Privacy & GDPR (Deep Workflow)

This skill supports structured thinking about personal data. Legal and compliance teams must approve binding interpretations—this is not legal advice.

When to Offer This Workflow

Trigger conditions:

• - New collection of PII; analytics or ML on user data
• Vendor processing agreements; international transfers
• DSAR volume; breach response planning

Initial offer:

Use six stages: (1) scope & roles, (2) inventory & purposes, (3) lawful basis & notices, (4) rights & DSAR, (5) security & subprocessors, (6) DPIA & transfers). Confirm jurisdiction (EU/UK vs broader).

Stage 1: Scope & Roles

Goal: Identify controller vs processor roles and whose data is involved (employees, customers, minors).

Output

Simple RACI for privacy decisions.

Exit condition: Data subjects and systems in scope are listed.

Stage 2: Inventory & Purposes

Goal: Record of processing activities (ROPA-style): what data, why, where stored, retention, who accesses.

Practices

• - Data minimization: collect and retain only what is needed

Stage 3: Lawful Basis & Notices

Goal: Map processing to lawful basis (consent, contract, legitimate interests, etc.)—lawyers validate per jurisdiction.

UX

• - Consent granular and withdrawable where required

Stage 4: Rights & DSAR

Goal: Operational playbook for access, erasure, portability, restriction—with SLAs and identity verification.

Practices

• - Log requests and responses for audit
• Plan how erasure interacts with backups and logs

Stage 5: Security & Subprocessors

Goal: DPAs, SCCs or adequacy for transfers; subprocessor list public where required.

Security

• - Encryption, access controls, and logging aligned with risk

Stage 6: DPIA & Transfers

Goal: Recognize when DPIA is likely required (high-risk processing)—escalate to DPO/legal.

Transfers

• - Document mechanisms for non-adequate countries

Final Review Checklist

• - [ ] Roles (controller/processor) and scope clear
• [ ] RoPA or equivalent inventory maintained
• [ ] Lawful basis and notices reviewed by legal where needed
• [ ] DSAR process with SLAs and verification
• [ ] Subprocessors and transfers documented

Tips for Effective Guidance

• - Engineering detail (backups, logs) is where GDPR meets reality.
• Privacy by design is cheaper than retrofit.
• Never invent legal conclusions—flag for professional review.

Handling Deviations

• - US-only: still map PII and consider state laws (e.g., CPRA).
• B2B vs B2C: different notice and rights patterns.