Data Privacy Controls

What it is: GDPR/CCPA.

Overview

Works out the smallest useful Data Privacy Controls setup for the business in front of it, then builds it only when asked. The default output is a short recommendation, not a spreadsheet. Artifacts - CSV, SQL DDL, JSON Schema, Notion mapping - are produced on request, from one field list so they cannot drift apart.

Layer: Layer 7: Protect. Fits: Scale stage. Table code: n/a.

When to Use This Skill

• gdpr compliance
• data privacy register
• ccpa controls
• data protection tracker

Also use it when the user says "gdpr/ccpa", or describes the same process happening in a spreadsheet, a document or someone inboxes.

Do not use it for: payroll calculation, tax filing, or legal advice. This skill produces empty templates only - it never holds or processes real employee or customer data.

How It Works

Use the self-contained workflow below; no parent module or integration is required for empty local templates. Record lawful basis and retention as unknown until a qualified owner supplies them; a checkbox or example row does not establish compliance.

Step 1 - Identify intent

Read the request and pick the intent before asking anything.

• "set up" or "build" or "create" -> the user wants artifacts; go to Step 2.
• "our process is ..." or "it is in a sheet" -> the user wants to move an existing process; capture it, then Step 2.
• "is this right" or "review" or "audit" -> the user wants a check, not a build; answer from what they share.
• "how do I ..." -> advice question; answer directly and offer the build only if it helps.

Ask only if this is the highest-value missing fact; otherwise proceed without an opener:

Q: What personal data do you hold?

Step 2 - Ask only what is missing

Skip anything the user already answered, in any earlier message. Ask the rest one at a time, and stop as soon as the remaining answers would not change the output.

• Data - Which categories? / Employee, customer or both? / How many people affected?
• Purpose - Why is it held? / Consent given? / Any special categories?
• Controls - Who can access it? / Retention rules? / Deletion process?
• Current process - Is it documented? / Any privacy notice? / Has a breach happened?
• Outcome - What do you need? / A data inventory, a control list or both?

Never invent an answer. If the user does not know, record it as unknown and carry on.

Step 3 - Hold the internal context

Hold the answers in this shape. It stays internal - it is not shown to the user unless they ask, and it never carries a value the user did not give.

module: data-privacy-controls
intent: null            # setup | advice | review | fix | build | convert | export
scale: null             # Starter | Growth | Scale, only if the answer changes it
areas:
  "Data": null
  "Purpose": null
  "Controls": null
  "Current process": null
  "Outcome": null
requested_outputs: []   # csv | sql | json | notion | xlsx - requested formats only
confirmed_facts: []     # only what the user actually said
open_questions: []      # the unanswered ones, in the order worth asking

Step 4 - Recommend the smallest workflow

If an artifact was requested, build it after resolving essential missing facts. Otherwise give a short recommendation and offer the relevant artifact.

Recommended approach: Start with an inventory of what is held and why, then attach an owner and a retention rule to each item.

Why this one: Privacy work fails without an inventory, because you cannot protect data you have not listed. The inventory comes first.

Workflow: Data category listed → Purpose recorded → Owner and access → Retention rule → Review

Step 5 - Build only on request

Once the user asks for it, derive the fields from the confirmed context and emit the requested artifacts. For machine-readable text, keep prose outside the data; for files, provide a usable link. Report material validation failures or limitations separately.

For a Notion output, provide the CSV and property mapping below for manual import. If notion-manual-import is separately available, it may assist with import instructions; it is optional. For requested workspace writes, verify actual tool access and the precise target, apply the authorized change, and read it back before claiming completion. Never ask for a password or token.

…