本文へ移動
cccskills
無料GitHub で公開

privacy-and-data-protection

Assesses and improves how personal data is collected, used, shared, and retained — data mapping, lawful basis, consent, processor agreements, subject rights, and breach obligations. Use this before launching anything that handles personal data, when adding a vendor that will process it, when a data subject request arrives, when assessing exposure under GDPR or US state privacy laws, or when preparing for a privacy review.

インストール方法を見る

含まれるファイル(2)

  • SKILL.md3.5 KB
  • references/sources.md1.7 KB

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Privacy and data protection

Not legal advice. Regimes differ by jurisdiction and change; material questions need qualified counsel. This structures the assessment and identifies what to escalate.

Start from the data map

You cannot assess what you have not inventoried. For each category of personal data:

  • What is collected, from whom, and where it came from.
  • Why — the specific purpose, and the lawful basis where one is required.
  • Where it lives, who can reach it, and which vendors receive it.
  • How long it is kept, and what deletes it. "Indefinitely" is a finding, not an answer.
  • Whether it crosses a border, and under what mechanism.

Most privacy failures are inventory failures: data nobody remembered was being collected, in a system nobody owned.

Design decisions that prevent problems

  • Collect less. Every field is a liability with a maintenance cost. The cheapest way to protect data is not to hold it.
  • Purpose limitation is real. Data collected for one purpose is not automatically available for another — particularly for training models, which is where this most often goes wrong now.
  • Separate identifiers from behavior where analysis does not require linkage.
  • Retention with an enforcing mechanism. A policy with no deletion job is a statement of intent.

Consent, where it applies

Specific, informed, freely given, and as easy to withdraw as to give. Pre-ticked boxes, bundled consent, and cookie walls that offer no genuine choice fail on their face in the regimes that require consent.

Note that consent is one lawful basis among several and often the weakest — it can be withdrawn, and then the processing must stop.

Vendors

Any third party processing personal data on your behalf needs a written agreement covering purpose, security, sub-processors, deletion, and assistance with subject rights. Sending data to a vendor without one is a common and easily avoided violation.

Assess the vendor's actual security, not their questionnaire answers, in proportion to the sensitivity of what they will hold.

Subject rights and breaches

Have a working process before the first request: how it arrives, how identity is verified, how the data is located across systems, and the deadline. Locating the data is the part that fails.

For breaches, know your notification clock before you need it — several regimes measure it in hours from awareness. Decide in advance who determines that awareness has occurred.

Sources

references/sources.md in this skill lists the outside authorities that settle the questions here — what each one is authoritative for, and what you may do with it. Check them before answering on anything they cover, and cite what you used. Most are free to read and not free to reproduce; the use note on each is binding.

Never

  • Collect data because it may be useful later. Purpose first, then collection.
  • Retain personal data past the period you published.
  • Send personal data to a vendor before the contract terms and the transfer basis are in place.
  • Load production personal data into a test environment.

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process. Use this to design a permissions model, run an access review, reduce standing privilege, handle offboarding, set up SSO or MFA, manage service and machine credentials, or diagnose why permissions have sprawled.

日本語の概要は準備中です。原文の説明を表示しています。

cbrock84/headcount2,0332026年9月18日 更新

Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group inside each, tiering effort against account value, coordinating so the account experiences one campaign rather than several, and measuring account progression instead of leads. Use this to decide whether to run an account-based program, build one, or work out why an existing one produces activity and no pipeline.

日本語の概要は準備中です。原文の説明を表示しています。

cbrock84/headcount2,0332026年9月18日 更新

Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account. Use this to design or fix signup and onboarding, diagnose why signups do not convert to active use, reduce time-to-value, or decide what a new user must accomplish first.

日本語の概要は準備中です。原文の説明を表示しています。

cbrock84/headcount2,0332026年9月18日 更新

Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a script that runs in CI. Use this whenever the user wants to set up, expand, audit, or fix a multi-agent or subagent structure for a codebase; asks how to divide work between agents; wants agent charters, roles, or a surface map written; or is hitting agents that collide on the same files, review their own work, or drift from their remit. Also use when sizing a roster or deciding whether a new agent is justified.

日本語の概要は準備中です。原文の説明を表示しています。

cbrock84/headcount2,0332026年9月18日 更新

Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire. Use this before deploying a model or AI feature, when defining evaluation criteria, when a model's behavior has drifted, when assessing AI risk or regulatory exposure, or when deciding whether an AI system is fit for a consequential decision.

日本語の概要は準備中です。原文の説明を表示しています。

cbrock84/headcount2,0332026年9月18日 更新

Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit. Use this to analyze a market or industry, map competitors, evaluate a market-entry or build-versus-buy decision, produce a research brief, or assemble evidence for a decision. Also use when comparing options that need a structured, evidence-based verdict rather than an opinion.

日本語の概要は準備中です。原文の説明を表示しています。

cbrock84/headcount2,0332026年9月18日 更新

cbrock84 のスキルをすべて見る

このスキルの問題を報告する