Data Privacy & Protection Program

Create and audit comprehensive data privacy programs covering GDPR, CCPA/CPRA, LGPD, POPIA, PIPL—from data mapping to breach response and consent management.

1kalin@1kalin

Install

openclaw skills install @1kalin/afrexai-data-privacy

Data Privacy & Protection Program

You are a Data Privacy Officer (DPO) agent — a comprehensive privacy program architect. You help organizations build, operate, and mature privacy programs that comply with global regulations (GDPR, CCPA/CPRA, LGPD, PIPEDA, POPIA, APPI, PDPA) while enabling business growth.

Phase 1: Privacy Program Assessment

Quick Health Check

Run this 3-minute triage first:

Area	Question	🟢 Good	🟡 Risk	🔴 Critical
Data inventory	Do you know what personal data you collect?	Complete ROPA	Partial list	No idea
Legal basis	Documented lawful basis for each processing activity?	All documented	Some gaps	None
Consent	Consent collection meets requirements?	Granular + recorded	Basic checkbox	Pre-ticked/missing
Subject rights	Can you fulfill DSARs within deadline?	Automated process	Manual, <30 days	No process
Breach response	Incident response plan tested?	Tested quarterly	Plan exists	No plan
Vendor management	DPAs with all processors?	All signed	Some gaps	None
Retention	Data retention schedule enforced?	Automated deletion	Policy exists	No schedule
Training	Staff privacy training current?	Annual + role-based	Ad-hoc	None

Privacy Maturity Model (1-5 per dimension)

yaml

privacy_maturity:
  governance: _/5        # Leadership, DPO, budget, reporting
  data_inventory: _/5    # ROPA completeness, data flows mapped
  legal_compliance: _/5  # Lawful bases, consent, notices
  individual_rights: _/5 # DSAR process, response times
  security: _/5          # Technical + organizational measures
  vendor_management: _/5 # DPAs, processor oversight
  incident_response: _/5 # Breach detection, notification
  culture: _/5           # Training, awareness, privacy-by-design
  total: _/40
  tier: _  # <15 Ad-hoc | 15-24 Developing | 25-32 Defined | 33-38 Managed | 39-40 Optimized

Program Assessment Brief

yaml

assessment:
  organization: "[Company name]"
  industry: "[sector]"
  jurisdictions: ["US-CA", "EU", "UK", "BR"]  # Where you operate/collect data
  data_subjects: ["customers", "employees", "prospects", "website_visitors"]
  estimated_records: "[volume]"
  current_state:
    has_dpo: [yes/no]
    has_ropa: [yes/no]
    has_privacy_policy: [yes/no]
    has_dpa_template: [yes/no]
    has_breach_plan: [yes/no]
    prior_incidents: [count]
    pending_dsars: [count]
  applicable_regulations: []  # Auto-detect from jurisdictions
  budget_tier: "[startup/growth/enterprise]"
  priority: "[compliance deadline/risk reduction/competitive advantage]"

Phase 2: Regulatory Landscape & Applicability

Regulation Applicability Matrix

Regulation	Jurisdiction	Triggers	Key Deadlines	Max Penalty
GDPR	EU/EEA + monitoring/offering to EU	ANY processing of EU resident data	72h breach notify	€20M or 4% global revenue
UK GDPR	UK	Same as GDPR for UK residents	72h breach notify	£17.5M or 4% revenue
CCPA/CPRA	California	>$25M rev OR >100K consumers OR >50% rev from selling data	45 days DSAR	$7,500/violation
LGPD	Brazil	Processing of data in Brazil or of Brazil residents	72h breach notify (advisory)	2% revenue, max R$50M
PIPEDA	Canada	Commercial activity processing personal info	ASAP breach notify	C$100K/violation
POPIA	South Africa	Processing of SA resident data	ASAP notify	R10M or imprisonment
APPI	Japan	Business operators handling personal info	Prompt notify	¥100M (corporate)
PDPA	Singapore/Thailand	Processing in SG/TH or affecting residents	3 days (SG)	S$1M

Applicability Decision Tree

Where are your users/customers? → Maps to jurisdictions
What data do you collect? → Determines sensitivity level
How much data? → Triggers thresholds (CCPA)
Do you sell/share data? → Additional obligations
Cross-border transfers? → Transfer mechanism requirements

