Skip to content

Releases: garethmdowns/gdpr-skill

Release list

v1.3 - first public release

v1.3 - first public release Latest
Latest

Choose a tag to compare

View all tags
@garethmdowns garethmdowns released this 26 May 12:27
v1.3
b698806
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First public release of the /gdpr skill. This release applies three substantive corrections and five consistency fixes ahead of opening the skill to public contribution.

Substantive corrections

Transfer register: DPF and contractual safeguards separated. Previous schema collapsed UK-US Data Bridge (DPF) and SCCs into a single column. New three-column structure separates DPF status (reviewer to verify) from the contractual fallback (UK Addendum to EU SCCs or UK IDTA) and adds an explicit TRA requirement flag.

Privacy notice scaffolding names the LLM provider. Aligns with ICO Generative AI guidance. Template provided.

Listings split into personal-data and legal-entity portions. UK GDPR applies to the personal-data portion (sole traders, named contacts at companies). It does not apply to the legal-entity portion (limited companies, generic info@ inboxes). PECR Regulation 23 covers corporate subscribers separately from the Regulation 22 consent requirement for individual subscribers.

New reference files

  • references/transfer-mechanisms.md - DPF and contractual safeguards as separate questions, plus what Confidence measures under the new schema.
  • references/personal-data-vs-business-contact.md - distinguishing personal data of natural persons from information about legal entities, with worked examples and the PECR 22 / 23 split.

Consistency fixes

  • Transfer register column schema reconciled between SKILL.md and the template asset.
  • "UNKNOWN - reviewer to confirm" phrasing harmonised throughout.
  • Business function list reconciled between SKILL.md and ico-template.md.
  • Inline disclaimer in SKILL.md is now the canonical source.
  • Article 21 cross-reference from lawful-basis.md to SKILL.md privacy notice scaffolding.

What this skill is and is not

A practitioner-built Claude skill that drafts UK GDPR artefacts (ROPA, transfer register, AI processing findings, privacy notice scaffolding, methodology) from a codebase. Every output is flagged DRAFT and requires review by a qualified person. The skill cannot determine lawful basis with certainty, cannot confirm contracts and DPAs are in place, and cannot see runtime behaviour.

MIT licensed. Practitioner contributions welcome via issues and PRs.

Assets 2
Loading