# Gdpr Data Handling

> Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.

Source: https://skillsagentes.com/skills/wshobson/agents/gdpr-data-handling
Repository: https://github.com/wshobson/agents
Author: wshobson
License: MIT
Updated: hace 2 meses
Context cost: 59 tok installed, 670 tok once triggered, 5k tok with every bundled file
Bundle: 2 files, 20 KB
Permissions requested: none declared

## Install

```bash
npx -y skills add wshobson/agents --skill gdpr-data-handling --agent claude-code
```

## What it does

- Implementa manejo de datos conforme a GDPR con gestión de consentimiento y controles de privacidad
- Define bases legales de procesamiento según el Art. 6 (consentimiento, contrato, obligación legal, etc.)
- Gestiona solicitudes de derechos del interesado (acceso, rectificación, supresión, portabilidad, objeción)
- Clasifica categorías de datos personales (básicos, sensibles Art. 9, penales Art. 10, de menores)
- Aplica buenas prácticas de minimización de datos, cifrado, controles de acceso y auditorías

## Use it when

- Construir sistemas que procesan datos personales de la UE
- Implementar gestión de consentimiento
- Manejar solicitudes de derechos del interesado (DSRs)
- Realizar revisiones de cumplimiento GDPR o diseñar arquitecturas privacy-first

## What triggers it

- "Ayúdame a implementar gestión de consentimiento conforme a GDPR"
- "Necesito manejar una solicitud de derecho al olvido de un usuario"
- "Revisa si nuestro sistema cumple con GDPR"

## Files

- SKILL.md — 3 KB
- references/details.md — 17 KB

## SKILL.md

Reproduced verbatim from wshobson/agents under MIT. This section is the upstream document and is in English.

# GDPR Data Handling

Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.

## When to Use This Skill

- Building systems that process EU personal data
- Implementing consent management
- Handling data subject requests (DSRs)
- Conducting GDPR compliance reviews
- Designing privacy-first architectures
- Creating data processing agreements

## Core Concepts

### 1. Personal Data Categories

| Category               | Examples                    | Protection Level   |
| ---------------------- | --------------------------- | ------------------ |
| **Basic**              | Name, email, phone          | Standard           |
| **Sensitive (Art. 9)** | Health, religion, ethnicity | Explicit consent   |
| **Criminal (Art. 10)** | Convictions, offenses       | Official authority |
| **Children's**         | Under 16 data               | Parental consent   |

### 2. Legal Bases for Processing

```
Article 6 - Lawful Bases:
├── Consent: Freely given, specific, informed
├── Contract: Necessary for contract performance
├── Legal Obligation: Required by law
├── Vital Interests: Protecting someone's life
├── Public Interest: Official functions
└── Legitimate Interest: Balanced against rights
```

### 3. Data Subject Rights

```
Right to Access (Art. 15)      ─┐
Right to Rectification (Art. 16) │
Right to Erasure (Art. 17)       │ Must respond
Right to Restrict (Art. 18)      │ within 1 month
Right to Portability (Art. 20)   │
Right to Object (Art. 21)       ─┘
```

## Detailed worked examples and patterns

Detailed sections (starting with `## Implementation Patterns`) live in `references/details.md`. Read that file when the navigation summary above is insufficient.

## Best Practices

### Do's

- **Minimize data collection** - Only collect what's needed
- **Document everything** - Processing activities, legal bases
- **Encrypt PII** - At rest and in transit
- **Implement access controls** - Need-to-know basis
- **Regular audits** - Verify compliance continuously

### Don'ts

- **Don't pre-check consent boxes** - Must be opt-in
- **Don't bundle consent** - Separate purposes separately
- **Don't retain indefinitely** - Define and enforce retention
- **Don't ignore DSARs** - 30-day response required
- **Don't transfer without safeguards** - SCCs or adequacy decisions

---

Skills Agentes — https://skillsagentes.com/skills/wshobson/agents/gdpr-data-handling