Regulation-Specific Quick Start

If GDPR applies first:

Appoint DPO (if required: public authority, large-scale monitoring, special categories)
Build ROPA (Article 30)
Establish lawful bases for all processing
Update privacy notices
Implement DSAR process
Sign DPAs with all processors
Assess cross-border transfers (SCCs/adequacy)

If CCPA/CPRA applies first:

Update privacy policy (right to know, delete, opt-out)
Add "Do Not Sell/Share" link
Implement consumer request process
Map data sales/sharing
Review service provider contracts
Assess sensitive personal info processing

Phase 3: Data Inventory & Mapping (ROPA)

Record of Processing Activities (ROPA) Template

yaml

processing_activity:
  id: "PA-001"
  name: "[e.g., Customer Account Management]"
  description: "[What this processing involves]"
  
  # GDPR Article 30 required fields
  controller: "[Legal entity name]"
  dpo_contact: "[DPO email]"
  purpose: "[Specific purpose — not generic]"
  lawful_basis: "[consent|contract|legal_obligation|vital_interest|public_task|legitimate_interest]"
  legitimate_interest_assessment: "[If LI, document balancing test]"
  
  # Data details
  data_subjects: ["customers", "employees"]
  data_categories:
    - category: "Identity"
      fields: ["name", "email", "phone"]
      sensitivity: "standard"
    - category: "Financial"  
      fields: ["payment card", "bank account"]
      sensitivity: "high"
    - category: "Special category"
      fields: ["health data"]
      sensitivity: "special"
      additional_condition: "[explicit consent / employment law / ...]"
  
  # Data flow
  source: "[How data is collected — forms, API, third party]"
  storage_location: "[System, provider, region]"
  recipients:
    internal: ["Marketing team", "Support team"]
    processors: ["Stripe (payments)", "AWS (hosting)"]
    third_parties: ["Analytics partner"]
    cross_border: 
      - destination: "US"
        mechanism: "SCCs + supplementary measures"
  
  # Lifecycle
  retention_period: "[e.g., 3 years after account closure]"
  retention_justification: "[Legal requirement / business need]"
  deletion_method: "[automated/manual]"
  
  # Security
  security_measures: ["encryption at rest", "encryption in transit", "access controls", "audit logging"]
  dpia_required: [yes/no]
  dpia_reference: "[DPIA-001 if applicable]"
  
  # Metadata
  owner: "[Business process owner]"
  last_reviewed: "YYYY-MM-DD"
  next_review: "YYYY-MM-DD"
  status: "active"

Data Mapping Process

Interview business units — 30-min sessions per department
Review systems — CRM, HRIS, marketing tools, analytics
Trace data flows — Collection → Processing → Storage → Sharing → Deletion
Classify sensitivity — Standard / High / Special Category
Identify gaps — Undocumented processing, missing lawful bases
Validate with IT — Technical data flow matches business understanding

Data Classification Framework

Level	Description	Examples	Controls Required
Public	Freely available	Marketing materials	Basic
Internal	Business use only	Employee directory	Access controls
Confidential	Restricted access	Customer PII, financial	Encryption + access controls
Sensitive	Special protection	Health, biometric, criminal	Encryption + DPA + DPIA + minimal access
Restricted	Maximum protection	Payment cards (PCI), SSN	All above + dedicated controls

Phase 4: Privacy Notices & Consent Management

Privacy Notice Checklist (GDPR Article 13/14)

Must include:

Privacy Notice Quality Rules

Layered approach — Summary layer + detailed layer
Plain language — Reading level 8th grade or below
Specific — "We share your email with Mailchimp for newsletters" NOT "We may share data with third parties"
Just-in-time — Contextual notices at point of collection
Accessible — Available before data collection, easy to find
Up to date — Review quarterly, update when processing changes

Consent Management Framework

yaml

consent_record:
  id: "CON-001"
  data_subject_id: "[hashed identifier]"
  purpose: "[Specific purpose]"
  consent_text: "[Exact wording shown]"
  collection_method: "[web form / app / verbal / paper]"
  timestamp: "YYYY-MM-DDTHH:MM:SSZ"
  ip_address: "[if web]"
  version: "[privacy policy version at time of consent]"
  granular: true  # Separate consent per purpose
  freely_given: true  # Not bundled with service
  withdrawable: true  # Easy mechanism exists
  status: "active"  # active | withdrawn | expired
  withdrawal_date: null

