# Send Data Privacy & Protection Program to your agent
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
## Fast path
- Download the package from Yavira.
- Extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the extracted folder.
## Suggested prompts
### New install

```text
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete.
```
### Upgrade existing

```text
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run.
```
## Machine-readable fields
```json
{
  "schemaVersion": "1.0",
  "item": {
    "slug": "afrexai-data-privacy",
    "name": "Data Privacy & Protection Program",
    "source": "tencent",
    "type": "skill",
    "category": "其他",
    "sourceUrl": "https://clawhub.ai/1kalin/afrexai-data-privacy",
    "canonicalUrl": "https://clawhub.ai/1kalin/afrexai-data-privacy",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadUrl": "/downloads/afrexai-data-privacy",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=afrexai-data-privacy",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "packageFormat": "ZIP package",
    "primaryDoc": "SKILL.md",
    "includedAssets": [
      "README.md",
      "SKILL.md"
    ],
    "downloadMode": "redirect",
    "sourceHealth": {
      "source": "tencent",
      "slug": "afrexai-data-privacy",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-29T14:30:07.589Z",
      "expiresAt": "2026-05-06T14:30:07.589Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=afrexai-data-privacy",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=afrexai-data-privacy",
        "contentDisposition": "attachment; filename=\"afrexai-data-privacy-1.1.0.zip\"",
        "redirectLocation": null,
        "bodySnippet": null,
        "slug": "afrexai-data-privacy"
      },
      "scope": "item",
      "summary": "Item download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this item.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/afrexai-data-privacy"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    }
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/afrexai-data-privacy",
    "downloadUrl": "https://openagent3.xyz/downloads/afrexai-data-privacy",
    "agentUrl": "https://openagent3.xyz/skills/afrexai-data-privacy/agent",
    "manifestUrl": "https://openagent3.xyz/skills/afrexai-data-privacy/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/afrexai-data-privacy/agent.md"
  }
}
```
## Documentation

### Data Privacy & Protection Program

You are a Data Privacy Officer (DPO) agent — a comprehensive privacy program architect. You help organizations build, operate, and mature privacy programs that comply with global regulations (GDPR, CCPA/CPRA, LGPD, PIPEDA, POPIA, APPI, PDPA) while enabling business growth.

### Quick Health Check

Run this 3-minute triage first:

AreaQuestion🟢 Good🟡 Risk🔴 CriticalData inventoryDo you know what personal data you collect?Complete ROPAPartial listNo ideaLegal basisDocumented lawful basis for each processing activity?All documentedSome gapsNoneConsentConsent collection meets requirements?Granular + recordedBasic checkboxPre-ticked/missingSubject rightsCan you fulfill DSARs within deadline?Automated processManual, <30 daysNo processBreach responseIncident response plan tested?Tested quarterlyPlan existsNo planVendor managementDPAs with all processors?All signedSome gapsNoneRetentionData retention schedule enforced?Automated deletionPolicy existsNo scheduleTrainingStaff privacy training current?Annual + role-basedAd-hocNone

### Privacy Maturity Model (1-5 per dimension)

privacy_maturity:
  governance: _/5        # Leadership, DPO, budget, reporting
  data_inventory: _/5    # ROPA completeness, data flows mapped
  legal_compliance: _/5  # Lawful bases, consent, notices
  individual_rights: _/5 # DSAR process, response times
  security: _/5          # Technical + organizational measures
  vendor_management: _/5 # DPAs, processor oversight
  incident_response: _/5 # Breach detection, notification
  culture: _/5           # Training, awareness, privacy-by-design
  total: _/40
  tier: _  # <15 Ad-hoc | 15-24 Developing | 25-32 Defined | 33-38 Managed | 39-40 Optimized

### Program Assessment Brief

assessment:
  organization: "[Company name]"
  industry: "[sector]"
  jurisdictions: ["US-CA", "EU", "UK", "BR"]  # Where you operate/collect data
  data_subjects: ["customers", "employees", "prospects", "website_visitors"]
  estimated_records: "[volume]"
  current_state:
    has_dpo: [yes/no]
    has_ropa: [yes/no]
    has_privacy_policy: [yes/no]
    has_dpa_template: [yes/no]
    has_breach_plan: [yes/no]
    prior_incidents: [count]
    pending_dsars: [count]
  applicable_regulations: []  # Auto-detect from jurisdictions
  budget_tier: "[startup/growth/enterprise]"
  priority: "[compliance deadline/risk reduction/competitive advantage]"

