data-privacy-controls – skill Dữ liệu & Khoa học cho agent AI

Data Privacy Controls

What it is: GDPR/CCPA.

Overview

Works out the smallest useful Data Privacy Controls setup for the business in front of it, then

builds it only when asked. The default output is a short recommendation, not a

spreadsheet. Artifacts - CSV, SQL DDL, JSON Schema, Notion mapping - are produced on

request, from one field list so they cannot drift apart.

Layer: Layer 7: Protect. Fits: Scale stage. Table code: n/a.

When to Use This Skill

• gdpr compliance
• data privacy register
• ccpa controls
• data protection tracker

Also use it when the user says "gdpr/ccpa", or describes the same process happening in a

spreadsheet, a document or someone inboxes.

Do not use it for: payroll calculation, tax filing, or legal advice. This skill produces

empty templates only - it never holds or processes real employee or customer data.

How It Works

Use the self-contained workflow below; no parent module or integration is required for empty local templates. Record lawful basis and retention as unknown until a qualified owner supplies them; a checkbox or example row does not establish compliance.

Step 1 - Identify intent

Read the request and pick the intent before asking anything.

• "set up" or "build" or "create" -> the user wants artifacts; go to Step 2.
• "our process is ..." or "it is in a sheet" -> the user wants to move an existing process; capture it, then Step 2.
• "is this right" or "review" or "audit" -> the user wants a check, not a build; answer from what they share.
• "how do I ..." -> advice question; answer directly and offer the build only if it helps.

Ask only if this is the highest-value missing fact; otherwise proceed without an opener:

> Q: What personal data do you hold?

Step 2 - Ask only what is missing

Skip anything the user already answered, in any earlier message. Ask the rest one at a

time, and stop as soon as the remaining answers would not change the output.

• Data - Which categories? / Employee, customer or both? / How many people affected?
• Purpose - Why is it held? / Consent given? / Any special categories?
• Controls - Who can access it? / Retention rules? / Deletion process?
• Current process - Is it documented? / Any privacy notice? / Has a breach happened?
• Outcome - What do you need? / A data inventory, a control list or both?

Never invent an answer. If the user does not know, record it as unknown and carry on.

Step 3 - Hold the internal context

Hold the answers in this shape. It stays internal - it is not shown to the user unless

they ask, and it never carries a value the user did not give.

module: data-privacy-controls
intent: null            # setup | advice | review | fix | build | convert | export
scale: null             # Starter | Growth | Scale, only if the answer changes it
areas:
  "Data": null
  "Purpose": null
  "Controls": null
  "Current process": null
  "Outcome": null
requested_outputs: []   # csv | sql | json | notion | xlsx - requested formats only
confirmed_facts: []     # only what the user actually said
open_questions: []      # the unanswered ones, in the order worth asking

Step 4 - Recommend the smallest workflow

If an artifact was requested, build it after resolving essential missing facts. Otherwise give a short recommendation and offer the relevant artifact.

Recommended approach: Start with an inventory of what is held and why, then attach an owner and a retention rule to each item.

Why this one: Privacy work fails without an inventory, because you cannot protect data you have not listed. The inventory comes first.

Workflow: Data category listed → Purpose recorded → Owner and access → Retention rule → Review

Step 5 - Build only on request

Once the user asks for it, derive the fields from the confirmed context and emit the

requested artifacts. For machine-readable text, keep prose outside the data; for files,

provide a usable link. Report material validation failures or limitations separately.

For a Notion output, provide the CSV and property mapping below for manual import. If notion-manual-import is separately available, it may assist with import instructions; it is optional. For requested workspace writes, verify actual tool access and the precise target, apply the authorized change, and read it back before claiming completion. Never ask for a password or token.

For an Excel-compatible CSV, use UTF-8 with a byte order mark so Excel opens the

text correctly. A CSV is not an .xlsx workbook; create .xlsx only when the user

requests a workbook.

A CSV carries no types, so after it, name the columns

that need a number, date or currency format applied.