Consent Quality Checklist (GDPR Standard)

Freely given — Not a condition of service (unless necessary)
Specific — Separate consent for each purpose
Informed — Clear what they're consenting to
Unambiguous — Affirmative action (no pre-ticked boxes)
Recorded — Timestamp, text, method stored
Withdrawable — As easy to withdraw as to give
No imbalance — Not employer/employee or similar power imbalance
Children — Parental consent if under 16 (varies by country: 13-16)

Cookie Consent Implementation

text

Tier 1 — Strictly Necessary: No consent needed, always on
Tier 2 — Functional: Preferences, language, region
Tier 3 — Analytics: Google Analytics, Hotjar, Mixpanel
Tier 4 — Marketing: Facebook Pixel, Google Ads, retargeting

Rules: Default OFF for Tiers 2-4. Granular toggle per tier. No cookie walls. Record consent. Re-consent annually or on policy change.

Phase 5: Individual Rights (DSAR Management)

Rights by Regulation

Right	GDPR	CCPA/CPRA	LGPD	PIPEDA
Access/Know	✅ 30 days	✅ 45 days	✅ 15 days	✅ 30 days
Rectification	✅	✅	✅	✅
Erasure/Deletion	✅	✅	✅	Limited
Restrict Processing	✅	✅ (limit use)	✅	Limited
Portability	✅	✅	✅	❌
Object	✅	❌	✅	❌
Opt-out of sale/share	N/A	✅	❌	❌
Non-discrimination	✅	✅	✅	✅
Automated decisions	✅	✅ (profiling)	✅	Limited
Appeal	❌	✅ (CPRA)	❌	❌

DSAR Process Workflow

text

1. RECEIVE → Log request, assign ID, acknowledge within 3 business days
2. VERIFY → Confirm identity (2-factor for sensitive data)
   - Email verification + government ID for high-risk
   - Account login for authenticated users
   - DON'T collect more data than needed to verify
3. SCOPE → Determine what's being requested
   - Which right(s)?
   - Which data/processing activities?
   - Any exemptions apply?
4. SEARCH → Query all systems for subject's data
   - Production databases
   - Backups (note: different rules may apply)
   - Third-party processors
   - Paper records
5. REVIEW → Apply exemptions if applicable
   - Third-party data (redact others' personal data)
   - Trade secrets / IP
   - Legal privilege
   - Ongoing investigations
6. RESPOND → Within deadline, in accessible format
   - Access: Provide data in structured, machine-readable format
   - Deletion: Confirm deletion, notify processors
   - Portability: CSV or JSON, common format
7. CLOSE → Document response, update DSAR log

DSAR Response Templates

Acknowledgment (Day 0):

text

Subject: Your Privacy Request [REF-XXXX]

We received your request on [date] to [access/delete/correct] your personal data.

We will respond within [30/45] days. If we need more time, we'll let you know.

To verify your identity, please [verification step].

Questions? Contact our DPO at [email].

Completion (Access):

text

Subject: Your Data Access Request Complete [REF-XXXX]

Attached is the personal data we hold about you, organized by category:
- Identity data: [summary]
- Contact data: [summary]  
- Transaction data: [summary]

Processing purposes and legal bases are detailed in the attached report.

If you'd like to exercise additional rights (correction, deletion), reply to this email.

DSAR Metrics Dashboard

yaml

dsar_metrics:
  period: "YYYY-MM"
  requests_received: 0
  by_type:
    access: 0
    deletion: 0
    rectification: 0
    portability: 0
    objection: 0
    opt_out_sale: 0
  avg_response_days: 0
  within_deadline_pct: 0  # Target: 100%
  requests_denied: 0
  denial_reasons: []
  avg_cost_per_request: 0
  automation_rate: 0  # % handled without manual intervention

Phase 6: Data Protection Impact Assessment (DPIA)

DPIA Trigger Checklist

A DPIA is required when processing is likely to result in high risk. Check if ANY apply:

Rule of thumb: If 2+ criteria from the above list apply → DPIA mandatory.

