Agent Academy

Agent Academy is a free, source-linked library of skills, prompts, MCP servers and bot templates, organised into courses by profession, for people who hand real work to AI agents: 1,467 live resources, each with its original link, license and safety tags.

Skill

gdpr-data-handling

Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.

No credentialsDoes not send
Open the original

https://github.com/wshobson/agents/blob/main/plugins/hr-legal-compliance/skills/gdpr-data-handling/SKILL.md

Install
npx skills add wshobson/agents --skill gdpr-data-handling

Original content

Full originalMITSource

Republished in full under its license, with attribution. The source is authoritative.

name: gdpr-data-handling
description: Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.

GDPR Data Handling

Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.

When to Use This Skill

  • Building systems that process EU personal data
  • Implementing consent management
  • Handling data subject requests (DSRs)
  • Conducting GDPR compliance reviews
  • Designing privacy-first architectures
  • Creating data processing agreements

Core Concepts

1. Personal Data Categories

CategoryExamplesProtection Level
BasicName, email, phoneStandard
Sensitive (Art. 9)Health, religion, ethnicityExplicit consent
Criminal (Art. 10)Convictions, offensesOfficial authority
Children'sUnder 16 dataParental consent

2. Legal Bases for Processing

Article 6 - Lawful Bases:
├── Consent: Freely given, specific, informed
├── Contract: Necessary for contract performance
├── Legal Obligation: Required by law
├── Vital Interests: Protecting someone's life
├── Public Interest: Official functions
└── Legitimate Interest: Balanced against rights

3. Data Subject Rights

Right to Access (Art. 15)      ─┐
Right to Rectification (Art. 16) │
Right to Erasure (Art. 17)       │ Must respond
Right to Restrict (Art. 18)      │ within 1 month
Right to Portability (Art. 20)   │
Right to Object (Art. 21)       ─┘

Detailed worked examples and patterns

Detailed sections (starting with ## Implementation Patterns) live in references/details.md. Read that file when the navigation summary above is insufficient.

Best Practices

Do's

  • Minimize data collection - Only collect what's needed
  • Document everything - Processing activities, legal bases
  • Encrypt PII - At rest and in transit
  • Implement access controls - Need-to-know basis
  • Regular audits - Verify compliance continuously

Don'ts

  • Don't pre-check consent boxes - Must be opt-in
  • Don't bundle consent - Separate purposes separately
  • Don't retain indefinitely - Define and enforce retention
  • Don't ignore DSARs - 30-day response required
  • Don't transfer without safeguards - SCCs or adequacy decisions

Related

SkillLegal and compliance

employment-contract-templates

Create employment contracts, offer letters, and HR policy documents following legal best practices. Use when drafting employment agreements, creating HR policies, or standardizing employment documentation.

Sourcegithub.com/wshobson/agents/blob/main/plugins/hr-legal-compliance/skills/employment-contract-templates/SKILL.md

No credentialsDoes not sendMIT
SkillLegal and compliance

brief

Generate contextual briefings for legal work — daily summary, topic research, or incident response. Use when starting your day and need a scan of legal-relevant items across email, calendar, and contracts, when researching a specific legal question across internal sources, or when a developing situation (data breach, litigation threat, regulatory inquiry) needs rapid context.

Sourcegithub.com/anthropics/knowledge-work-plugins/blob/main/legal/skills/brief/SKILL.md

No credentialsDoes not sendApache-2.0
SkillLegal and compliance

comp-analysis

Analyze compensation — benchmarking, band placement, and equity modeling. Trigger with "what should we pay a [role]", "is this offer competitive", "model this equity grant", or when uploading comp data to find outliers and retention risks.

Sourcegithub.com/anthropics/knowledge-work-plugins/blob/main/human-resources/skills/comp-analysis/SKILL.md

No credentialsDoes not sendApache-2.0
SkillLegal and compliance

compliance-check

Run a compliance check on a proposed action, product feature, or business initiative, surfacing applicable regulations, required approvals, and risk areas. Use when launching a feature that touches personal data, when marketing or product proposes something with regulatory implications, or when you need to know which approvals and jurisdictional requirements apply before proceeding.

Sourcegithub.com/anthropics/knowledge-work-plugins/blob/main/legal/skills/compliance-check/SKILL.md

No credentialsDoes not sendApache-2.0
SkillLegal and compliance

draft-offer

Draft an offer letter with comp details and terms. Use when a candidate is ready for an offer, assembling a total comp package (base, equity, signing bonus), writing the offer letter text itself, or prepping negotiation guidance for the hiring manager.

Sourcegithub.com/anthropics/knowledge-work-plugins/blob/main/human-resources/skills/draft-offer/SKILL.md

No credentialsDoes not sendApache-2.0
SkillLegal and compliance

interview-prep

Create structured interview plans with competency-based questions and scorecards. Trigger with "interview plan for", "interview questions for", "how should we interview", "scorecard for", or when the user is preparing to interview candidates.

Sourcegithub.com/anthropics/knowledge-work-plugins/blob/main/human-resources/skills/interview-prep/SKILL.md

No credentialsDoes not sendApache-2.0