Conducts Privacy Impact Assessments for vendor/third-party processors under GDPR Article 28, covering due diligence, DPA requirements, sub-processors, cross-border transfers, cloud providers, and monitoring.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeThis skill uses the workspace's default tool permissions.
When a controller engages a processor (vendor) to process personal data on its behalf, GDPR Article 28 imposes specific obligations on the controller to ensure that the processor provides sufficient guarantees to implement appropriate technical and organisational measures. The EDPB has repeatedly emphasized that the controller remains accountable for the processing regardless of delegation to a...
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
When a controller engages a processor (vendor) to process personal data on its behalf, GDPR Article 28 imposes specific obligations on the controller to ensure that the processor provides sufficient guarantees to implement appropriate technical and organisational measures. The EDPB has repeatedly emphasized that the controller remains accountable for the processing regardless of delegation to a vendor. This skill provides a structured PIA methodology for assessing and managing the privacy risks of vendor data processing arrangements.
| Requirement | Description |
|---|---|
| Art. 28(1) | Controller shall use only processors providing sufficient guarantees |
| Art. 28(2) | Processor shall not engage another processor (sub-processor) without prior specific or general written authorisation |
| Art. 28(3) | Processing governed by a contract or legal act setting out subject matter, duration, nature, purpose, data types, categories of data subjects, and controller obligations/rights |
| Art. 28(3)(a)-(h) | Mandatory DPA clauses: process only on documented instructions, confidentiality, security measures, sub-processor conditions, assist with data subject rights, assist with security/breach/DPIA, delete or return data, provide audit information |
| Art. 28(4) | Sub-processor must be bound by the same data protection obligations |
| Art. 28(5) | Adherence to approved codes of conduct or certification (Art. 42) as elements to demonstrate sufficient guarantees |
The controller must assess the processor's:
| Risk Category | Examples | Risk Level |
|---|---|---|
| Cloud infrastructure (IaaS/PaaS) | AWS, Azure, GCP — hosting personal data | High (data at rest and in transit under vendor control) |
| SaaS applications | CRM, HRIS, email marketing — processing personal data in vendor application | High (vendor application logic and access controls) |
| Analytics providers | Website analytics, marketing attribution — processing behavioural data | Medium-High (data sharing, profiling, cookie compliance) |
| IT support / managed services | Helpdesk, system administration — access to personal data during support | Medium (access-based risk, not purpose-based) |
| Payment processors | Card processing, billing — financial personal data | High (PCI DSS intersection, financial data sensitivity) |
| Sub-processors | Vendor's own vendors processing controller's data | High (reduced visibility and control) |