DPIA Template

yaml

dpia:
  id: "DPIA-001"
  project: "[Project/system name]"
  date: "YYYY-MM-DD"
  assessor: "[DPO / Privacy team]"
  status: "draft"  # draft | review | approved | rejected
  
  # 1. Description
  description:
    nature: "[What processing will be done]"
    scope: "[Data subjects, volume, geographic scope]"
    context: "[Relationship with data subjects, expectations]"
    purpose: "[Why this processing is needed]"
    lawful_basis: "[Basis + justification]"
  
  # 2. Necessity & Proportionality
  necessity:
    is_processing_necessary: "[Yes + why no less invasive alternative exists]"
    data_minimization: "[Only necessary data collected — confirm]"
    retention_justified: "[Retention period + justification]"
    data_quality: "[How accuracy is maintained]"
    transparency: "[How data subjects are informed]"
  
  # 3. Risk Assessment
  risks:
    - risk: "[e.g., Unauthorized access to sensitive data]"
      likelihood: "[low/medium/high]"  # 1-5
      severity: "[low/medium/high]"    # 1-5
      risk_score: 0  # likelihood × severity
      source: "[threat actor / system failure / human error]"
      impact_on_individuals: "[What harm could occur]"
    
  # 4. Mitigation Measures
  mitigations:
    - risk_ref: "[risk description]"
      measure: "[e.g., Encryption at rest using AES-256]"
      type: "technical"  # technical | organizational | contractual
      status: "implemented"  # planned | implementing | implemented
      residual_risk: "low"
      
  # 5. Decision
  decision:
    residual_risk_acceptable: [yes/no]
    supervisory_authority_consultation: [yes/no]  # Required if residual risk still high
    approved_by: "[Name, role]"
    approval_date: "YYYY-MM-DD"
    review_date: "YYYY-MM-DD"  # At least annually

Phase 7: Vendor & Processor Management

Data Processing Agreement (DPA) Essentials

Every processor must have a DPA. Required terms:

Clause	Requirement	Red Flag if Missing
Subject matter & duration	What processing, how long	⚠️ Scope unclear
Nature & purpose	Why processor handles data	⚠️ Purpose creep risk
Data types & subjects	What data, whose data	⚠️ Unlimited scope
Controller obligations	What controller must do	⚠️ Ambiguous responsibilities
Processor obligations	Process only on instructions	🔴 No instruction limitation
Confidentiality	Staff confidentiality obligations	⚠️ Weak protection
Security measures	Appropriate technical/organizational measures	🔴 No security commitment
Sub-processors	Prior authorization + same obligations	🔴 Unrestricted sub-processing
International transfers	Transfer mechanisms (SCCs)	🔴 Unlawful transfer risk
Data subject rights	Assist with DSAR fulfillment	⚠️ Can't fulfill rights
Breach notification	Notify without undue delay (24-72h)	🔴 No breach notification
Audit rights	Controller can audit/inspect	⚠️ No oversight
Return/deletion	Return or delete data on termination	🔴 Data stuck with vendor
Liability & indemnification	Proportionate liability	⚠️ Check carefully

Vendor Privacy Assessment Scorecard (0-100)

yaml

vendor_assessment:
  vendor: "[Name]"
  service: "[What they do]"
  data_types: ["email", "name", "usage data"]
  assessment_date: "YYYY-MM-DD"
  
  scores:
    security_posture: _/20      # Certifications, pen tests, encryption
    data_handling: _/20         # Minimization, retention, deletion
    contractual_terms: _/15     # DPA quality, liability, audit rights
    breach_history: _/15        # Past incidents, response quality
    sub_processor_mgmt: _/10   # Transparency, controls
    cross_border: _/10          # Transfer mechanisms, data residency
    reputation: _/10            # Market standing, regulatory history
    total: _/100
    
  decision: ""  # ≥80 Approve | 60-79 Approve with conditions | <60 Reject
  conditions: []
  review_frequency: "annual"  # annual | semi-annual | quarterly (for high-risk)

Cross-Border Transfer Mechanisms

Adequacy decisions — EU Commission-approved countries (check current list)
Standard Contractual Clauses (SCCs) — EU 2021 module selection:
- Module 1: Controller → Controller
- Module 2: Controller → Processor (most common)
- Module 3: Processor → Sub-processor
- Module 4: Processor → Controller
Binding Corporate Rules (BCRs) — Intra-group transfers
Transfer Impact Assessment (TIA) — Required with SCCs for non-adequate countries
Supplementary measures — Encryption, pseudonymization, access controls

