Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →lawve-ai/gdpr-breach-sentinel-oliver-schmidt-prietz
Elite incident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34.
Passed 19 of 22 test cases with the skill, and 15 of 22 without it.
and 2 more in the full report
4 fixed15 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our group has offices in Dublin, Paris, and Berlin. Decisions regarding central customer database processing and security controls are made exclusively at our Dublin headquarters. A breach affected users across Europe. Which supervisory authority serves as the Lead Supervisory Authority under Article 56?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies the Irish Data Protection Commission as the Lead Supervisory Authority based on main establishment and decision-making location. | Passed | Passed |
| Notes that affected Member States must still be listed in the Lead SA notification submission. | Missed | Passed |
The instructions your model reads when the skill loads.
Guide users through post-breach compliance with GDPR Articles 33 & 34, EDPB Guidelines 9/2022 & 01/2021, and ENISA Severity Methodology. Build an EDPB-template-aligned breach evidence file, generate audit-ready documentation, and provide actionable mitigation guidance.
Important: This skill provides structured GDPR breach-notification guidance based on Art. 33–34 GDPR, EDPB Guidelines, and ENISA methodology. It is not legal advice. Final notification decisions should involve your organisation's DPO and qualified legal counsel.
Handle with care: This may be a live incident.
- Do not paste real personal data unless necessary — anonymised or pseudonymised samples ("Employee A", "Patient 1") are sufficient for the assessment.
- Do not upload forensic artefacts, logs, or personal data to public tools unless cleared by your security and legal teams; for an actual breach, work in an environment your organisation has approved for confidential incident data.
- Preserve legal privilege: keep communications prepared with or for legal counsel separate from operational facts, and mark them as privileged.
- Keep facts, assumptions, and legal conclusions clearly separated in everything you record (see Evidence Posture below).
"Are you in a time-critical situation with less than 12 hours remaining on your notification clock?"
Not every security incident is a personal data breach. Establish two things first:
Classify into exactly one verdict:
| Triage Verdict | Meaning | Next Step |
|---|---|---|
| SECURITY INCIDENT ONLY | No personal data affected (e.g., DDoS against a static site, malware on a system holding no personal data) | Art. 33/34 not triggered. Document why no personal data was involved (offer a short internal security-incident record, .docx), advise preserving that documentation, screen parallel regimes (NIS2 etc.), and stop the GDPR workflow — no dashboard, no ENISA run |
| BREACH CONFIRMED | Personal data demonstrably affected | Proceed to intake — the 72h clock analysis applies |
test cases passed, vs 15 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.