Explore

Expert Vietnam Personal Data Protection Law (PDPL) compliance advisor for Law No. 91/2025/QH15 and implementing Decree 356/2025/ND-CP (effective January 1, 2026). Use this skill for gap analysis against the Vietnam PDPL, data subject rights fulfilment workflows, cross-border data transfer impact assessments, privacy notices and internal policies, breach notification procedures, sector-specific obligations (finance, AI, cloud, blockchain), and DPO qualification reviews. Trigger whenever a user mentions Vietnam data privacy, VN-PDPL, Nghị định 356, Vietnamese personal data, or cross-border transfers involving Vietnamese citizens' data.

Expert LGPD compliance advisor for Brazil's Lei Geral de Proteção de Dados (Law 13,709/2018). Use this skill whenever a user asks about LGPD, Brazilian data protection, ANPD, personal data processing in Brazil, data subject rights under Brazilian law, legal bases for processing, sensitive data handling, DPO appointment in Brazil, data breach notification to ANPD, LGPD penalties (fines up to 2% of revenue / R$50M), international data transfers from Brazil, Brazil-EU mutual adequacy (January 2026 — SCCs/BCRs no longer needed for Brazil-EU transfers), LGPD gap assessments, privacy policy drafting for Brazilian operations, DPIA under LGPD, consent management, or comparing LGPD with GDPR. Trigger for any Brazil privacy or data protection question even if LGPD is not named explicitly.

Expert ISO 27701 Privacy Information Management System (PIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 27701:2025, ISO/IEC 27701:2019, privacy information management, PIMS certification, PII controller or processor obligations, privacy risk assessment, Statement of Applicability for privacy, privacy by design, data subject rights, DPIA, records of processing activities, transitioning from ISO 27701:2019, GDPR alignment with ISO 27701, or any privacy management system topic. Also trigger for questions about Annex A.1 (controller controls), A.2 (processor controls), A.3 (shared security controls), or implementing a standalone PIMS without ISO 27001. When in doubt, use this skill — it covers the full ISO 27701 lifecycle from gap assessment through certification.

Expert GDPR compliance assistant covering all four core workflows: (1) auditing code and systems for GDPR violations, (2) drafting GDPR-compliant documents such as privacy policies, Data Processing Agreements (DPAs), and consent notices, (3) answering GDPR compliance questions with authoritative article citations, and (4) reviewing data flows and PII handling practices. Use this skill whenever the user mentions GDPR, data protection, privacy compliance, lawful basis, data subject rights, DPA, privacy notices, consent management, data breaches, DPIAs, controller/ processor relationships, cross-border data transfers, or any EU/UK data privacy topic.

Expert India Digital Personal Data Protection Act, 2023 (DPDPA) compliance advisor. Use this skill whenever a user asks about the DPDPA, DPDP Act, DPDP Rules 2025, India data privacy law, Data Fiduciary obligations, Data Principal rights, Significant Data Fiduciary, Data Protection Board of India, consent under DPDPA, notice requirements, breach notification India, children's data India, cross-border data transfer India, India privacy compliance, DPDPA gap analysis, DPDPA vs GDPR, or any obligation under India's personal data protection framework.

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) compliance advisor — business threshold analysis, consumer rights fulfillment (access, delete, correct, opt-out of sale/sharing, limit SPI, ADMT opt-out), privacy notice drafting, service provider vs. contractor vs. third-party classification, sensitive personal information (SPI) handling, data minimization, opt-out mechanisms (including GPC), cybersecurity audits and risk assessments (live since Jan 1, 2026), ADMT obligations (effective 2026, deadline Jan 1, 2027), CPPA enforcement (Disney $2.75M, PlayOn $1.1M, Ford $375K), penalty exposure, GDPR comparison, and gap assessments for businesses operating in or targeting California residents.

Henkilötietojen käsittelyn tietosuoja EU:n tietosuoja-asetuksen (2016/679) ja tietosuojalain (1050/2018) mukaan: käsittelyn arviointi ja DPIA, tietosuojaseloste ja seloste käsittelytoimista sekä rekisteröidyn tietopyyntöihin vastaaminen.

