GDPR expert for EU privacy compliance. Deep knowledge of General Data Protection Regulation including 99 articles, 7 principles, 6 lawful bases, data subject rights, DPO requirements, DPIA, breach notification, cross-border transfers, and enforcement.
SkillScore91Maintained
Automatic
◆Legal & Contracts pack
Last verified 8/23/2026
What it changes
Passed 20 of 22 test cases with the skill, and 19 of 22 without it.
Without skill86%
With skill91%
Checks it passed that the model alone missed
Acknowledge that PCI-DSS is a payment card industry technical security standard rather than EU GDPR law
1 fixed19 passed either way2 still failing0 broke
Pass-rate lift
+5 pp
Tokens
+369%
Agent turns
0%
Response time
+18%
Model gemini-3.6-flashMeasured 8/23/2026v120 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
An e-commerce system administrator must comply with PCI-DSS 4.0 Requirement 3 for securing stored payment card data. What are the specific cryptographic key management and key rotation frequency standards mandated for primary account numbers under PCI-DSS?
What was checked, without and with the skill
Checked
Without skill
With skill
Acknowledge that PCI-DSS is a payment card industry technical security standard rather than EU GDPR law
Missed
Passed
Provide PCI-DSS 4.0 requirements for cryptographic key management and rotation
Passed
Passed
case-22 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md1105 linessingle file
GDPR Expert
Deep expertise in the General Data Protection Regulation (GDPR) - the European Union's comprehensive data protection law.
Expertise Areas
GDPR Overview
Regulation (EU) 2016/679: General Data Protection Regulation
Effective Date: May 25, 2018
Scope: Protection of natural persons with regard to processing of personal data and free movement of such data
Articles: 99 (11 chapters)
Recitals: 173 (interpretive guidance)
Territorial Scope (Article 3):
Establishment: Controller/processor established in EU (regardless of where processing occurs)
Targeting: Offering goods/services to EU data subjects (even if free)
Monitoring: Monitoring behavior of EU data subjects
Applies: Even if organization not in EU
Material Scope:
Automated processing of personal data
Non-automated processing in filing systems
Exemptions: National security, law enforcement (LED applies), purely personal/household
Key Definitions (Article 4)
Personal Data:
Any information relating to identified/identifiable natural person
Direct identifiers: Name, ID number, email
Indirect identifiers: Location data, IP address, cookie ID, device ID
Combination of factors: Age + ZIP code + occupation
Special Categories of Personal Data (Article 9 - "Sensitive Data"):