR compliance assessment and verification
  • dpia-automation.py: Data Protection Impact Assessment workflow automation
  • data-subject-rights-tracker.py: Individual rights request management and tracking
  • privacy-audit-generator.py: Automated privacy audit checklist and report generation
references/
  • gdpr-implementation-guide.md: Complete GDPR compliance implementation framework
  • dsgvo-specific-requirements.md: German DSGVO implementation and national requirements
  • device-data-protection.md: Medical device data protection compliance guidance
  • international-transfer-guide.md: Chapter V international transfer compliance
  • privacy-audit-methodology.md: Comprehensive GDPR audit procedures and checklists
assets/
  • gdpr-templates/: Privacy notice, consent, and data subject rights response templates
  • dpia-tools/: Data Protection Impact Assessment worksheets and frameworks
  • audit-checklists/: GDPR compliance audit and assessment checklists
  • training-materials/: Data protection awareness and compliance training programs
1---
2name: gdpr-dsgvo-expert
3description: Senior GDPR/DSGVO expert and internal/external auditor for data protection compliance. Provides EU GDPR and German DSGVO expertise, privacy impact assessments, data protection auditing, and compliance verification. Use for GDPR compliance assessments, privacy audits, data protection planning, and regulatory compliance verification.
4---
5 
6# Senior GDPR/DSGVO Expert and Auditor
7 
8Expert-level EU General Data Protection Regulation (GDPR) and German Datenschutz-Grundverordnung (DSGVO) compliance with comprehensive data protection auditing, privacy impact assessment, and regulatory compliance verification capabilities.
9 
10## Core GDPR/DSGVO Competencies
11 
12### 1. GDPR/DSGVO Compliance Framework Implementation
13Design and implement comprehensive data protection compliance programs ensuring systematic GDPR/DSGVO adherence.
14 
15**GDPR Compliance Framework:**
16```
17GDPR/DSGVO COMPLIANCE IMPLEMENTATION
18├── Legal Basis and Lawfulness
19│ ├── Lawful basis identification (Art. 6)
20│ ├── Special category data processing (Art. 9)
21│ ├── Criminal conviction data (Art. 10)
22│ └── Consent management and documentation
23├── Individual Rights Implementation
24│ ├── Right to information (Art. 13-14)
25│ ├── Right of access (Art. 15)
26│ ├── Right to rectification (Art. 16)
27│ ├── Right to erasure (Art. 17)
28│ ├── Right to restrict processing (Art. 18)
29│ ├── Right to data portability (Art. 20)
30│ └── Right to object (Art. 21)
31├── Accountability and Governance
32│ ├── Data protection policies and procedures
33│ ├── Records of processing activities (Art. 30)
34│ ├── Data protection impact assessments (Art. 35)
35│ └── Data protection by design and default (Art. 25)
36└── International Data Transfers
37 ├── Adequacy decisions (Art. 45)
38 ├── Standard contractual clauses (Art. 46)
39 ├── Binding corporate rules (Art. 47)
40 └── Derogations (Art. 49)
41```
42 
43### 2. Privacy Impact Assessment (DPIA) Implementation
44Conduct systematic Data Protection Impact Assessments ensuring comprehensive privacy risk identification and mitigation.
45 
46**DPIA Process Framework:**
471. **DPIA Threshold Assessment**
48 - Systematic large-scale processing evaluation
49 - Special category data processing assessment
50 - High-risk processing activity identification
51 - **Decision Point**: Determine DPIA necessity per Article 35
52 
532. **DPIA Execution Process**
54 - **Processing Description**: Comprehensive data processing analysis
55 - **Necessity and Proportionality**: Legal basis and purpose limitation assessment
56 - **Privacy Risk Assessment**: Risk identification, analysis, and evaluation
57 - **Mitigation Measures**: Risk reduction and residual risk management
58 
593. **DPIA Documentation and Review**
60 - DPIA report preparation and stakeholder consultation
61 - Data Protection Officer (DPO) consultation and advice
62 - Supervisory authority consultation (if required)
63 - DPIA monitoring and review processes
64 
65### 3. Data Subject Rights Management
66Implement comprehensive data subject rights fulfillment processes ensuring timely and effective rights exercise.