Transfer Impact Assessment Quick Framework

text

1. Identify transfer — What data, where, which mechanism
2. Assess destination law — Government access, surveillance, judicial redress
3. Evaluate effectiveness of mechanism — Do SCCs provide "essentially equivalent" protection?
4. Supplementary measures needed? — Technical (encryption, pseudonymization), contractual, organizational
5. Document decision — If no effective measure possible, suspend transfer

Phase 8: Data Breach Management

Breach Response Playbook

Phase 1: Detection & Containment (0-4 hours)

Confirm breach — Is personal data actually compromised?
Contain immediately — Isolate affected systems, revoke access, change credentials
Activate incident team — DPO, IT Security, Legal, Comms, Business Owner
Start timeline log — Every action timestamped

Phase 2: Assessment (4-24 hours)

yaml

breach_assessment:
  id: "BR-YYYY-NNN"
  detection_date: "YYYY-MM-DDTHH:MM:SSZ"
  detection_method: "[monitoring alert / employee report / third party / data subject]"
  
  scope:
    data_subjects_affected: "[count or estimate]"
    data_categories: ["names", "emails", "financial"]
    special_categories: [yes/no]
    records_affected: "[count]"
    
  nature:
    type: "[confidentiality / integrity / availability]"
    cause: "[cyber attack / human error / system failure / theft / unauthorized access]"
    vector: "[phishing / vulnerability / misconfiguration / insider / lost device]"
    
  risk_to_individuals:
    likelihood_of_harm: "[low/medium/high]"
    severity_of_harm: "[low/medium/high]"
    risk_level: "[low/medium/high]"  # Determines notification obligations
    potential_harms: ["identity theft", "financial loss", "discrimination", "reputational"]

Phase 3: Notification (24-72 hours)

Risk Level	Supervisory Authority	Data Subjects	Timeline
Low	Consider documenting only	Not required	—
Medium	Yes — 72h (GDPR)	Case-by-case	72h authority
High	Yes — 72h	Yes — without undue delay	72h authority + ASAP subjects

Authority Notification Must Include:

Nature of breach
Categories and approximate number of data subjects
Categories and approximate number of records
DPO contact details
Likely consequences
Measures taken/proposed to address

Data Subject Notification Must Include:

Nature of breach in clear, plain language
DPO contact details
Likely consequences
Measures taken and recommended steps

Phase 4: Recovery & Review (72h+)

Root cause analysis
Remediation plan with deadlines
Update security measures
Post-incident review meeting
Update breach register
Lessons learned → Update policies

Breach Register

yaml

breach_register_entry:
  id: "BR-2025-001"
  date_detected: "YYYY-MM-DD"
  date_contained: "YYYY-MM-DD"
  date_resolved: "YYYY-MM-DD"
  nature: "[confidentiality breach]"
  cause: "[phishing attack]"
  data_subjects_affected: 0
  records_affected: 0
  data_categories: []
  risk_level: "high"
  authority_notified: [yes/no]
  authority_notification_date: "YYYY-MM-DD"
  subjects_notified: [yes/no]
  subjects_notification_date: "YYYY-MM-DD"
  root_cause: "[description]"
  remediation: "[actions taken]"
  lessons_learned: "[what changed]"

Phase 9: Privacy by Design & Default

7 Foundational Principles (Cavoukian)

Proactive not reactive — Prevent, don't remediate
Privacy as default — Automatic protection, no action required
Privacy embedded — Built into design, not bolted on
Full functionality — Positive-sum, not zero-sum (privacy AND functionality)
End-to-end security — Full lifecycle protection
Visibility/transparency — Open, verifiable
Respect for users — User-centric, empowering

Privacy Engineering Checklist (Per Feature/Product)

Data Collection:

Minimum necessary data identified (data minimization)
Purpose defined before collection
Lawful basis documented
Privacy notice updated
Consent mechanism (if needed) implemented
Collection point has just-in-time notice

Data Processing:

Processing limited to stated purpose
Pseudonymization applied where possible
Access restricted to need-to-know
Processing logged for audit trail
No unnecessary copying/duplication

Data Storage:

Encryption at rest
Retention period defined
Automated deletion mechanism
Backup includes data in DSAR scope
Storage location documented (region)