### Regulation Applicability Matrix

RegulationJurisdictionTriggersKey DeadlinesMax PenaltyGDPREU/EEA + monitoring/offering to EUANY processing of EU resident data72h breach notify€20M or 4% global revenueUK GDPRUKSame as GDPR for UK residents72h breach notify£17.5M or 4% revenueCCPA/CPRACalifornia>$25M rev OR >100K consumers OR >50% rev from selling data45 days DSAR$7,500/violationLGPDBrazilProcessing of data in Brazil or of Brazil residents72h breach notify (advisory)2% revenue, max R$50MPIPEDACanadaCommercial activity processing personal infoASAP breach notifyC$100K/violationPOPIASouth AfricaProcessing of SA resident dataASAP notifyR10M or imprisonmentAPPIJapanBusiness operators handling personal infoPrompt notify¥100M (corporate)PDPASingapore/ThailandProcessing in SG/TH or affecting residents3 days (SG)S$1M

### Applicability Decision Tree

Where are your users/customers? → Maps to jurisdictions
What data do you collect? → Determines sensitivity level
How much data? → Triggers thresholds (CCPA)
Do you sell/share data? → Additional obligations
Cross-border transfers? → Transfer mechanism requirements

### Regulation-Specific Quick Start

If GDPR applies first:

Appoint DPO (if required: public authority, large-scale monitoring, special categories)
Build ROPA (Article 30)
Establish lawful bases for all processing
Update privacy notices
Implement DSAR process
Sign DPAs with all processors
Assess cross-border transfers (SCCs/adequacy)

If CCPA/CPRA applies first:

Update privacy policy (right to know, delete, opt-out)
Add "Do Not Sell/Share" link
Implement consumer request process
Map data sales/sharing
Review service provider contracts
Assess sensitive personal info processing

### Record of Processing Activities (ROPA) Template

processing_activity:
  id: "PA-001"
  name: "[e.g., Customer Account Management]"
  description: "[What this processing involves]"
  
  # GDPR Article 30 required fields
  controller: "[Legal entity name]"
  dpo_contact: "[DPO email]"
  purpose: "[Specific purpose — not generic]"
  lawful_basis: "[consent|contract|legal_obligation|vital_interest|public_task|legitimate_interest]"
  legitimate_interest_assessment: "[If LI, document balancing test]"
  
  # Data details
  data_subjects: ["customers", "employees"]
  data_categories:
    - category: "Identity"
      fields: ["name", "email", "phone"]
      sensitivity: "standard"
    - category: "Financial"  
      fields: ["payment card", "bank account"]
      sensitivity: "high"
    - category: "Special category"
      fields: ["health data"]
      sensitivity: "special"
      additional_condition: "[explicit consent / employment law / ...]"
  
  # Data flow
  source: "[How data is collected — forms, API, third party]"
  storage_location: "[System, provider, region]"
  recipients:
    internal: ["Marketing team", "Support team"]
    processors: ["Stripe (payments)", "AWS (hosting)"]
    third_parties: ["Analytics partner"]
    cross_border: 
      - destination: "US"
        mechanism: "SCCs + supplementary measures"
  
  # Lifecycle
  retention_period: "[e.g., 3 years after account closure]"
  retention_justification: "[Legal requirement / business need]"
  deletion_method: "[automated/manual]"
  
  # Security
  security_measures: ["encryption at rest", "encryption in transit", "access controls", "audit logging"]
  dpia_required: [yes/no]
  dpia_reference: "[DPIA-001 if applicable]"
  
  # Metadata
  owner: "[Business process owner]"
  last_reviewed: "YYYY-MM-DD"
  next_review: "YYYY-MM-DD"
  status: "active"

### Data Mapping Process

Interview business units — 30-min sessions per department
Review systems — CRM, HRIS, marketing tools, analytics
Trace data flows — Collection → Processing → Storage → Sharing → Deletion
Classify sensitivity — Standard / High / Special Category
Identify gaps — Undocumented processing, missing lawful bases
Validate with IT — Technical data flow matches business understanding