Control,Data Category,Module,Legal Basis,Retention Period,Access Roles,Encryption,Consent Required,Owner,Last Reviewed,Status,Control ID
Employee data retention,Personal,Invoices & Billing,Contractual necessity,24 months after last activity,"People team, Finance",At rest and in transit,FALSE,Sneha Iyer,2026-01-15,Implemented,

CREATE TABLE data_privacy_controls (
  control VARCHAR(255),
  data_category VARCHAR(100) NOT NULL,
  module VARCHAR(255),
  legal_basis VARCHAR(255),
  retention_period VARCHAR(255),
  access_roles VARCHAR(255),
  encryption VARCHAR(255),
  consent_required BOOLEAN, -- NULL means applicability is unknown
  owner VARCHAR(255),
  last_reviewed DATE, -- NULL means no review has been recorded
  status VARCHAR(100) NOT NULL,
  control_id SERIAL PRIMARY KEY,
  created_at TIMESTAMP DEFAULT NOW(),
  updated_at TIMESTAMP DEFAULT NOW()
);

CREATE INDEX idx_data_privacy_controls_status ON data_privacy_controls (status);

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Data Privacy Controls",
  "type": "object",
  "additionalProperties": false,
  "properties": {
      "Control": { "type": "string" },
      "Data Category": { "type": "string" },
      "Module": { "type": "string" },
      "Legal Basis": { "type": "string" },
      "Retention Period": { "type": "string" },
      "Access Roles": { "type": "string" },
      "Encryption": { "type": "string" },
      "Consent Required": { "type": ["boolean", "null"] },
      "Owner": { "type": "string" },
      "Last Reviewed": { "type": ["string", "null"], "format": "date" },
      "Status": { "type": "string" },
      "Control ID": { "type": "integer" }
  },
  "required": [
      "Data Category",
      "Status"
  ]
}

| CSV column | Notion property | Set after import |
|---|---|---|
| Control | Title | Use as the database title |
| Data Category | Select (add options after import) | Convert to Select, add options: "Personal", "Sensitive", "Financial", "Health", "Biometric", "Location" |
| Module | Text | Leave as Text |
| Legal Basis | Text | Leave as Text |
| Retention Period | Text | Leave as Text |
| Access Roles | Text | Leave as Text |
| Encryption | Text | Leave as Text |
| Consent Required | Select | Use Unknown / Required / Not required; a Checkbox would collapse unknown into false |
| Owner | Text | Leave as Text |
| Last Reviewed | Date | Convert to Date |
| Status | Select (add options after import) | Convert to Select, add options: "Draft", "In Review", "Approved", "Implemented", "Retired" |
| Control ID | Text (preserve source ID) | Keep imported IDs as Text; optionally add a separate Unique ID property |

The rows above are documentation examples only. Emit empty templates unless the user explicitly requests examples. Money stays currency, dates stay date,

and anything pointing at another table stays relation.

Field Reference

| # | Field | Type | SQL | JSON Schema | Notion | CSV example |

|---:|---|---|---|---|---|---|

| 1 | Control | text | VARCHAR(255) | string | Text | Employee data retention |

| 2 | Data Category | select | VARCHAR(100) | string | Select (add options after import) | Personal |

| 3 | Module | text | VARCHAR(255) | string | Text | Invoices & Billing |

| 4 | Legal Basis | text | VARCHAR(255) | string | Text | Contractual necessity |

| 5 | Retention Period | text | VARCHAR(255) | string | Text | 24 months after last activity |

| 6 | Access Roles | text | VARCHAR(255) | string | Text | People team, Finance |

| 7 | Encryption | text | VARCHAR(255) | string | Text | At rest and in transit |

| 8 | Consent Required | nullable boolean | BOOLEAN NULL | boolean or null | Select: Unknown / Required / Not required | FALSE |

| 9 | Owner | text | VARCHAR(255) | string | Text | Sneha Iyer |

| 10 | Last Reviewed | nullable date | DATE NULL | string or null, format: date | Date | 2026-01-15 |

| 11 | Status | select | VARCHAR(100) | string | Select (add options after import) | Implemented |

| 12 | Control ID | id | SERIAL PRIMARY KEY | integer | Text (preserve source ID) | (blank) |

Select Options

Data Category

Personal | Sensitive | Finan

… (nội dung đầy đủ có trong gói tải về)