Help us improve
Share bugs, ideas, or general feedback.
Drafts GDPR compliance notes for journalistic content or data collection activities, documenting lawful basis, data categories, retention, and access controls.
npx claudepluginhub ur-grue/autopunk-media-skills --plugin autopunk-media-skillsHow this skill is triggered — by the user, by Claude, or both
Slash command
/autopunk-media-skills:gdpr-note-writerThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Drafts a GDPR compliance note for a specific piece of journalistic content or data collection activity — documenting the lawful basis for processing personal data, what data is held, how long it is retained, and who has access.
Drafts plain-language GDPR data handling notices for journalistic/media projects. Use when collecting personal data for interviews, surveys, recordings, or contributor databases.
Audits code/systems for GDPR violations, drafts privacy policies/DPAs/consent notices, answers questions with article citations, reviews data flows/PII handling.
Assess GDPR compliance for data processing, rights, privacy controls, and incident response obligations.
Share bugs, ideas, or general feedback.
Drafts a GDPR compliance note for a specific piece of journalistic content or data collection activity — documenting the lawful basis for processing personal data, what data is held, how long it is retained, and who has access.
Required: A description of the content or activity — what personal data is involved, who the individuals are (e.g. private individuals, public figures, sources, interview subjects), how the data was collected, and what the editorial purpose is.
Optional: How long you intend to retain the data, who within your organisation will have access, whether the data will be shared with third parties, whether any data will be published, the country your publication is based in.
A structured compliance note of 350–500 words, organised under five headings: Data Categories, Purpose and Lawful Basis, Retention, Access and Third-Party Sharing, and Risks and Actions Required. Tone is factual and administrative — suitable for internal records or DPO review. Plain English throughout; technical GDPR terms are used where necessary but always followed by a brief explanation.
I am writing an investigation into a pattern of workplace injury claims at a logistics company. I have interview recordings with six former employees who spoke on the record about their experiences. I also have a spreadsheet of 340 workers compiled from public tribunal records — names, dates of injury, and outcomes. The article will name the six interviewees and refer to the tribunal dataset in aggregate, but will not publish individual rows. I am based in the UK.
Data Categories
This project involves two categories of personal data:
Purpose and Lawful Basis
The processing is for journalistic purposes — investigation and publication of a matter of significant public interest (workplace safety accountability).
The six interview subjects have given informed consent to be named and for their accounts to be published. Consent is documented in signed release forms retained with project files.
Retention
Access and Third-Party Sharing
Access is restricted to the lead journalist and the managing editor. The dataset will not be shared with third parties. If the article is fact-checked externally, the checker will be granted read-only access to anonymised extracts only and will be required to sign a confidentiality agreement before access is granted.
Risks and Actions Required
This note is for internal records only. It is not a substitute for qualified legal or data protection advice.