Triages processing activities, generates PIAs, reviews DPAs as controller or processor, drafts DSAR responses within statutory timelines, and monitors policy drift against practice.

Review, draft, or redline a Data Processing Agreement (DPA / Auftragsverarbeitungsvertrag / AVV) under Art. 28 GDPR, or prepare a Joint Controller Arrangement under Art. 26 GDPR (basic). Supports bilingual output (DE/EN), both controller- and processor-side perspectives, and two review depths — quick (Art. 28(3)(a)–(h) coverage) and negotiation-grade (clause-by-clause risk scoring).

GDPR Transfer Impact Assessment for Chapter V transfers under the EDPB Recommendations 01/2020 six-step methodology, the CNIL TIA Guide (January 2025), and EDPB essential guarantees. Handles transfer qualification, Art. 45 adequacy fast-tracks, Art. 46 full assessments with country profiles for 12 jurisdictions, and balanced Art. 49 derogation analysis. Outputs a Markdown report, a .docx formal TIA, and a JSON delta for RoPA interchange.

Draft or review a DPDPA-compliant consent notice under India's Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025. Provide basic details about your business and this skill handles the rest - building a notice tailored to your operations, with all required sections, granular consent boxes, and internal notes for your team. If you have an existing notice or privacy policy that needs to comply with DPDPA, this skill revises it too, flagging key gaps and changes made.

Orientação LGPD para operações de tratamento no Brasil. Cobre bases legais (Art. 7º e Art. 11), RIPD, incidentes (Arts. 48-49), direitos dos titulares (Art. 18) e transferências internacionais. Triggers: LGPD, RIPD, ANPD, proteção de dados, dados pessoais, consentimento, encarregado, DPO Brasil, incidente de dados, legítimo interesse.

Performs structured compliance review, clause redlining, and drafting suggestions for legal documents (privacy policies, data processing agreements, vendor and SaaS contracts) against India's DPDPA 2023 and the EU GDPR. Flags clauses as compliant, at-risk, or non-compliant with reasoning, and proposes ready-to-use model replacement language.

Audit de conformité RGPD d'un site internet par un praticien RGPD/DPO. Observation systématique selon une checklist en 10 sections (mentions légales, hébergeur, formulaires, newsletter, politique de confidentialité, cookies, mots de passe, trackers, sous-traitants et transferts hors UE, accessibilité des droits) plus annexe 22 items art. 13/14 RGPD. Produit un rapport structuré (markdown, .docx en option) avec niveau de conformité global, points bloquants, points de vigilance, recommandations prioritaires et sources réglementaires citées (LCEN, RGPD, ePrivacy, délibérations CNIL, EDPB, DPF). Tool-agnostique : navigation automatique ou mode dégradé copier-coller. 7 arbres de décision pour les cas limites. Le praticien valide tous les statuts avant transmission au client. Analyse technique uniquement, pas de conseil juridique.

PII Shield is an open-source MCP server for Claude Desktop (Cowork and Code) that anonymizes documents *before* they reach the model and restores real values *after* analysis — entirely on the user's machine. The pipeline is local → API → local. The plugin reads a file on disk, replaces detected entities with placeholders like `<PERSON_1>`, `<ORG_2>`, `<IBAN_1>`, and only the placeholder text crosses the wire. Detection combines GLiNER zero-shot NER with **17 jurisdiction-specific patterns** (UK NIN/NHS/passport, DE Tax ID, FR NIR, IT fiscal code, ES DNI/NIE, CY TIC, EU VAT, plus US SSN/EIN, IBAN, crypto wallet, money, dates). A human-in-the-loop review UI renders inside Claude Desktop for false-positive correction. Ships with a companion skill `pii-contract-analyze` exposing six modes — MEMO, REDLINE, SUMMARY, COMPARISON, BULK (up to 5 files, shared placeholders), and ANONYMIZE-only. **Jurisdictions covered (detection patterns):** EU-wide, UK, Germany, France, Italy, Spain, Cyprus, US. Use PII Shield whenever client documents must be analyzed by an LLM but cannot be transmitted in cleartext: NDA / MSA / DPA review, GDPR risk analysis, due diligence on counterparty contracts, employment document handling, DSAR responses, and partial-analysis handoff between colleagues under privilege.

