privacy-compliance

Files (4)

• README.md
• SKILL.md
• evals.json
• gdpr-ccpa-comparison.md · references/

SKILL.md (first lines)

## Key principles

1. **Privacy by design** - Build privacy controls into the architecture from day
   one. Data minimization, access controls, and audit logs are structural decisions,
   not features added after launch. Retrofitting is expensive and incomplete.

2. **Data minimization** - Collect only what you need, retain it only as long as
   necessary, and delete it on schedule. Every field in your database is a liability
   if you cannot justify its purpose and retention period.

3. **Lawful basis for processing** - Every processing activity must have a documented
   lawful basis (GDPR) or a disclosure obligation (CCPA). "We might need it someday"
   is not a lawful basis. Document the basis before you collect the data.

4. **Transparency** - Users must understand what data you collect, why, how long you
   keep it, and who you share it with. Privacy policies must be readable, not a legal
   wall. Consent must be informed to be valid.

5. **Accountability** - Maintain records of processing activities (RoPA), run DPIAs
   for high-risk processing, appoint a DPO when required, and respond to data subject
   requests within statutory deadlines. Compliance is a continuous process, not a
   one-time audit.

---

## Core concepts

### GDPR vs CCPA at a glance

| Dimension | GDPR (EU/EEA) | CCPA / CPRA (California) |
|---|---|---|
| Scope | Any org processing EU/EEA residents' data | Businesses meeting revenue/data thresholds serving CA residents |
| Legal basis required | Yes - 6 lawful bases | No explicit basis required; disclosure + opt-out |
| Consent standard | Freely given, specific, informed, unambiguous, withdrawable | Opt-out for sale/sharing; opt-in for sensitive data (CPRA) |
| Data subject rights | Access, rectification, erasure, portability, restriction, objection, no automated decision | Know, delete, correct, opt-out of sale/sharing, limit sensitive data use, non-discrimination |
| Response deadline | 30 days (extendable to 90 days) | 45 days (extendable to 90 days) |
| Breach notification | 72 hours to supervisory authority; notify individuals if high risk | Reasonable time; private right of action for breaches |
| Penalties | Up to 4% global annual turnover or €20M | Up to $7,500 per intentional violation |
| DPO required | For large-scale systematic processing or sensitive data | No equivalent role required |
| Cross-border transfers | SCCs, adequacy decisions, BCRs required | No equivalent mechanism required |

### Lawful bases for processing (GDPR Art. 6)

| Basis | When to use | Gotcha |
|---|---|---|
| Consent | Marketing, non-essential cookies, optional features | Must be withdrawable; withdrawal must be as easy as giving it |
| Contract | Processing necessary to fulfill a contract with the user | Can only cover what is genuinely necessary for the contract |
| Legal obligation | Tax records, fraud reporting mandated by law | Must be a specific law, not a vague compliance claim |
| Vital interests | Emergency medical situations | Rarely applicable outside health contexts |
| Public task | Government and public authority processing | Not applicable to most private organizations |
| Legitimate interests (LI) | Analytics, fraud prevention, direct marketing (with caveats) | Must pass LI Assessment (LIA) - user interests must not override yours |

### Data subject rights

| Right | GDPR | CCPA/CPRA | Implementation note |
|---|---|---|---|
| Right to know / access | Art. 15 | Yes | Export all personal data in a portable format |
| Right to rectification / correction | Art. 16 | CPRA only | Update incorrect data across all systems |
| Right to erasure ("right to be forgotten") | Art. 17 | Yes | Cascade deletes across primary store, replicas, backups, third-party processors |
| Right to portability | Art. 20 | Yes (categories + specific pieces) | Machine-readable format (JSON, CSV) |
| Right to restriction of processing | Art. 18 | No | Freeze processing while dispute is resolved |
| Right to object | Art. 21 | Opt-out of sale/sharing | Especially for direct marketing and LI-based processing |
| No automated decision-making | Art. 22 | No | Human review option for decisions with legal/significant effects |

### Cross-border transfer mechanisms

| Mechanism | Use when |
|---|---|
| Adequacy decision | Transferring to a country the EU Commission has approved (e.g., UK post-IDTA, Japan, Canada) |
| Standard Contractual Clauses (SCCs) | Most common for transfers to non-adequate countries (e.g., US). Use 2021 SCCs. |
| Binding Corporate Rules (BCRs) | Intra-group transfers within a large multinational; requires DPA approval, lengthy process |
| Derogations (Art. 49) | Narrow exceptions: explicit consent, performance of contract, vital interests. Not for systematic transfers. |

---

## Common tasks

### 1. Implement a GDPR compliance checklist

Use this as a product/engineering launch gate:

**Data inventory**
- [ ] Record of Processing Activities (RoPA) created and up to date
- [ ] Lawful basis documented for each processing activity
- [ ] Retention periods defined for each data category
- [ ] Third-party processors identified; DPAs signed with each

**Technical controls**
- [ ] Personal data encrypted at rest and in transit
- [ ] Access to personal data is role-based and audited
- [ ] Pseudonymization applied where full identification is not needed
- [ ] Automated deletion jobs scheduled per retention policy

**User-facing obligations**
- [ ] Privacy policy published, accessible, and up to date
- [ ] Cookie consent mechanism in place (see task 2)
- [ ] Data subject request workflow implemented (see task 4)
- [ ] Age verification where required (special categories, children's data)

**Organizational**
- [ ] DPO appointed (if required) and contact details published
- [ ] Data breach response procedure documented and tested
- [ ] DPIA completed for high-risk processing activities (see task 3)
- [ ] Staff privacy training completed

---

### 2. Design consent management (cookie banners and preference center)

**The consent bar is higher than most implementations meet.** For GDPR, pre-ticked
boxes, bundled consent, and making "reject" harder than "accept" are all invalid.

**Cookie categories to surface to users:**

| Category | Examples | Requires consent? |
|---|---|---|
| Strictly necessary | Session auth, load balancing, CSRF tokens | No - but must disclose |
| Functional / preferences | Language, theme, remembered settings | Yes (GDPR), disclose (CCPA) |
| Analytics / performance | Google Analytics, Heap, session recording | Yes (GDPR), opt-out (CCPA) |

From mkurman/zorai, MIT.

More from mkurman/zorai