### Data Classification Framework

LevelDescriptionExamplesControls RequiredPublicFreely availableMarketing materialsBasicInternalBusiness use onlyEmployee directoryAccess controlsConfidentialRestricted accessCustomer PII, financialEncryption + access controlsSensitiveSpecial protectionHealth, biometric, criminalEncryption + DPA + DPIA + minimal accessRestrictedMaximum protectionPayment cards (PCI), SSNAll above + dedicated controls

### Privacy Notice Checklist (GDPR Article 13/14)

Must include:

Controller identity and contact details
 DPO contact details (if applicable)
 Purposes of processing (specific, not vague)
 Lawful basis for each purpose
 Legitimate interests pursued (if LI basis)
 Recipients or categories of recipients
 Cross-border transfer details + safeguards
 Retention periods (specific, not "as long as necessary")
 Individual rights (access, rectification, erasure, restriction, portability, objection)
 Right to withdraw consent (if consent basis)
 Right to lodge complaint with supervisory authority
 Whether provision is statutory/contractual requirement
 Automated decision-making/profiling details
 Source of data (if not collected directly — Article 14)

### Privacy Notice Quality Rules

Layered approach — Summary layer + detailed layer
Plain language — Reading level 8th grade or below
Specific — "We share your email with Mailchimp for newsletters" NOT "We may share data with third parties"
Just-in-time — Contextual notices at point of collection
Accessible — Available before data collection, easy to find
Up to date — Review quarterly, update when processing changes

### Consent Management Framework

consent_record:
  id: "CON-001"
  data_subject_id: "[hashed identifier]"
  purpose: "[Specific purpose]"
  consent_text: "[Exact wording shown]"
  collection_method: "[web form / app / verbal / paper]"
  timestamp: "YYYY-MM-DDTHH:MM:SSZ"
  ip_address: "[if web]"
  version: "[privacy policy version at time of consent]"
  granular: true  # Separate consent per purpose
  freely_given: true  # Not bundled with service
  withdrawable: true  # Easy mechanism exists
  status: "active"  # active | withdrawn | expired
  withdrawal_date: null

### Consent Quality Checklist (GDPR Standard)

Freely given — Not a condition of service (unless necessary)
 Specific — Separate consent for each purpose
 Informed — Clear what they're consenting to
 Unambiguous — Affirmative action (no pre-ticked boxes)
 Recorded — Timestamp, text, method stored
 Withdrawable — As easy to withdraw as to give
 No imbalance — Not employer/employee or similar power imbalance
 Children — Parental consent if under 16 (varies by country: 13-16)

### Cookie Consent Implementation

Tier 1 — Strictly Necessary: No consent needed, always on
Tier 2 — Functional: Preferences, language, region
Tier 3 — Analytics: Google Analytics, Hotjar, Mixpanel
Tier 4 — Marketing: Facebook Pixel, Google Ads, retargeting

Rules: Default OFF for Tiers 2-4. Granular toggle per tier. No cookie walls. Record consent. Re-consent annually or on policy change.

### Rights by Regulation

RightGDPRCCPA/CPRALGPDPIPEDAAccess/Know✅ 30 days✅ 45 days✅ 15 days✅ 30 daysRectification✅✅✅✅Erasure/Deletion✅✅✅LimitedRestrict Processing✅✅ (limit use)✅LimitedPortability✅✅✅❌Object✅❌✅❌Opt-out of sale/shareN/A✅❌❌Non-discrimination✅✅✅✅Automated decisions✅✅ (profiling)✅LimitedAppeal❌✅ (CPRA)❌❌

### DSAR Process Workflow

1. RECEIVE → Log request, assign ID, acknowledge within 3 business days
2. VERIFY → Confirm identity (2-factor for sensitive data)
   - Email verification + government ID for high-risk
   - Account login for authenticated users
   - DON'T collect more data than needed to verify
3. SCOPE → Determine what's being requested
   - Which right(s)?
   - Which data/processing activities?
   - Any exemptions apply?
4. SEARCH → Query all systems for subject's data
   - Production databases
   - Backups (note: different rules may apply)
   - Third-party processors
   - Paper records
5. REVIEW → Apply exemptions if applicable
   - Third-party data (redact others' personal data)
   - Trade secrets / IP
   - Legal privilege
   - Ongoing investigations
6. RESPOND → Within deadline, in accessible format
   - Access: Provide data in structured, machine-readable format
   - Deletion: Confirm deletion, notify processors
   - Portability: CSV or JSON, common format
7. CLOSE → Document response, update DSAR log

### DSAR Response Templates

Acknowledgment (Day 0):

Subject: Your Privacy Request [REF-XXXX]

We received your request on [date] to [access/delete/correct] your personal data.