Analyse systématique d'un Data Processing Agreement (DPA) au regard de l'article 28 RGPD, des lignes directrices EDPB 07/2020 et 02/2024, des Clauses Contractuelles Types 2021 et du Règlement (UE) 2024/1689. Produit un rapport structuré clause par clause sur 18 critères (13 obligatoires + 5 complémentaires) avec diagnostic 🟢/🟡/🔴, analyse détaillée des transferts internationaux (tableau structuré + accès gouvernemental Cloud Act/FISA 702), vérification de l'utilisation de systèmes d'IA, remédiations contractuelles prêtes à insérer, et questions à poser au fournisseur. Pensé pour les DPO et praticiens RGPD qui négocient ou auditent des contrats de sous-traitance.

Deterministic legal tools for the EU AI Act. Covers Annex III high-risk system classification, Article 73 compliance deadlines, Article 99 fine calculations, and jurisdictional mapping across the 27 EU member states. 9 tools, public, no auth required.

Use this skill when asked to review data protection or privacy compliance under Icelandic law and GDPR. Triggers on requests involving personal data processing, privacy policies, DPIA assessments, kennitala handling, Persónuvernd filings, or cross-border data transfers from Iceland.

Conducts a structured Legitimate Interest Assessment (LIA) under Art. 6(1)(f) GDPR using the full EDPB three-step test — interest identification, strict necessity analysis, and the balancing test with mitigation. Built on EDPB Guidelines 1/2024, Opinion 28/2024 (AI models), CNIL guidance (June 2025), ICO/DUA Act 2025, key CJEU judgments, and DPA positions from DE/FR/NL/AT/IT/ES/UK. Includes specialised modules for AI/ML, marketing, fraud prevention, children's data, employee monitoring, ePrivacy overlap, and cross-border, plus a dedicated Right to Object (Art. 21) response mode and structured LIA output. Use this skill whenever the user mentions GDPR Art. 6(1)(f), legitimate interest, the LIA or three-step test, EDPB/DPA guidance, AI training data lawfulness, web scraping legality, direct marketing or fraud prevention legal basis, employee monitoring, the right to object, or asks for a balancing test — even if they don't say "LIA" explicitly.

GDPR Data Protection Impact Assessment (DPIA) guidance under Article 35 GDPR, EDPB Guidelines WP 248 rev.01, EDPB Opinion 28/2024 (AI), and national SA blacklists/whitelists. Covers threshold assessment, multi-jurisdictional blacklist checks (DE, FR, IE, BE, NL, IT, PL), 5x5 risk scoring, necessity/proportionality analysis, mitigation mapping, Art. 36 prior consultation, AI dual-phase analysis, and audit-ready .docx generation.

Incident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34. Covers breach risk assessment using ENISA severity methodology, Controller vs Processor obligations, 72-hour notification clock management, EDPB case matching, cross-border Lead SA determination, AI Act Art. 73 intersection, mitigation playbooks, and audit-ready .docx document generation.

Draft GDPR-compliant privacy notices as .docx for any EU/EEA jurisdiction and audience. Supports five notice types (Website/App, Applicant, Employee, Business Partner, B2C Customer) across DE, FR, AT, IT, ES, NL, BE, IE, and UK GDPR. Covers Art. 13/14 disclosures, AI Act transparency, cookie policies, multi-language support, DPIA indicators, and post-generation compliance checklists.

Navigate privacy regulations (GDPR, CCPA), review DPAs, and handle data subject requests. Use when reviewing data processing agreements, responding to data subject access or deletion requests, assessing cross-border data transfer requirements, or evaluating privacy compliance.

Guide for drafting privacy policies compliant with GDPR. Includes CNIL 2020 recommendations, a reference template, and best practices. Use when drafting or revising a privacy policy for a website or application.