Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

GDPR Compliance Automator Skill · a5c-ai | DecimalAI

a5c-ai/gdpr-compliance-automator

SkillScore77Maintained

GDPR compliance assessment and automation for data mapping, consent management, DSAR handling, and privacy impact assessments

legalby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Legal & Contracts pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-gdpr-compliance-automator/SKILL.md

decimalai skills pull a5c-ai-gdpr-compliance-automator --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-gdpr-compliance-automator/SKILL.md https://app.decimal.ai/s/a5c-ai-gdpr-compliance-automator/SKILL.md

Raw file: /s/a5c-ai-gdpr-compliance-automator/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-gdpr-compliance-automator.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 25d ago

Yes — +41% lift · at higher cost+45% tokens0% turns77% of whole cases pass with skill (17/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	28%	0%
case-07	✗→✓	▲ Improved	-29%	0%
case-08	✗→✓	▲ Improved	35%	0%
case-09	✗→✓	▲ Improved	86%	0%
case-10	✗→✓	▲ Improved	0%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/security-compliance/skills/gdpr-compliance-automator/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

GDPR Compliance Automator Skill

Purpose

Automate General Data Protection Regulation (GDPR) compliance activities including data mapping, consent management, Data Subject Access Request (DSAR) handling, privacy impact assessments, and breach notification procedures.

Capabilities

Data Mapping and Inventory

Discover and catalog personal data across systems
Map data flows between systems and third parties
Identify data controllers and processors
Document lawful basis for processing
Track data retention periods
Generate Records of Processing Activities (RoPA)

Consent Management

Track consent collection and withdrawal
Manage granular consent preferences
Document consent mechanisms
Monitor consent validity and expiration
Generate consent audit trails

Data Subject Access Requests (DSAR)

Intake and track DSAR requests
Automate data discovery for subjects
Generate subject access reports
Manage request timelines (30-day deadline)
Handle erasure requests (Right to be Forgotten)
Process data portability requests

Privacy Impact Assessments (PIA/DPIA)

Generate DPIA templates for high-risk processing
Assess necessity and proportionality
Identify and mitigate privacy risks
Document supervisory authority consultation
Track DPIA approvals and reviews

Breach Notification

Document data breach incidents
Assess breach severity and notification requirements
Generate supervisory authority notifications (72-hour)
Prepare data subject notifications
Track breach response and remediation

Cross-Border Transfer Compliance

Document international data transfers
Track transfer mechanisms (SCCs, BCRs, adequacy)
Assess transfer impact assessments
Monitor regulatory changes

GDPR Articles Coverage

Article 5: Principles of processing
Article 6: Lawful basis for processing
Article 7: Conditions for consent
Article 12-22: Data subject rights
Article 25: Data protection by design
Article 30: Records of processing activities
Article 32: Security of processing
Article 33-34: Breach notification
Article 35: Data protection impact assessment
Article 44-49: International transfers

Integrations

OneTrust: Privacy management platform
TrustArc: Privacy compliance automation
BigID: Data discovery and privacy
Collibra: Data governance platform
Custom GDPR tools: Organization-specific solutions

Target Processes

GDPR Compliance Assessment
Privacy Impact Assessments
Data Subject Request Handling
Breach Response Process
Privacy by Design Implementation

Input Schema

json
{
  "type": "object",
  "properties": {
    "assessmentType": {
      "type": "string",
      "enum": ["full", "gap", "dpia", "dsar", "breach"],
      "description": "Type of GDPR assessment"
    },
    "scope": {
      "type": "object",
      "properties": {
        "systems": { "type": "array", "items": { "type": "string" } },
        "dataCategories": { "type": "array", "items": { "type": "string" } },
        "processingActivities": { "type": "array", "items": { "type": "string" } }
      }
    },
    "dsarRequest": {
      "type": "object",
      "properties": {
        "requestType": { "type": "string", "enum": ["access", "erasure", "rectification", "portability", "restriction", "objection"] },
        "subjectIdentifier": { "type": "string" },
        "requestDate": { "type": "string", "format": "date" }
      }
    },
    "breachDetails": {
      "type": "object",
      "properties": {
        "discoveryDate": { "type": "string", "format": "date-time" },
        "description": { "type": "string" },
        "affectedSubjects": { "type": "integer" },
        "dataCategories": { "type": "array" }
      }
    },
    "existingRopa": {
      "type": "string",
      "description": "Path to existing Records of Processing Activities"
    }
  },
  "required": ["assessmentType"]
}