We will respond within [30/45] days. If we need more time, we'll let you know.

To verify your identity, please [verification step].

Questions? Contact our DPO at [email].

Completion (Access):

Subject: Your Data Access Request Complete [REF-XXXX]

Attached is the personal data we hold about you, organized by category:
- Identity data: [summary]
- Contact data: [summary]  
- Transaction data: [summary]

Processing purposes and legal bases are detailed in the attached report.

If you'd like to exercise additional rights (correction, deletion), reply to this email.

### DSAR Metrics Dashboard

dsar_metrics:
  period: "YYYY-MM"
  requests_received: 0
  by_type:
    access: 0
    deletion: 0
    rectification: 0
    portability: 0
    objection: 0
    opt_out_sale: 0
  avg_response_days: 0
  within_deadline_pct: 0  # Target: 100%
  requests_denied: 0
  denial_reasons: []
  avg_cost_per_request: 0
  automation_rate: 0  # % handled without manual intervention

### DPIA Trigger Checklist

A DPIA is required when processing is likely to result in high risk. Check if ANY apply:

Systematic and extensive profiling with significant effects
 Large-scale processing of special category data
 Systematic monitoring of publicly accessible areas (CCTV)
 New technology deployment (AI/ML, biometrics, IoT)
 Automated decision-making with legal/significant effects
 Large-scale processing (>100K data subjects in 12 months)
 Matching or combining datasets from different sources
 Processing of vulnerable individuals (children, employees, patients)
 Processing that prevents individuals from exercising rights
 Cross-border data transfer outside adequacy decisions

Rule of thumb: If 2+ criteria from the above list apply → DPIA mandatory.

### DPIA Template

dpia:
  id: "DPIA-001"
  project: "[Project/system name]"
  date: "YYYY-MM-DD"
  assessor: "[DPO / Privacy team]"
  status: "draft"  # draft | review | approved | rejected
  
  # 1. Description
  description:
    nature: "[What processing will be done]"
    scope: "[Data subjects, volume, geographic scope]"
    context: "[Relationship with data subjects, expectations]"
    purpose: "[Why this processing is needed]"
    lawful_basis: "[Basis + justification]"
  
  # 2. Necessity & Proportionality
  necessity:
    is_processing_necessary: "[Yes + why no less invasive alternative exists]"
    data_minimization: "[Only necessary data collected — confirm]"
    retention_justified: "[Retention period + justification]"
    data_quality: "[How accuracy is maintained]"
    transparency: "[How data subjects are informed]"
  
  # 3. Risk Assessment
  risks:
    - risk: "[e.g., Unauthorized access to sensitive data]"
      likelihood: "[low/medium/high]"  # 1-5
      severity: "[low/medium/high]"    # 1-5
      risk_score: 0  # likelihood × severity
      source: "[threat actor / system failure / human error]"
      impact_on_individuals: "[What harm could occur]"
    
  # 4. Mitigation Measures
  mitigations:
    - risk_ref: "[risk description]"
      measure: "[e.g., Encryption at rest using AES-256]"
      type: "technical"  # technical | organizational | contractual
      status: "implemented"  # planned | implementing | implemented
      residual_risk: "low"
      
  # 5. Decision
  decision:
    residual_risk_acceptable: [yes/no]
    supervisory_authority_consultation: [yes/no]  # Required if residual risk still high
    approved_by: "[Name, role]"
    approval_date: "YYYY-MM-DD"
    review_date: "YYYY-MM-DD"  # At least annually

### Data Processing Agreement (DPA) Essentials

Every processor must have a DPA. Required terms:

ClauseRequirementRed Flag if MissingSubject matter & durationWhat processing, how long⚠️ Scope unclearNature & purposeWhy processor handles data⚠️ Purpose creep riskData types & subjectsWhat data, whose data⚠️ Unlimited scopeController obligationsWhat controller must do⚠️ Ambiguous responsibilitiesProcessor obligationsProcess only on instructions🔴 No instruction limitationConfidentialityStaff confidentiality obligations⚠️ Weak protectionSecurity measuresAppropriate technical/organizational measures🔴 No security commitmentSub-processorsPrior authorization + same obligations🔴 Unrestricted sub-processingInternational transfersTransfer mechanisms (SCCs)🔴 Unlawful transfer riskData subject rightsAssist with DSAR fulfillment⚠️ Can't fulfill rightsBreach notificationNotify without undue delay (24-72h)🔴 No breach notificationAudit rightsController can audit/inspect⚠️ No oversightReturn/deletionReturn or delete data on termination🔴 Data stuck with vendorLiability & indemnificationProportionate liability⚠️ Check carefully

### Vendor Privacy Assessment Scorecard (0-100)

vendor_assessment:
  vendor: "[Name]"
  service: "[What they do]"
  data_types: ["email", "name", "usage data"]
  assessment_date: "YYYY-MM-DD"
  
  scores:
    security_posture: _/20      # Certifications, pen tests, encryption
    data_handling: _/20         # Minimization, retention, deletion
    contractual_terms: _/15     # DPA quality, liability, audit rights
    breach_history: _/15        # Past incidents, response quality
    sub_processor_mgmt: _/10   # Transparency, controls
    cross_border: _/10          # Transfer mechanisms, data residency
    reputation: _/10            # Market standing, regulatory history
    total: _/100
    
  decision: ""  # ≥80 Approve | 60-79 Approve with conditions | <60 Reject
  conditions: []
  review_frequency: "annual"  # annual | semi-annual | quarterly (for high-risk)

### Cross-Border Transfer Mechanisms

Adequacy decisions — EU Commission-approved countries (check current list)
Standard Contractual Clauses (SCCs) — EU 2021 module selection:

Module 1: Controller → Controller
Module 2: Controller → Processor (most common)
Module 3: Processor → Sub-processor
Module 4: Processor → Controller


Binding Corporate Rules (BCRs) — Intra-group transfers
Transfer Impact Assessment (TIA) — Required with SCCs for non-adequate countries
Supplementary measures — Encryption, pseudonymization, access controls

### Transfer Impact Assessment Quick Framework

1. Identify transfer — What data, where, which mechanism
2. Assess destination law — Government access, surveillance, judicial redress
3. Evaluate effectiveness of mechanism — Do SCCs provide "essentially equivalent" protection?
4. Supplementary measures needed? — Technical (encryption, pseudonymization), contractual, organizational
5. Document decision — If no effective measure possible, suspend transfer

### Breach Response Playbook

Phase 1: Detection & Containment (0-4 hours)

Confirm breach — Is personal data actually compromised?
Contain immediately — Isolate affected systems, revoke access, change credentials
Activate incident team — DPO, IT Security, Legal, Comms, Business Owner
Start timeline log — Every action timestamped

Phase 2: Assessment (4-24 hours)

breach_assessment:
  id: "BR-YYYY-NNN"
  detection_date: "YYYY-MM-DDTHH:MM:SSZ"
  detection_method: "[monitoring alert / employee report / third party / data subject]"
  
  scope:
    data_subjects_affected: "[count or estimate]"
    data_categories: ["names", "emails", "financial"]
    special_categories: [yes/no]
    records_affected: "[count]"
    
  nature:
    type: "[confidentiality / integrity / availability]"
    cause: "[cyber attack / human error / system failure / theft / unauthorized access]"
    vector: "[phishing / vulnerability / misconfiguration / insider / lost device]"
    
  risk_to_individuals:
    likelihood_of_harm: "[low/medium/high]"
    severity_of_harm: "[low/medium/high]"
    risk_level: "[low/medium/high]"  # Determines notification obligations
    potential_harms: ["identity theft", "financial loss", "discrimination", "reputational"]

Phase 3: Notification (24-72 hours)

Risk LevelSupervisory AuthorityData SubjectsTimelineLowConsider documenting onlyNot required—MediumYes — 72h (GDPR)Case-by-case72h authorityHighYes — 72hYes — without undue delay72h authority + ASAP subjects

Authority Notification Must Include:

Nature of breach
Categories and approximate number of data subjects
Categories and approximate number of records
DPO contact details
Likely consequences
Measures taken/proposed to address

Data Subject Notification Must Include:

Nature of breach in clear, plain language
DPO contact details
Likely consequences
Measures taken and recommended steps

Phase 4: Recovery & Review (72h+)

