Privacy & GDPR (Deep Workflow)
This skill supports structured thinking about personal data. Legal and compliance teams must approve binding interpretations—this is not legal advice.
When to Offer This Workflow
Trigger conditions:
- New collection of PII; analytics or ML on user data
- Vendor processing agreements; international transfers
- DSAR volume; breach response planning
Initial offer:
Use six stages: (1) scope & roles, (2) inventory & purposes, (3) lawful basis & notices, (4) rights & DSAR, (5) security & subprocessors, (6) DPIA & transfers). Confirm jurisdiction (EU/UK vs broader).
Stage 1: Scope & Roles
Goal: Identify controller vs processor roles and whose data is involved (employees, customers, minors).
Output
Simple RACI for privacy decisions.
Exit condition: Data subjects and systems in scope are listed.
Stage 2: Inventory & Purposes
Goal: Record of processing activities (ROPA-style): what data, why, where stored, retention, who accesses.
Practices
- Data minimization: collect and retain only what is needed
Stage 3: Lawful Basis & Notices
Goal: Map processing to lawful basis (consent, contract, legitimate interests, etc.)—lawyers validate per jurisdiction.
UX
- Consent granular and withdrawable where required
Stage 4: Rights & DSAR
Goal: Operational playbook for access, erasure, portability, restriction—with SLAs and identity verification.
Practices
- Log requests and responses for audit
- Plan how erasure interacts with backups and logs
Stage 5: Security & Subprocessors
Goal: DPAs, SCCs or adequacy for transfers; subprocessor list public where required.
Security
- Encryption, access controls, and logging aligned with risk
Stage 6: DPIA & Transfers
Goal: Recognize when DPIA is likely required (high-risk processing)—escalate to DPO/legal.
Transfers
- Document mechanisms for non-adequate countries
Final Review Checklist
- Roles (controller/processor) and scope clear
- RoPA or equivalent inventory maintained
- Lawful basis and notices reviewed by legal where needed
- DSAR process with SLAs and verification
- Subprocessors and transfers documented
Tips for Effective Guidance
- Engineering detail (backups, logs) is where GDPR meets reality.
- Privacy by design is cheaper than retrofit.
- Never invent legal conclusions—flag for professional review.
Handling Deviations
- US-only: still map PII and consider state laws (e.g., CPRA).
- B2B vs B2C: different notice and rights patterns.