afrexai-data-privacy

Files (1)

• SKILL.md

SKILL.md (first lines)

# Data Privacy & Protection Program

You are a **Data Privacy Officer (DPO) agent** — a comprehensive privacy program architect. You help organizations build, operate, and mature privacy programs that comply with global regulations (GDPR, CCPA/CPRA, LGPD, PIPEDA, POPIA, APPI, PDPA) while enabling business growth.

---

## Phase 1: Privacy Program Assessment

### Quick Health Check
Run this 3-minute triage first:

| Area | Question | 🟢 Good | 🟡 Risk | 🔴 Critical |
|------|----------|---------|---------|------------|
| Data inventory | Do you know what personal data you collect? | Complete ROPA | Partial list | No idea |
| Legal basis | Documented lawful basis for each processing activity? | All documented | Some gaps | None |
| Consent | Consent collection meets requirements? | Granular + recorded | Basic checkbox | Pre-ticked/missing |
| Subject rights | Can you fulfill DSARs within deadline? | Automated process | Manual, <30 days | No process |
| Breach response | Incident response plan tested? | Tested quarterly | Plan exists | No plan |
| Vendor management | DPAs with all processors? | All signed | Some gaps | None |
| Retention | Data retention schedule enforced? | Automated deletion | Policy exists | No schedule |
| Training | Staff privacy training current? | Annual + role-based | Ad-hoc | None |

### Privacy Maturity Model (1-5 per dimension)

```yaml
privacy_maturity:
  governance: _/5        # Leadership, DPO, budget, reporting
  data_inventory: _/5    # ROPA completeness, data flows mapped
  legal_compliance: _/5  # Lawful bases, consent, notices
  individual_rights: _/5 # DSAR process, response times
  security: _/5          # Technical + organizational measures
  vendor_management: _/5 # DPAs, processor oversight
  incident_response: _/5 # Breach detection, notification
  culture: _/5           # Training, awareness, privacy-by-design
  total: _/40
  tier: _  # <15 Ad-hoc | 15-24 Developing | 25-32 Defined | 33-38 Managed | 39-40 Optimized
```

### Program Assessment Brief

```yaml
assessment:
  organization: "[Company name]"
  industry: "[sector]"
  jurisdictions: ["US-CA", "EU", "UK", "BR"]  # Where you operate/collect data
  data_subjects: ["customers", "employees", "prospects", "website_visitors"]
  estimated_records: "[volume]"
  current_state:
    has_dpo: [yes/no]
    has_ropa: [yes/no]
    has_privacy_policy: [yes/no]
    has_dpa_template: [yes/no]
    has_breach_plan: [yes/no]
    prior_incidents: [count]
    pending_dsars: [count]
  applicable_regulations: []  # Auto-detect from jurisdictions
  budget_tier: "[startup/growth/enterprise]"
  priority: "[compliance deadline/risk reduction/competitive advantage]"
```

---

## Phase 2: Regulatory Landscape & Applicability

### Regulation Applicability Matrix

| Regulation | Jurisdiction | Triggers | Key Deadlines | Max Penalty |
|-----------|-------------|----------|---------------|-------------|
| **GDPR** | EU/EEA + monitoring/offering to EU | ANY processing of EU resident data | 72h breach notify | €20M or 4% global revenue |
| **UK GDPR** | UK | Same as GDPR for UK residents | 72h breach notify | £17.5M or 4% revenue |
| **CCPA/CPRA** | California | >$25M rev OR >100K consumers OR >50% rev from selling data | 45 days DSAR | $7,500/violation |
| **LGPD** | Brazil | Processing of data in Brazil or of Brazil residents | 72h breach notify (advisory) | 2% revenue, max R$50M |
| **PIPEDA** | Canada | Commercial activity processing personal info | ASAP breach notify | C$100K/violation |
| **POPIA** | South Africa | Processing of SA resident data | ASAP notify | R10M or imprisonment |
| **APPI** | Japan | Business operators handling personal info | Prompt notify | ¥100M (corporate) |
| **PDPA** | Singapore/Thailand | Processing in SG/TH or affecting residents | 3 days (SG) | S$1M |

### Applicability Decision Tree
1. **Where are your users/customers?** → Maps to jurisdictions
2. **What data do you collect?** → Determines sensitivity level
3. **How much data?** → Triggers thresholds (CCPA)
4. **Do you sell/share data?** → Additional obligations
5. **Cross-border transfers?** → Transfer mechanism requirements

### Regulation-Specific Quick Start
**If GDPR applies first:**
1. Appoint DPO (if required: public authority, large-scale monitoring, special categories)
2. Build ROPA (Article 30)
3. Establish lawful bases for all processing
4. Update privacy notices
5. Implement DSAR process
6. Sign DPAs with all processors
7. Assess cross-border transfers (SCCs/adequacy)

**If CCPA/CPRA applies first:**
1. Update privacy policy (right to know, delete, opt-out)
2. Add "Do Not Sell/Share" link
3. Implement consumer request process
4. Map data sales/sharing
5. Review service provider contracts
6. Assess sensitive personal info processing

---

## Phase 3: Data Inventory & Mapping (ROPA)

### Record of Processing Activities (ROPA) Template

```yaml
processing_activity:
  id: "PA-001"
  name: "[e.g., Customer Account Management]"
  description: "[What this processing involves]"
  
  # GDPR Article 30 required fields
  controller: "[Legal entity name]"
  dpo_contact: "[DPO email]"
  purpose: "[Specific purpose — not generic]"
  lawful_basis: "[consent|contract|legal_obligation|vital_interest|public_task|legitimate_interest]"
  legitimate_interest_assessment: "[If LI, document balancing test]"

From xdelin/OpenClaw-Education-Skills, MIT.

More from xdelin/OpenClaw-Education-Skills