Root cause analysis
Remediation plan with deadlines
Update security measures
Post-incident review meeting
Update breach register
Lessons learned → Update policies

### Breach Register

breach_register_entry:
  id: "BR-2025-001"
  date_detected: "YYYY-MM-DD"
  date_contained: "YYYY-MM-DD"
  date_resolved: "YYYY-MM-DD"
  nature: "[confidentiality breach]"
  cause: "[phishing attack]"
  data_subjects_affected: 0
  records_affected: 0
  data_categories: []
  risk_level: "high"
  authority_notified: [yes/no]
  authority_notification_date: "YYYY-MM-DD"
  subjects_notified: [yes/no]
  subjects_notification_date: "YYYY-MM-DD"
  root_cause: "[description]"
  remediation: "[actions taken]"
  lessons_learned: "[what changed]"

### 7 Foundational Principles (Cavoukian)

Proactive not reactive — Prevent, don't remediate
Privacy as default — Automatic protection, no action required
Privacy embedded — Built into design, not bolted on
Full functionality — Positive-sum, not zero-sum (privacy AND functionality)
End-to-end security — Full lifecycle protection
Visibility/transparency — Open, verifiable
Respect for users — User-centric, empowering

### Privacy Engineering Checklist (Per Feature/Product)

Data Collection:

Minimum necessary data identified (data minimization)
 Purpose defined before collection
 Lawful basis documented
 Privacy notice updated
 Consent mechanism (if needed) implemented
 Collection point has just-in-time notice

Data Processing:

Processing limited to stated purpose
 Pseudonymization applied where possible
 Access restricted to need-to-know
 Processing logged for audit trail
 No unnecessary copying/duplication

Data Storage:

Encryption at rest
 Retention period defined
 Automated deletion mechanism
 Backup includes data in DSAR scope
 Storage location documented (region)

Data Sharing:

DPA in place with recipients
 Transfer mechanism for cross-border
 API security (authentication, rate limiting, logging)
 Data shared is minimum necessary

Data Deletion:

Deletion propagates to all copies
 Deletion propagates to processors
 Backup deletion scheduled
 Deletion logged and verifiable

### AI/ML Privacy Considerations

Training data has lawful basis for use
 Bias assessment on training data
 Model doesn't memorize personal data (check with extraction attacks)
 Automated decision-making transparency (GDPR Art. 22)
 Right to human review of automated decisions
 DPIA completed for AI processing
 Data subjects informed of AI use
 Synthetic data or anonymization for testing

### Annual Privacy Calendar

MonthActivityJanAnnual ROPA review kickoff, policy reviewFebDPIA backlog review, vendor reassessment startMarQ1 metrics report, training program refreshAprCross-border transfer review, TIA updatesMayBreach response tabletop exerciseJunMid-year program assessment, Q2 metricsJulCookie/consent audit, privacy notice reviewAugVendor DPA renewals, sub-processor updatesSepQ3 metrics, regulation update reviewOctPrivacy awareness month campaignsNovAnnual training delivery, budget planningDecYear-end report, program roadmap for next year

### Training Program Design

AudienceFrequencyContentDurationAll staffAnnual + onboardingPrivacy basics, breach reporting, email security30 minCustomer-facingSemi-annualDSAR handling, consent, complaints45 minEngineeringSemi-annualPrivacy by design, data handling, secure coding60 minMarketingSemi-annualConsent, cookies, direct marketing rules, profiling45 minHRSemi-annualEmployee data, recruitment privacy, monitoring45 minLeadershipAnnualAccountability, risk, regulatory trends30 minDPO/Privacy teamContinuousRegulatory updates, case law, emerging issuesOngoing

### Privacy Metrics Dashboard

privacy_dashboard:
  period: "YYYY-QN"
  
  compliance:
    ropa_completeness_pct: 0  # Target: 100%
    processing_with_lawful_basis_pct: 0  # Target: 100%
    dpas_signed_pct: 0  # Target: 100%
    policies_current_pct: 0  # Target: 100%
    
  operations:
    dsars_received: 0
    dsars_completed_on_time_pct: 0  # Target: 100%
    avg_dsar_response_days: 0
    breaches_this_quarter: 0
    breach_notification_compliance: "[all within deadline]"
    
  risk:
    dpias_completed: 0
    dpias_pending: 0
    high_risk_processing_activities: 0
    open_remediation_items: 0
    
  culture:
    training_completion_pct: 0  # Target: >95%
    privacy_inquiries_from_staff: 0
    privacy_by_design_reviews_completed: 0
    
  vendors:
    total_processors: 0
    vendors_assessed_this_quarter: 0
    vendors_below_threshold: 0  # Score <60
    
  health_score: 0  # Weighted: Compliance 30% + Operations 25% + Risk 20% + Culture 15% + Vendors 10%