Output Schema

json
{
  "type": "object",
  "properties": {
    "assessmentId": {
      "type": "string"
    },
    "assessmentType": {
      "type": "string"
    },
    "assessmentDate": {
      "type": "string",
      "format": "date-time"
    },
    "dataInventory": {
      "type": "object",
      "properties": {
        "personalDataCategories": { "type": "array" },
        "specialCategories": { "type": "array" },
        "processingActivities": { "type": "array" },
        "thirdParties": { "type": "array" }
      }
    },
    "complianceStatus": {
      "type": "object",
      "properties": {
        "articlesAssessed": { "type": "integer" },
        "compliant": { "type": "integer" },
        "partiallyCompliant": { "type": "integer" },
        "nonCompliant": { "type": "integer" }
      }
    },
    "gapAnalysis": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "article": { "type": "string" },
          "requirement": { "type": "string" },
          "currentState": { "type": "string" },
          "gap": { "type": "string" },
          "remediation": { "type": "string" },
          "priority": { "type": "string" }
        }
      }
    },
    "dsarResponse": {
      "type": "object"
    },
    "breachAssessment": {
      "type": "object"
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    }
  }
}

Usage Example

javascript
skill: {
  name: 'gdpr-compliance-automator',
  context: {
    assessmentType: 'full',
    scope: {
      systems: ['CRM', 'Marketing Platform', 'HR System'],
      dataCategories: ['customer', 'employee', 'prospect']
    }
  }
}

Illustrative Want to see what a5c-ai/gdpr-compliance-automator would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 09:53 UTC · 22 cases