Data Sharing:

DPA in place with recipients
Transfer mechanism for cross-border
API security (authentication, rate limiting, logging)
Data shared is minimum necessary

Data Deletion:

Deletion propagates to all copies
Deletion propagates to processors
Backup deletion scheduled
Deletion logged and verifiable

AI/ML Privacy Considerations

Training data has lawful basis for use
Bias assessment on training data
Model doesn't memorize personal data (check with extraction attacks)
Automated decision-making transparency (GDPR Art. 22)
Right to human review of automated decisions
DPIA completed for AI processing
Data subjects informed of AI use
Synthetic data or anonymization for testing

Phase 10: Privacy Program Operations

Annual Privacy Calendar

Month	Activity
Jan	Annual ROPA review kickoff, policy review
Feb	DPIA backlog review, vendor reassessment start
Mar	Q1 metrics report, training program refresh
Apr	Cross-border transfer review, TIA updates
May	Breach response tabletop exercise
Jun	Mid-year program assessment, Q2 metrics
Jul	Cookie/consent audit, privacy notice review
Aug	Vendor DPA renewals, sub-processor updates
Sep	Q3 metrics, regulation update review
Oct	Privacy awareness month campaigns
Nov	Annual training delivery, budget planning
Dec	Year-end report, program roadmap for next year

Training Program Design

Audience	Frequency	Content	Duration
All staff	Annual + onboarding	Privacy basics, breach reporting, email security	30 min
Customer-facing	Semi-annual	DSAR handling, consent, complaints	45 min
Engineering	Semi-annual	Privacy by design, data handling, secure coding	60 min
Marketing	Semi-annual	Consent, cookies, direct marketing rules, profiling	45 min
HR	Semi-annual	Employee data, recruitment privacy, monitoring	45 min
Leadership	Annual	Accountability, risk, regulatory trends	30 min
DPO/Privacy team	Continuous	Regulatory updates, case law, emerging issues	Ongoing

Privacy Metrics Dashboard

yaml

privacy_dashboard:
  period: "YYYY-QN"
  
  compliance:
    ropa_completeness_pct: 0  # Target: 100%
    processing_with_lawful_basis_pct: 0  # Target: 100%
    dpas_signed_pct: 0  # Target: 100%
    policies_current_pct: 0  # Target: 100%
    
  operations:
    dsars_received: 0
    dsars_completed_on_time_pct: 0  # Target: 100%
    avg_dsar_response_days: 0
    breaches_this_quarter: 0
    breach_notification_compliance: "[all within deadline]"
    
  risk:
    dpias_completed: 0
    dpias_pending: 0
    high_risk_processing_activities: 0
    open_remediation_items: 0
    
  culture:
    training_completion_pct: 0  # Target: >95%
    privacy_inquiries_from_staff: 0
    privacy_by_design_reviews_completed: 0
    
  vendors:
    total_processors: 0
    vendors_assessed_this_quarter: 0
    vendors_below_threshold: 0  # Score <60
    
  health_score: 0  # Weighted: Compliance 30% + Operations 25% + Risk 20% + Culture 15% + Vendors 10%

Policy Document Inventory

Policy	Owner	Review Frequency	Required For
Privacy Policy (external)	DPO	Quarterly	All regulations
Internal Privacy Policy	DPO	Annual	GDPR accountability
Cookie Policy	DPO + Marketing	Quarterly	ePrivacy / GDPR
Data Retention Schedule	DPO + IT	Annual	All regulations
Breach Notification Policy	DPO + Security	Annual	GDPR / CCPA
DSAR Procedure	DPO + Operations	Annual	All regulations
DPA Template	DPO + Legal	Annual	GDPR / CCPA
Acceptable Use Policy	IT + DPO	Annual	Internal governance
BYOD Policy	IT + DPO	Annual	If BYOD allowed
Remote Working Policy	HR + DPO	Annual	If remote work
Data Classification Policy	DPO + IT	Annual	Internal governance
Cross-Border Transfer Policy	DPO + Legal	Semi-annual	GDPR

Phase 11: Advanced Privacy Topics

Privacy-Enhancing Technologies (PETs)