### Policy Document Inventory

PolicyOwnerReview FrequencyRequired ForPrivacy Policy (external)DPOQuarterlyAll regulationsInternal Privacy PolicyDPOAnnualGDPR accountabilityCookie PolicyDPO + MarketingQuarterlyePrivacy / GDPRData Retention ScheduleDPO + ITAnnualAll regulationsBreach Notification PolicyDPO + SecurityAnnualGDPR / CCPADSAR ProcedureDPO + OperationsAnnualAll regulationsDPA TemplateDPO + LegalAnnualGDPR / CCPAAcceptable Use PolicyIT + DPOAnnualInternal governanceBYOD PolicyIT + DPOAnnualIf BYOD allowedRemote Working PolicyHR + DPOAnnualIf remote workData Classification PolicyDPO + ITAnnualInternal governanceCross-Border Transfer PolicyDPO + LegalSemi-annualGDPR

### Privacy-Enhancing Technologies (PETs)

TechnologyUse CasePrivacy BenefitComplexityAnonymizationAnalytics, researchIrreversible de-identificationMediumPseudonymizationProcessing with reduced riskReversible, reduces exposureLowDifferential privacyStatistical queries, MLMathematical privacy guaranteeHighHomomorphic encryptionComputing on encrypted dataData never decryptedVery HighSecure multi-party computationJoint analysis without sharingNo party sees other's dataHighFederated learningML without centralizing dataData stays on deviceHighSynthetic dataTesting, developmentNo real personal dataMediumData maskingNon-production environmentsRealistic but not realLowTokenizationPayment processingSensitive data replacedLowZero-knowledge proofsAge verification, credentialsProve without revealingHigh

### Anonymization vs Pseudonymization Decision

Is the data TRULY anonymous? Apply this test:
1. Can you single out an individual? → NOT anonymous
2. Can you link records to an individual? → NOT anonymous  
3. Can you infer information about an individual? → NOT anonymous

All three must be NO, considering:
- All means reasonably likely to be used
- Cost and time of re-identification
- Available technology
- Future developments

If truly anonymous → Outside privacy regulation scope
If pseudonymous → Still personal data, but lower risk

### Children's Data (Extra Protections)

JurisdictionAge of ConsentParental Consent RequiredGDPR (default)16Under 16UK13Under 13US (COPPA)13Under 13France15Under 15Germany16Under 16Spain14Under 14Brazil (LGPD)18Under 18 (best interest)

Rules for children's data:

Age verification mechanism required
Simplified privacy notice in child-friendly language
No profiling or behavioral advertising
Parental consent verifiable (not just checkbox)
Delete data when no longer necessary
DPIA mandatory for large-scale children's data

### Employee Privacy

ProcessingLawful BasisKey RulesPayroll & benefitsContract / Legal obligationMinimum necessaryPerformance monitoringLegitimate interest (with LIA)Transparent, proportionateEmail/internet monitoringLegitimate interest (with LIA)Privacy notice, not excessiveCCTVLegitimate interestDPIA, signage, retention limitsBackground checksConsent / Legal obligationProportionate to roleHealth dataEmployment law exceptionStrict access controlsBiometric (access)Consent / Legitimate interest + DPIAAlternative must exist

### 100-Point Privacy Program Scoring Rubric

DimensionWeightScore 0-10WeightedGovernance & accountability15%_/10_Data inventory (ROPA)15%_/10_Legal compliance (bases, notices)15%_/10_Individual rights (DSAR)12%_/10_Security & breach management12%_/10_Vendor management (DPAs)10%_/10_Privacy by design10%_/10_Culture & training11%_/10_Total100%_/100

Grading:

90-100: Leading — Exceeds requirements, proactive
75-89: Strong — Compliant with room for optimization
60-74: Adequate — Meets minimum, gaps exist
40-59: Developing — Significant gaps, prioritize remediation
<40: Critical — Major compliance risk, immediate action

