Gdpr Compliance

Instructions

Step 1: Lawful Basis Assessment

Six Lawful Bases (Article 6):

Marketing Activity Mapping:

Step 2: Consent Requirements

Valid Consent Criteria (Article 7):

Consent Record Requirements:

Record for each consent:
- Who consented (identifier)
- When (timestamp)
- What they consented to (purpose)
- How (mechanism)
- What they were told (notice version)

Step 3: Privacy Notice Requirements

Required Elements (Articles 13-14):

Step 4: Data Subject Rights

Rights Framework:

Step 5: Documentation & Records

Required Documentation:

1. Records of Processing Activities (ROPA)
2. Legitimate Interest Assessments
3. Consent records and mechanisms
4. Privacy notices (versioned)
5. Data Subject Request log
6. Breach notification procedures

Examples

Example 1: Marketing Email Consent Flow

Input:

Design a GDPR-compliant consent flow for:
- SaaS product newsletter
- Product updates
- Promotional offers
- Third-party partner offers

Output:

## GDPR-Compliant Email Consent Flow

### Consent Collection UI

---

**Signup Form Fields:**

Email: [________________]

[ ] I agree to receive the monthly newsletter with industry insights [ ] I agree to receive product updates and feature announcements [ ] I agree to receive promotional offers and discounts [ ] I agree to receive relevant offers from our trusted partners

[Sign Up]

By signing up, you confirm you've read our [Privacy Notice]. You can withdraw consent anytime via unsubscribe link or contacting us.

**Design Requirements:**
- All checkboxes unchecked by default
- No "select all" option
- Each purpose separate
- Privacy notice linked, not buried
- No dark patterns

---

### Consent Record Structure

```json
{
  "email": "[email protected]",
  "consents": [
    {
      "purpose": "newsletter",
      "granted": true,
      "timestamp": "2026-01-31T10:30:00Z",
      "source": "signup_form_v3",
      "notice_version": "privacy_v2.1"
    },
    {
      "purpose": "product_updates",
      "granted": true,
      "timestamp": "2026-01-31T10:30:00Z",
      "source": "signup_form_v3",
      "notice_version": "privacy_v2.1"
    },
    {
      "purpose": "promotional",
      "granted": false,
      "timestamp": null,
      "source": null,
      "notice_version": null
    },
    {
      "purpose": "third_party",
      "granted": false,
      "timestamp": null,
      "source": null,
      "notice_version": null
    }
  ],
  "ip_address": "192.168.1.1",
  "user_agent": "Mozilla/5.0..."
}

Email Footer (Required)

---
You're receiving this because you subscribed to our [newsletter/updates].

Manage preferences: [link]
Unsubscribe from this list: [link]
Unsubscribe from all: [link]

[Company Name]
[Address]
[Contact Email]

Preference Center

[Update Preferences] [Unsubscribe from All]

Compliance Checklist

• All consents granular (separate checkboxes)
• Checkboxes unchecked by default
• Clear description of each purpose
• Privacy notice accessible
• Withdrawal mechanism clear
• Consent records stored
• Double opt-in implemented
• Unsubscribe in every email
• Preference center available

### Example 2: Legitimate Interest Assessment

**Input:**

We want to email our existing customers about related products. Do we need consent or can we use legitimate interest?

**Output:**

Legitimate Interest Assessment: Customer Cross-Sell

Summary

You can likely rely on legitimate interest (not consent) for emailing existing customers about similar products, but must complete this assessment and offer easy opt-out.

Three-Part LIA Test

1. Purpose Test: Is There a Legitimate Interest?

Interest: Promote related products to existing customers Legitimacy: Yes - recognized business interest in customer development Benefit: Revenue growth, customer relationship deepening

✅ PASS

2. Necessity Test: Is Processing Necessary?

✅ PASS (with conditions)

Conditions:

• Limit to genuinely related products
• Reasonable frequency (not daily)
• Honor opt-outs immediately

3. Balancing Test: Individual Rights vs. Your Interest

✅ PASS

Conclusion

Lawful Basis: Legitimate Interest (Article 6(1)(f))

Requirements for Compliance:

1. Document this LIA and keep on file
2. Include in privacy notice: "We may contact existing customers about similar products based on legitimate interest. You can opt out at any time."
3. Easy opt-out: Every email must have unsubscribe
4. Honor preferences: Immediate suppression on opt-out
5. Similar products only: Don't expand to unrelated offerings
6. Reasonable frequency: No more than weekly

Template Email Footer

You're receiving this as a valued [Company] customer.

Not interested in product updates?
[Opt out of marketing] | [Manage preferences]

This email was sent based on our legitimate interest in keeping
customers informed about relevant products. See our Privacy Notice
for details and your rights.

When This Doesn't Apply

Use consent instead if:

• Products are significantly different
• Customer bought once 2+ years ago
• You acquired data from third party
• Customer previously opted out
• Emails are primarily promotional (not informational)

## Skill Boundaries

### What This Skill Does Well
- Explaining GDPR requirements
- Drafting compliant language
- Creating documentation templates
- Identifying compliance gaps

### What This Skill Cannot Do
- Provide legal advice
- Know your specific jurisdiction nuances
- Guarantee regulatory acceptance
- Replace DPO consultation

### When to Escalate to Human
- Complex cross-border transfers
- Regulatory investigation
- Data breach response
- Novel processing activities

## Iteration Guide

**Follow-up Prompts:**
- "Draft the privacy notice section for [activity]"
- "How do we handle a right to erasure request?"
- "What documentation do we need for [processing]?"
- "Is this cookie banner compliant?"

## References

- GDPR Text (Regulation 2016/679)
- EDPB Guidelines on Consent
- ICO Direct Marketing Guidance
- CNIL Cookie Guidelines

## Related Skills

- `terms-analyzer` - Terms of service review
- `contract-review` - DPA analysis
- `nda-generator` - Confidentiality

## Skill Metadata

- **Domain**: Legal / Marketing
- **Complexity**: Intermediate
- **Mode**: centaur
- **Time to Value**: 1-2 hours per assessment
- **Prerequisites**: Basic GDPR familiarity