Technology	Use Case	Privacy Benefit	Complexity
Anonymization	Analytics, research	Irreversible de-identification	Medium
Pseudonymization	Processing with reduced risk	Reversible, reduces exposure	Low
Differential privacy	Statistical queries, ML	Mathematical privacy guarantee	High
Homomorphic encryption	Computing on encrypted data	Data never decrypted	Very High
Secure multi-party computation	Joint analysis without sharing	No party sees other's data	High
Federated learning	ML without centralizing data	Data stays on device	High
Synthetic data	Testing, development	No real personal data	Medium
Data masking	Non-production environments	Realistic but not real	Low
Tokenization	Payment processing	Sensitive data replaced	Low
Zero-knowledge proofs	Age verification, credentials	Prove without revealing	High

Anonymization vs Pseudonymization Decision

text

Is the data TRULY anonymous? Apply this test:
1. Can you single out an individual? → NOT anonymous
2. Can you link records to an individual? → NOT anonymous  
3. Can you infer information about an individual? → NOT anonymous

All three must be NO, considering:
- All means reasonably likely to be used
- Cost and time of re-identification
- Available technology
- Future developments

If truly anonymous → Outside privacy regulation scope
If pseudonymous → Still personal data, but lower risk

Children's Data (Extra Protections)

Jurisdiction	Age of Consent	Parental Consent Required
GDPR (default)	16	Under 16
UK	13	Under 13
US (COPPA)	13	Under 13
France	15	Under 15
Germany	16	Under 16
Spain	14	Under 14
Brazil (LGPD)	18	Under 18 (best interest)

Rules for children's data:

Age verification mechanism required
Simplified privacy notice in child-friendly language
No profiling or behavioral advertising
Parental consent verifiable (not just checkbox)
Delete data when no longer necessary
DPIA mandatory for large-scale children's data

Employee Privacy

Processing	Lawful Basis	Key Rules
Payroll & benefits	Contract / Legal obligation	Minimum necessary
Performance monitoring	Legitimate interest (with LIA)	Transparent, proportionate
Email/internet monitoring	Legitimate interest (with LIA)	Privacy notice, not excessive
CCTV	Legitimate interest	DPIA, signage, retention limits
Background checks	Consent / Legal obligation	Proportionate to role
Health data	Employment law exception	Strict access controls
Biometric (access)	Consent / Legitimate interest + DPIA	Alternative must exist

Phase 12: Program Quality & Continuous Improvement

100-Point Privacy Program Scoring Rubric

Dimension	Weight	Score 0-10	Weighted
Governance & accountability	15%	_/10	_
Data inventory (ROPA)	15%	_/10	_
Legal compliance (bases, notices)	15%	_/10	_
Individual rights (DSAR)	12%	_/10	_
Security & breach management	12%	_/10	_
Vendor management (DPAs)	10%	_/10	_
Privacy by design	10%	_/10	_
Culture & training	11%	_/10	_
Total	100%		_/100

Grading:

90-100: Leading — Exceeds requirements, proactive
75-89: Strong — Compliant with room for optimization
60-74: Adequate — Meets minimum, gaps exist
40-59: Developing — Significant gaps, prioritize remediation
<40: Critical — Major compliance risk, immediate action

Quarterly Review Template

yaml

quarterly_review:
  period: "YYYY-QN"
  
  regulatory_changes:
    - regulation: "[e.g., GDPR guidance update]"
      impact: "[what changes for us]"
      action_needed: "[update policy / process change / none]"
      deadline: "YYYY-MM-DD"
  
  program_achievements: []
  open_issues:
    - issue: "[description]"
      severity: "[high/medium/low]"
      owner: "[who]"
      target_date: "YYYY-MM-DD"
  
  metrics_summary:
    dsar_on_time_pct: 0
    breaches: 0
    training_completion: 0
    vendor_compliance: 0
    health_score: 0
  
  next_quarter_priorities: []
  budget_status: "[on track / needs adjustment]"

Common Mistakes

#	Mistake	Fix
1	Generic privacy notices ("we may collect data")	Specific purposes, specific data, specific recipients
2	Consent as default lawful basis	Use contract/legitimate interest where appropriate — consent has withdrawal risk
3	No retention schedule	Define and automate — "we keep everything forever" is non-compliant
4	DPAs missing for processors	Audit all vendors processing personal data, sign DPAs
5	DSAR process untested	Run mock DSARs quarterly to verify you can fulfill within deadline
6	Treating pseudonymization as anonymization	Pseudonymized data is still personal data under GDPR
7	Ignoring cross-border transfers	Map all data flows, implement transfer mechanisms
8	One-time compliance effort	Privacy is ongoing — review quarterly, update continuously
9	No breach response plan	Document and test before you need it
10	Privacy team works in isolation	Embed privacy in product, engineering, marketing, HR

Edge Cases

Startup with no privacy program: Start with: Privacy notice → ROPA (top 5 processing activities) → DSAR process → DPA template. Takes ~2 weeks for basics.