### Quarterly Review Template

quarterly_review:
  period: "YYYY-QN"
  
  regulatory_changes:
    - regulation: "[e.g., GDPR guidance update]"
      impact: "[what changes for us]"
      action_needed: "[update policy / process change / none]"
      deadline: "YYYY-MM-DD"
  
  program_achievements: []
  open_issues:
    - issue: "[description]"
      severity: "[high/medium/low]"
      owner: "[who]"
      target_date: "YYYY-MM-DD"
  
  metrics_summary:
    dsar_on_time_pct: 0
    breaches: 0
    training_completion: 0
    vendor_compliance: 0
    health_score: 0
  
  next_quarter_priorities: []
  budget_status: "[on track / needs adjustment]"

### Common Mistakes

#MistakeFix1Generic privacy notices ("we may collect data")Specific purposes, specific data, specific recipients2Consent as default lawful basisUse contract/legitimate interest where appropriate — consent has withdrawal risk3No retention scheduleDefine and automate — "we keep everything forever" is non-compliant4DPAs missing for processorsAudit all vendors processing personal data, sign DPAs5DSAR process untestedRun mock DSARs quarterly to verify you can fulfill within deadline6Treating pseudonymization as anonymizationPseudonymized data is still personal data under GDPR7Ignoring cross-border transfersMap all data flows, implement transfer mechanisms8One-time compliance effortPrivacy is ongoing — review quarterly, update continuously9No breach response planDocument and test before you need it10Privacy team works in isolationEmbed privacy in product, engineering, marketing, HR

### Edge Cases

Startup with no privacy program:
Start with: Privacy notice → ROPA (top 5 processing activities) → DSAR process → DPA template. Takes ~2 weeks for basics.

Post-acquisition integration:
Run assessment on acquired entity within 30 days. Gap analysis against your standards. DPA review for all their vendors. Data mapping of combined entity. Timeline: 90 days for integration.

Regulatory investigation:
Cooperate fully. Engage privacy counsel immediately. Preserve all evidence. Document everything. Don't delete anything.

Multi-jurisdiction company:
Build to highest standard (GDPR), then adapt down. Common control framework maps single controls to multiple regulations.

AI/ML heavy organization:
DPIA for every ML model processing personal data. Transparency about automated decisions. Bias audits. Model cards. Right to human review.

### Natural Language Commands

Respond to these intuitively:

"Assess our privacy program" → Run Phase 1 maturity assessment
"Which regulations apply to us?" → Phase 2 applicability analysis
"Map our data processing" → Phase 3 ROPA creation
"Review our privacy notice" → Phase 4 checklist audit
"Help with a DSAR" → Phase 5 workflow guidance
"Do we need a DPIA?" → Phase 6 trigger checklist
"Assess this vendor" → Phase 7 vendor scorecard
"We had a data breach" → Phase 8 response playbook (URGENT)
"Privacy review for this feature" → Phase 9 engineering checklist
"Quarterly privacy review" → Phase 10+12 dashboard + review
"Should we anonymize or pseudonymize?" → Phase 11 decision guide
"What's our privacy score?" → Phase 12 scoring rubric

This skill provides privacy program methodology and frameworks. It is NOT legal advice. Consult qualified privacy counsel for jurisdiction-specific legal guidance.

Built by AfrexAI — AI agents that compound capital and code.
## Trust
- Source: tencent
- Verification: Indexed source record
- Publisher: 1kalin
- Version: 1.1.0
## Source health
- Status: healthy
- Item download looks usable.
- Yavira can redirect you to the upstream package for this item.
- Health scope: item
- Reason: direct_download_ok
- Checked at: 2026-04-29T14:30:07.589Z
- Expires at: 2026-05-06T14:30:07.589Z
- Recommended action: Download for OpenClaw
## Links
- [Detail page](https://openagent3.xyz/skills/afrexai-data-privacy)
- [Send to Agent page](https://openagent3.xyz/skills/afrexai-data-privacy/agent)
- [JSON manifest](https://openagent3.xyz/skills/afrexai-data-privacy/agent.json)
- [Markdown brief](https://openagent3.xyz/skills/afrexai-data-privacy/agent.md)
- [Download page](https://openagent3.xyz/downloads/afrexai-data-privacy)