⚠️ EXPERIMENTAL — This skill is provided for educational and informational purposes only. It does NOT constitute legal advice. All responsibility for usage rests with the user. Consult qualified legal professionals before acting on any output.

Privacy Compliance Navigator

Tools and guidance for multi-regulation privacy compliance across 9 major global privacy frameworks, DPA review, and data subject request lifecycle management.

[Tools](#tools)
[Privacy Regulation Checker](#privacy-regulation-checker)
[DSR Tracker](#dsr-tracker)
[Reference Guides](#reference-guides)
[Workflows](#workflows)
[Troubleshooting](#troubleshooting)
[Success Criteria](#success-criteria)
[Scope & Limitations](#scope--limitations)
[Anti-Patterns](#anti-patterns)
[Tool Reference](#tool-reference)

Tools

Privacy Regulation Checker

Determines which privacy regulations apply to an organization based on its location, data subjects, data types, and processing activities. Generates a compliance obligations matrix and flags gaps.

# Basic check — organization in Germany processing EU and US data
python scripts/privacy_regulation_checker.py \
  --org-location DE \
  --data-subjects EU,US \
  --data-types personal,sensitive,financial \
  --processing-activities marketing,analytics,hr

# JSON output for integration
python scripts/privacy_regulation_checker.py \
  --org-location SG \
  --data-subjects SG,AU,CN \
  --data-types personal,health \
  --processing-activities healthcare,research \
  --json

# Include gap analysis against current practices
python scripts/privacy_regulation_checker.py \
  --org-location US-CA \
  --data-subjects EU,US,BR \
  --data-types personal,biometric \
  --processing-activities ecommerce,profiling \
  --current-practices consent_mechanism,breach_process,retention_policy

Determines:

Which of 9 regulations apply based on territorial scope rules
Key obligations per applicable regulation
Data subject rights required per regulation
Response timelines per regulation
Gap analysis when current practices are provided

Output:

Applicable regulations list with confidence level
Per-regulation obligations matrix
Gap analysis with risk ratings
Recommended priority actions

DSR Tracker

Manages Data Subject Request lifecycle across multiple regulations with deadline calculation, status tracking, and overdue alerts.

# Add a new GDPR access request
python scripts/dsr_tracker.py add \
  --type access --regulation gdpr \
  --subject "Jane Smith" --email "jane@example.com"

# Add CCPA deletion request
python scripts/dsr_tracker.py add \
  --type deletion --regulation ccpa \
  --subject "John Doe" --email "john@example.com"

# List all open requests
python scripts/dsr_tracker.py list

# List overdue requests only
python scripts/dsr_tracker.py list --overdue

# Update request status
python scripts/dsr_tracker.py update --id DSR-0001 --status verified

# Dashboard view with time remaining
python scripts/dsr_tracker.py dashboard

# Export as JSON
python scripts/dsr_tracker.py dashboard --json

Supported Request Types:

| Type | GDPR Art. | CCPA Section | LGPD Art. | |------|-----------|-------------|-----------| | Access | Art. 15 | §1798.100 | Art. 18 | | Deletion/Erasure | Art. 17 | §1798.105 | Art. 18(VI) | | Correction/Rectification | Art. 16 | §1798.106 | Art. 18(III) | | Portability | Art. 20 | §1798.130 | Art. 18(V) | | Restriction | Art. 18 | — | Art. 18(IV) | | Objection | Art. 21 | §1798.120 | Art. 18(IV) | | Automated Decision Opt-Out | Art. 22 | §1798.185 | Art. 20 | | Withdraw Consent | Art. 7(3) | — | Art. 18(IX) |