Lift

+41%

77% vs 36%

Agent turns

0%

1.0 vs 1.0

Tokens

+45%

4,783.95 vs 3,301.73

fail → pass · 9pass → pass · 8fail → fail · 5

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We recently discovered an unauthenticated database exposed to the web containing user email addresses and account hashes affecting approximately 12,000 user records. I need an automated assessment for this incident. Please process these incident details along with the discovery timestamp, and return a comprehensive compliance evaluation covering the breach assessment, affected data categories, regulatory notice obligations, and remediation action items.	fail→fail	23,782	23,959	+1%	1	1	0%	3,244	5,066	+56%	0	0	—
case-02 A client with identifier 'user-77491' submitted a formal request on 2025-04-12 asking for complete removal of all personal information held across our billing and customer service systems. Please handle this subject request and generate a complete DSAR response structure, data mapping breakdown, regulatory compliance status, and operational next steps.	fail→fail	23,909	22,963	-4%	1	1	0%	3,441	4,893	+42%	0	0	—
case-03 We are conducting a comprehensive privacy review for our CRM, HR portal, and cloud analytics platforms handling customer and employee records. Please run a full compliance evaluation that catalogues personal data categories and third parties, reports compliance status across evaluated articles, lists specific gaps with priority remediation paths, and provides actionable recommendations.	fail→pass	38,348	33,326	-13%	1	1	0%	5,539	7,067	+28%	0	0	—
case-04 A California resident submitted a 'Do Not Sell My Personal Information' opt-out request under the California Consumer Privacy Act (CCPA/CPRA). Provide the standard CCPA opt-out workflow and consumer notice response in JSON format.	fail→fail	13,841	16,132	+17%	1	1	0%	2,617	3,877	+48%	0	0	—
case-05 Draft a US HIPAA Business Associate Agreement (BAA) for a cloud healthcare vendor storing Protected Health Information (PHI) under 45 CFR Part 160 and 164.	fail→fail	27,001	30,773	+14%	1	1	0%	4,248	6,718	+58%	0	0	—
case-06 Prepare a SOC 2 Type II readiness audit mapping for AICPA Trust Services Criteria across Security, Availability, and Confidentiality.	fail→fail	24,277	41,593	+71%	1	1	0%	3,801	8,761	+130%	0	0	—
case-07 We are onboarding a new international HR payroll platform that processes employee financial details and national identifiers across European subsidiaries. While our IT team assumed a basic security check was sufficient, we need a complete GDPR review evaluating principles, legal bases, and security. Output a JSON payload containing the assessment results.	fail→pass	32,355	19,875	-39%	1	1	0%	5,958	4,244	-29%	0	0	—
case-08 Our product team wants to launch automated facial recognition for employee building access. They insist this does not require a formal Privacy Impact Assessment because employee consent was gathered in onboarding contracts. Perform a dedicated high-risk processing review and return JSON evaluation output.	fail→pass	23,416	20,107	-14%	1	1	0%	3,147	4,242	+35%	0	0	—
case-09 Our marketing database contains 500,000 email records collected over 8 years without documented consent mechanisms or lawful bases recorded. The marketing team wants to keep sending mass mailers while we slowly clean the data. Perform a targeted deficiency audit and present the results in structured JSON.	fail→pass	14,722	17,259	+17%	1	1	0%	2,501	4,660	+86%	0	0	—
case-10 A customer ('user-99120') submitted a request on 2025-05-01 requesting a structured machine-readable export of all their transaction history and preference settings to migrate to a competitor. Generate a complete JSON response for this request.	fail→pass	23,170	17,477	-25%	1	1	0%	4,169	4,182	+0%	0	0	—
case-11 An employee's unencrypted corporate laptop containing unhashed customer phone numbers and addresses was stolen from a vehicle yesterday at 14:00. The security team thinks we can wait two weeks until the police report is finalized before taking compliance action. Process this security incident and return JSON output.	fail→pass	17,459	16,750	-4%	1	1	0%	2,345	3,729	+59%	0	0	—
case-12 We need to document our customer support ticketing system's data flows, including customer contact details sent to offshore vendor tiers, retention schedules, and legal bases. Generate a complete GDPR data inventory evaluation in JSON format.	fail→pass	21,405	15,715	-27%	1	1	0%	4,030	4,428	+10%	0	0	—
case-13 We store EU customer analytics data on US-based cloud servers. The infrastructure team believes European data protection law does not apply because the cloud vendor's primary headquarters is in California. Perform a GDPR transfer risk review and return JSON output.	pass→pass	21,283	19,440	-9%	1	1	0%	3,070	4,160	+36%	0	0	—
case-14 A customer ('user-33412') disputed the accuracy of their account billing balance on 2025-06-10 and formally requested that we pause all automated processing and marketing contacts while the dispute is investigated. Process this request in JSON output.	fail→pass	12,254	10,272	-16%	1	1	0%	1,532	3,631	+137%	0	0	—
case-15 An active user clicked 'unsubscribe' and withdrew consent for direct marketing emails, but our sales team wants to continue sending 'relationship update' promotional messages. Conduct a compliance evaluation for this consent event and produce JSON output.	pass→pass	16,833	19,128	+14%	1	1	0%	2,072	4,079	+97%	0	0	—
case-16 A customer ('user-88123') updated their legal surname on 2025-03-15 and requested correction across all primary and backup customer databases. Process this subject request and produce a structured JSON output.	fail→pass	9,162	10,706	+17%	1	1	0%	1,844	3,540	+92%	0	0	—
case-17 Our mobile engineering team is building a location-aware mobile app that defaults to background GPS tracking and continuous contact list syncing for all users upon installation. Run a compliance gap assessment and generate structured JSON output.	pass→pass	29,604	19,782	-33%	1	1	0%	4,294	5,067	+18%	0	0	—
case-18 We are contracting a third-party AI transcription vendor to process recorded customer service calls. The vendor's draft agreement lacks sub-processor notification clauses and audit rights. Run a compliance risk assessment and return JSON output.	pass→pass	26,078	22,925	-12%	1	1	0%	3,689	4,844	+31%	0	0	—
case-19 A user ('user-10492') submitted an objection on 2025-07-01 against our automated credit scoring and behavioral profiling algorithms. Process this request and output JSON compliance output.	pass→pass	16,343	21,155	+29%	1	1	0%	2,241	4,820	+115%	0	0	—
case-20 Our HR department has been retaining full background checks, medical leave notes, and bank details of former employees who left the company over 12 years ago, exceeding our statutory 6-year retention schedule. Run a targeted gap evaluation in JSON format.	pass→pass	22,948	18,546	-19%	1	1	0%	3,141	3,960	+26%	0	0	—
case-21 We co-host a joint clinical research trial with a university medical center where both entities determine processing purposes for patient health data, but no agreement exists defining respective responsibilities. Conduct a compliance assessment and return JSON output.	pass→pass	21,500	24,897	+16%	1	1	0%	2,959	5,261	+78%	0	0	—
case-22 A customer ('user-44021') requested a copy of all personal data held about them across our web platform on 2025-08-01. Generate the complete subject access response evaluation in JSON format.	pass→pass	18,223	18,652	+2%	1	1	0%	2,756	4,018	+46%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +41 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 36.4%
Pass rate with the skill: 77.3%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 09:53 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Prompt

We are conducting a comprehensive privacy review for our CRM, HR portal, and cloud analytics platforms handling customer and employee records. Please run a full compliance evaluation that catalogues personal data categories and third parties, reports compliance status across evaluated articles, lists specific gaps with priority remediation paths, and provides actionable recommendations.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run77

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+50% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 24 days ago

Other measured skills in the registry, with their headline benchmark lift.