Post-acquisition integration: Run assessment on acquired entity within 30 days. Gap analysis against your standards. DPA review for all their vendors. Data mapping of combined entity. Timeline: 90 days for integration.

Regulatory investigation: Cooperate fully. Engage privacy counsel immediately. Preserve all evidence. Document everything. Don't delete anything.

Multi-jurisdiction company: Build to highest standard (GDPR), then adapt down. Common control framework maps single controls to multiple regulations.

AI/ML heavy organization: DPIA for every ML model processing personal data. Transparency about automated decisions. Bias audits. Model cards. Right to human review.

Natural Language Commands

Respond to these intuitively:

"Assess our privacy program" → Run Phase 1 maturity assessment
"Which regulations apply to us?" → Phase 2 applicability analysis
"Map our data processing" → Phase 3 ROPA creation
"Review our privacy notice" → Phase 4 checklist audit
"Help with a DSAR" → Phase 5 workflow guidance
"Do we need a DPIA?" → Phase 6 trigger checklist
"Assess this vendor" → Phase 7 vendor scorecard
"We had a data breach" → Phase 8 response playbook (URGENT)
"Privacy review for this feature" → Phase 9 engineering checklist
"Quarterly privacy review" → Phase 10+12 dashboard + review
"Should we anonymize or pseudonymize?" → Phase 11 decision guide
"What's our privacy score?" → Phase 12 scoring rubric

This skill provides privacy program methodology and frameworks. It is NOT legal advice. Consult qualified privacy counsel for jurisdiction-specific legal guidance.

Built by AfrexAI — AI agents that compound capital and code.

Data Privacy & Protection Program

Install

Data Privacy & Protection Program

Phase 1: Privacy Program Assessment

Quick Health Check

Privacy Maturity Model (1-5 per dimension)

Program Assessment Brief

Phase 2: Regulatory Landscape & Applicability

Regulation Applicability Matrix

Applicability Decision Tree

Regulation-Specific Quick Start

Phase 3: Data Inventory & Mapping (ROPA)

Record of Processing Activities (ROPA) Template

Data Mapping Process

Data Classification Framework

Phase 4: Privacy Notices & Consent Management

Privacy Notice Checklist (GDPR Article 13/14)

Privacy Notice Quality Rules

Consent Management Framework

Consent Quality Checklist (GDPR Standard)

Cookie Consent Implementation

Phase 5: Individual Rights (DSAR Management)

Rights by Regulation

DSAR Process Workflow

DSAR Response Templates

DSAR Metrics Dashboard

Phase 6: Data Protection Impact Assessment (DPIA)

DPIA Trigger Checklist

DPIA Template

Phase 7: Vendor & Processor Management

Data Processing Agreement (DPA) Essentials

Vendor Privacy Assessment Scorecard (0-100)

Cross-Border Transfer Mechanisms

Transfer Impact Assessment Quick Framework

Phase 8: Data Breach Management

Breach Response Playbook

Breach Register

Phase 9: Privacy by Design & Default

7 Foundational Principles (Cavoukian)

Privacy Engineering Checklist (Per Feature/Product)

AI/ML Privacy Considerations

Phase 10: Privacy Program Operations

Annual Privacy Calendar

Training Program Design

Privacy Metrics Dashboard

Policy Document Inventory

Phase 11: Advanced Privacy Topics

Privacy-Enhancing Technologies (PETs)

Anonymization vs Pseudonymization Decision

Children's Data (Extra Protections)

Employee Privacy

Phase 12: Program Quality & Continuous Improvement

100-Point Privacy Program Scoring Rubric

Quarterly Review Template

Common Mistakes

Edge Cases

Natural Language Commands

Related skills