Deadline Calculation:

| Regulation | Initial Deadline | Extension | Extension Deadline | |-----------|-----------------|-----------|-------------------| | GDPR | 30 calendar days | +60 days (complex) | 90 calendar days | | CCPA | 10 business days (ack) + 45 calendar days | +45 days | 90 calendar days | | LGPD | 15 calendar days | — | — | | POPIA | 30 calendar days | — | — | | PIPEDA | 30 calendar days | +30 days | 60 calendar days | | PDPA (SG) | 30 calendar days | — | — | | Privacy Act (AU) | 30 calendar days | +30 days | 60 calendar days | | PIPL | 15 calendar days | +15 days | 30 calendar days | | UK GDPR | 30 calendar days | +60 days | 90 calendar days |

Statuses: received → verified → processing → completed | denied | extended

Reference Guides

Global Privacy Regulations

references/global_privacy_regulations.md

Comprehensive comparison of 9 major privacy regulations covering:

Territorial scope and applicability criteria
Legal bases for processing
Data subject rights comparison matrix
Breach notification requirements and timelines
Cross-border transfer mechanisms
DPO requirements
Penalty structures

DPA Review Checklist

references/dpa_review_checklist.md

Complete Data Processing Agreement review guide:

Art. 28 GDPR required elements
10 processor obligations with analysis points
International transfer mechanisms (SCCs June 2021, module selection)
Transfer impact assessment requirements
Common DPA issues with risk levels
Practical negotiation considerations

DSR Handling Guide

references/dsr_handling_guide.md

Data Subject Request handling reference:

8 request types with intake procedures
Identity verification methods
Response timelines per regulation
Exemptions by regulation
6-step response process
Regulatory monitoring approach

Workflows

Workflow 1: Regulation Applicability Assessment

Step 1: Identify organization parameters
        → Location, data subjects, data types, processing activities

Step 2: Run regulation checker
        → python scripts/privacy_regulation_checker.py --org-location [LOC] ...

Step 3: Review applicable regulations and obligations
        → Prioritize by risk (penalties, data volume, enforcement activity)

Step 4: Gap analysis against current practices
        → Re-run with --current-practices flag

Step 5: Build remediation roadmap
        → Address critical gaps first (missing legal basis, no breach process)

Workflow 2: Data Subject Request Handling

Step 1: Receive and log request
        → python scripts/dsr_tracker.py add --type [type] --regulation [reg] ...

Step 2: Verify identity (proportionate to sensitivity)
        → See references/dsr_handling_guide.md for methods
        → python scripts/dsr_tracker.py update --id [ID] --status verified

Step 3: Gather data from all systems
        → python scripts/dsr_tracker.py update --id [ID] --status processing

Step 4: Apply exemptions if applicable
        → Check references/dsr_handling_guide.md exemptions table

Step 5: Prepare and send response within deadline
        → python scripts/dsr_tracker.py update --id [ID] --status completed

Step 6: Monitor dashboard for overdue requests
        → python scripts/dsr_tracker.py dashboard

Workflow 3: DPA Review

Step 1: Check DPA against Art. 28 required elements
        → Use references/dpa_review_checklist.md

Step 2: Verify processor obligations (10 items)
        → Sub-processing, deletion, audit rights, etc.

Step 3: Assess international transfer provisions
        → SCC module selection (C2P, C2C, P2P, P2C)
        → Transfer impact assessment
        → Supplementary measures

Step 4: Review practical considerations
        → Liability caps, insurance, termination, data locations

Step 5: Document findings and negotiate amendments

Workflow 4: Multi-Regulation Compliance Program

Step 1: Run regulation checker for full scope
        → python scripts/privacy_regulation_checker.py [params]

Step 2: Map overlapping obligations across regulations
        → Use references/global_privacy_regulations.md comparison matrix

Step 3: Build unified controls (satisfy strictest requirement)
        → GDPR-first approach covers most other regulations

Step 4: Layer

privacy-compliance

Como adicionar

Cole no README do seu repo

Skills relacionadas

understand-domain

understand-dashboard

understand-chat

dev-browser

Receba novas skills de Pesquisa e Web toda segunda