Agent skill · software engineering · github
gdpr-compliant
Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authentication flows, implementing logging, handling user data, writing retention/deletion jobs, designing cloud infrastructure, or reviewing pull requests for privacy compliance. Trigger this skill for any task involving personal data, user accounts, cookies, analytics, emails, audit logs, encryption, pseudonymization, anonymization, data exports, breach response, CI/CD pipelines that process real data, or any question framed as "is this GDPR-compliant?". Inspired by CNIL developer guidance and GDPR Articles 5, 25, 32, 33, 35.
Why this skill is useful
Provides specific GDPR compliance engineering practices and patterns that the AI wouldn't reliably generate on its own.
What it needs
About 7k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
GDPR Engineering Skill Actionable GDPR reference for engineers, architects, DevOps, and tech leads. Inspired by CNIL developer guidance and GDPR Articles 5, 25, 32, 33, 35. Golden Rule: Collect less. Store less. Expose less. Retain less. For deep dives, read the reference files in references/: references/data-rights.md — user rights endpoints, DSR workflow, RoPA references/security.md — encryption, hashing, secrets, anonymization references/operations.md — cloud, CI/CD, incident response, architecture patterns --- 1. Core GDPR Principles (Article 5) Principle Engineering obligation --- --- Lawfulness, fairness, transparency Document legal basis for every processing activity in the RoPA Purpose limitation Data collected for purpose A MUST NOT be reused for purpose B without a new legal basis Data minimization Collect only fields with a documented business need today Accuracy Provide update endpoints; propagate corrections to downstream stores Storage limitation Define TTL at schema design time — never after Integrity & confidentiality Encrypt at rest and in transit; restrict and audit access Accountability Maintain evidence of compliance; RoPA ready for DPA inspection at any time --- 2. Privacy by Design & by Default MUST Add CreatedAt, RetentionExpiresAt to every table holding personal data at creation time. Default all optional data collection to off. Users opt in; they never opt out of a default-on setting. Conduct a DPIA before building high-risk processing (biometrics, health data, large-scale profiling, systematic monitoring). Update the RoPA with every new feature that introduces a processing activity. Sign a DPA with every sub-processor before data flows to them. MUST NOT Ship a new data collection feature without a documented legal basis. Enable analytics, tracking, or telemetry by default without explicit consent. Store personal data in a system not listed in the RoPA. --- 3. Data Minimization MUST Map every DTO/model field to a concrete business need. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/gdpr-compliant