gdpr-data-handling
- Use it when:
- You're building a system that processes EU personal data, adding privacy controls, or reviewing a system for GDPR compliance.
- It does:
- Sorts personal data by the protection it needs, ties processing to one of the six lawful bases and lists the rights users can exercise.
- You get:
- Code patterns for consent, access and erasure requests, retention, privacy by design and breach notification, and a compliance checklist.
TL;DR
The regulation boiled down for builders: data categories from basic contact details to sensitive (Article 9), criminal (Article 10) and children's data, the six lawful bases of Article 6, and the rights to access, rectification, erasure, restriction, portability and objection, which must be answered within a month. Its rules: collect only what's needed, document processing and its legal basis, encrypt personal data at rest and in transit, restrict access and audit regularly; never pre-tick consent boxes, bundle purposes into one consent, keep data indefinitely or transfer it without safeguards such as standard contractual clauses. A separate file holds the implementations, in JavaScript and Python: consent records and a cookie-consent banner, a handler for data subject requests with its deadlines, retention policies with a legal basis for each kind of data, a privacy-by-design data model that keeps personal data apart, and breach notification within 72 hours, plus a checklist covering legal basis, transparency, rights, security, breach response and documentation.
Summarizes the skill at 4bde316.
npx skills add https://github.com/wshobson/agents --skill gdpr-data-handling skills.sh pageSource on GitHubAll skills from wshobson/agents
- Total Downloads
- 15,400 on skills.sh, Nov 9, 2026
- Repo stars
- 42,334 wshobson/agents
- First seen
- Jan 20, 2026 on skills.sh
Weekly values
| Week to | Installs |
|---|---|
| Sep 21 | 203 |
| Sep 28 | 256 |
| Oct 5 | 310 |
| Oct 12 | 266 |
| Oct 19 | 261 |
| Oct 26 | 258 |
| Nov 2 | 243 |
| Nov 9 | 217 |
| Category |
Compliance, guardrails, skill vetting and browser fingerprinting. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills. |
|---|---|
| Type |
Knowledge and rules the agent applies while it works: best practices, design principles, API references. |
| Effect |
Adds no side effects of its own. It shapes how the agent thinks, writes or reviews. Guidelines and routers are always effect:none, even when the task they support edits code. |
| Needs |
Instructions only. Works in any agent that supports skills. |
| Publisher |
Everyone else. Unverified vendor claims default to community. |
| Topics |
SKILL.md
From wshobson/agents at 4bde316. Checked daily, last changed Nov 6, 2026.
Frontmatter
name: gdpr-data-handling
description: Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.GDPR Data Handling
Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.
When to Use This Skill
- Building systems that process EU personal data
- Implementing consent management
- Handling data subject requests (DSRs)
- Conducting GDPR compliance reviews
- Designing privacy-first architectures
- Creating data processing agreements
Core Concepts
1. Personal Data Categories
| Category | Examples | Protection Level |
|---|---|---|
| Basic | Name, email, phone | Standard |
| Sensitive (Art. 9) | Health, religion, ethnicity | Explicit consent |
| Criminal (Art. 10) | Convictions, offenses | Official authority |
| Children's | Under 16 data | Parental consent |
2. Legal Bases for Processing
Article 6 - Lawful Bases:
├── Consent: Freely given, specific, informed
├── Contract: Necessary for contract performance
├── Legal Obligation: Required by law
├── Vital Interests: Protecting someone's life
├── Public Interest: Official functions
└── Legitimate Interest: Balanced against rights
3. Data Subject Rights
Right to Access (Art. 15) ─┐
Right to Rectification (Art. 16) │
Right to Erasure (Art. 17) │ Must respond
Right to Restrict (Art. 18) │ within 1 month
Right to Portability (Art. 20) │
Right to Object (Art. 21) ─┘
Detailed worked examples and patterns
Detailed sections (starting with ## Implementation Patterns) live in references/details.md. Read that file when the navigation summary above is insufficient.
Best Practices
Do's
- Minimize data collection - Only collect what's needed
- Document everything - Processing activities, legal bases
- Encrypt PII - At rest and in transit
- Implement access controls - Need-to-know basis
- Regular audits - Verify compliance continuously
Don'ts
- Don't pre-check consent boxes - Must be opt-in
- Don't bundle consent - Separate purposes separately
- Don't retain indefinitely - Define and enforce retention
- Don't ignore DSARs - 30-day response required
- Don't transfer without safeguards - SCCs or adequacy decisions