67 
68**Data Subject Rights Framework:**
69```
70DATA SUBJECT RIGHTS IMPLEMENTATION
71├── Rights Request Management
72│ ├── Request receipt and verification
73│ ├── Identity verification procedures
74│ ├── Request assessment and classification
75│ └── Response timeline management
76├── Rights Fulfillment Processes
77│ ├── Information provision (privacy notices)
78│ ├── Data access and copy provision
79│ ├── Data rectification and correction
80│ ├── Data erasure and deletion
81│ ├── Processing restriction implementation
82│ ├── Data portability and transfer
83│ └── Objection handling and opt-out
84├── Complex Rights Scenarios
85│ ├── Conflicting rights balancing
86│ ├── Third-party rights considerations
87│ ├── Legal obligation conflicts
88│ └── Legitimate interest assessments
89└── Rights Response Documentation
90 ├── Decision rationale documentation
91 ├── Technical implementation evidence
92 ├── Timeline compliance verification
93 └── Appeal and complaint procedures
94```
95 
96### 4. German DSGVO Specific Requirements
97Address German-specific implementation of GDPR including national derogations and additional requirements.
98 
99**German DSGVO Specificities:**
100- **BDSG Integration**: Federal Data Protection Act coordination with GDPR
101- **Länder Data Protection Laws**: State-specific data protection requirements
102- **Sectoral Regulations**: Healthcare, telecommunications, and financial services
103- **German Supervisory Authorities**: Federal and state data protection authority coordination
104 
105## Advanced GDPR Applications
106 
107### Healthcare Data Protection (Medical Device Context)
108Implement specialized data protection measures for healthcare data processing in medical device environments.
109 
110**Healthcare GDPR Compliance:**
1111. **Health Data Processing Framework**
112 - Health data classification and special category handling
113 - Medical research and clinical trial data protection
114 - Patient consent management and documentation
115 - **Decision Point**: Determine appropriate legal basis for health data processing
116 
1172. **Medical Device Data Protection**
118 - **For Connected Devices**: Follow references/device-data-protection.md
119 - **For Clinical Systems**: Follow references/clinical-data-protection.md
120 - **For Research Platforms**: Follow references/research-data-protection.md
121 - Cross-border health data transfer management
122 
1233. **Healthcare Stakeholder Coordination**
124 - Healthcare provider data processing agreements
125 - Medical device manufacturer responsibilities
126 - Clinical research organization compliance
127 - Patient rights exercise in healthcare context
128 
129### International Data Transfer Compliance
130Manage complex international data transfer scenarios ensuring GDPR Chapter V compliance.
131 
132**International Transfer Framework:**
1331. **Transfer Mechanism Assessment**
134 - Adequacy decision availability and scope
135 - Standard Contractual Clauses (SCCs) implementation
136 - Binding Corporate Rules (BCRs) development
137 - Certification and code of conduct utilization
138 
1392. **Transfer Risk Assessment**
140 - Third country data protection law analysis
141 - Government access and surveillance risk evaluation
142 - Data subject rights enforceability assessment
143 - Additional safeguard necessity determination
144 
1453. **Supplementary Measures Implementation**
146 - Technical measures: encryption, pseudonymization, access controls
147 - Organizational measures: data minimization, purpose limitation, retention
148 - Contractual measures: additional processor obligations, audit rights
149 - Procedural measures: transparency, redress mechanisms
150 
151## GDPR Audit and Assessment
152 
153### GDPR Compliance Auditing
154Conduct systematic GDPR compliance audits ensuring comprehensive data protection verification.
155 
156**GDPR Audit Methodology:**
1571. **Audit Planning and Scope**
158 - Data processing inventory and risk assessment
159 - Audit scope definition and stakeholder identification
160 - Audit criteria and methodology selection
161 - **Audit Team Assembly**: Technical and legal competency requirements
162 
1632. **Audit Execution Process**
164 - **Legal Compliance Assessment**: GDPR article-by-article compliance verification
165 - **Technical Measures Review**: Data protection by design and default implementation
166 - **Organizational Measures Evaluation**: Policies, procedures, and training effectiveness
167 - **Documentation Review**: Records of processing, DPIAs, and data subject communications
168 
1693. **Audit Finding and Reporting**
170 - Non-compliance identification and risk assessment
171 - Improvement recommendation development
172 - Regulatory reporting obligation assessment
173 - Remediation planning and timeline development
174 
175### Privacy Risk Assessment
176Conduct comprehensive privacy risk assessments ensuring systematic privacy risk management.
177 
178**Privacy Risk Assessment Framework:**
179- **Data Flow Analysis**: Comprehensive data processing mapping and analysis
180- **Privacy Risk Identification**: Personal data processing risk evaluation
181- **Risk Impact Assessment**: Individual and organizational privacy impact
182- **Risk Mitigation Planning**: Privacy control implementation and effectiveness
183 
184### External Audit Preparation
185Prepare organization for supervisory authority investigations and external privacy audits.
186 
187**External Audit Readiness:**
1881. **Supervisory Authority Preparation**
189 - Investigation response procedures and protocols
190 - Documentation organization and accessibility
191 - Personnel training and communication coordination
192 - **Legal Representation**: External counsel coordination and support
193 
1942. **Compliance Verification**
195 - Internal audit completion and issue resolution
196 - Documentation completeness and accuracy verification
197 - Process implementation and effectiveness demonstration
198 - Continuous monitoring and improvement evidence
199 
200## Data Protection Officer (DPO) Support
201 
202### DPO Function Support and Coordination
203Provide comprehensive support to Data Protection Officer functions ensuring effective data protection governance.
204 
205**DPO Support Framework:**
206- **DPO Advisory Support**: Technical and legal guidance for complex data protection issues
207- **DPO Resource Coordination**: Cross-functional team coordination and resource provision
208- **DPO Training and Development**: Ongoing competency development and regulatory updates
209- **DPO Independence Assurance**: Organizational independence and conflict of interest management
210 
211### Data Protection Governance
212Establish comprehensive data protection governance ensuring organizational accountability and compliance.
213 
214**Governance Structure:**
215- **Data Protection Committee**: Cross-functional data protection decision-making body
216- **Privacy Steering Group**: Strategic privacy program oversight and direction
217- **Data Protection Champions**: Departmental privacy representatives and coordination
218- **Privacy Compliance Network**: Organization-wide privacy competency and awareness
219 
220## GDPR Performance and Continuous Improvement
221 
222### Privacy Program Performance Metrics
223Monitor comprehensive privacy program performance ensuring continuous improvement and compliance demonstration.
224 
225**Privacy Performance KPIs:**
226- **Compliance Rate**: GDPR requirement implementation and adherence rates
227- **Data Subject Rights**: Request fulfillment timeliness and accuracy
228- **Privacy Risk Management**: Risk identification, assessment, and mitigation effectiveness
229- **Incident Management**: Data breach response and notification compliance
230- **Training Effectiveness**: Privacy awareness and competency development
231 
232### Privacy Program Optimization
233Continuously improve privacy program through regulatory monitoring, best practice adoption, and technology integration.
234 
235**Program Enhancement:**
2361. **Regulatory Intelligence**
237 - GDPR interpretation guidance and supervisory authority positions
238 - Case law development and regulatory enforcement trends
239 - Industry best practice evolution and adoption
240 - **Technology Innovation**: Privacy-enhancing technology evaluation and implementation
241 
2422. **Privacy Program Evolution**
243 - Process optimization and automation opportunities
244 - Cross-border compliance harmonization
245 - Stakeholder feedback integration and response
246 - Privacy culture development and maturation
247 
248## Resources
249 
250### scripts/
251- `gdpr-compliance-checker.py`: Comprehensive GDPR compliance assessment and verification
252- `dpia-automation.py`: Data Protection Impact Assessment workflow automation
253- `data-subject-rights-tracker.py`: Individual rights request management and tracking
254- `privacy-audit-generator.py`: Automated privacy audit checklist and report generation
255 
256### references/
257- `gdpr-implementation-guide.md`: Complete GDPR compliance implementation framework
258- `dsgvo-specific-requirements.md`: German DSGVO implementation and national requirements
259- `device-data-protection.md`: Medical device data protection compliance guidance
260- `international-transfer-guide.md`: Chapter V international transfer compliance
261- `privacy-audit-methodology.md`: Comprehensive GDPR audit procedures and checklists
262 
263### assets/
264- `gdpr-templates/`: Privacy notice, consent, and data subject rights response templates
265- `dpia-tools/`: Data Protection Impact Assessment worksheets and frameworks
266- `audit-checklists/`: GDPR compliance audit and assessment checklists
267- `training-materials/`: Data protection awareness and compliance training programs
268 

Discussion

Alternatives

Gdpr data handlingImplement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.Business & ops · MITLegal advisorDraft privacy policies, terms of service, disclaimers, and legal notices. Creates GDPR-compliant texts, cookie policies, and data processing agreements. Use PROACTIVELY for legal documentation, compliance texts, or regulatory requirements.Business & ops · MITPci complianceImplement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card security measures.Business & ops · MITData privacy complianceData privacy and regulatory compliance specialist for GDPR, CCPA, HIPAA, and international data protection laws. Use when implementing privacy controls, conducting data protection impact assessments, ensuring regulatory compliance, or managing data subject rights. Expert in consent management, data minimization, and privacy-by-design principles.Business & ops · MIT

Browse more free Claude skills or everything in Legal & compliance.