Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
DeepSeek
Muse+22 moreClaude CodeCursorCodex CLIDeepSeekMuse
Dots
Manus
Grok
Grok Bot+18 agentsGDPR ROPA & DPIA Drafting Assistant
Drafts and audits GDPR-compliant ROPA registers and DPIA risk assessments with cited legal articles and gap analysis.
$17
GDPR ROPA & DPIA Drafting Assistant
Example session with this skill installed
Draft a ROPA entry for a new employee payroll system called 'PayRollMaster'. We use a third-party processor in the US. Data includes names, bank details, and social security numbers.
- Read your context and instructions
- Compiled the gdpr ropa
This draft includes a controller ROPA entry with 3 identified gaps. The top priority is confirming the international transfer mechanism for the US-based processor.
DISCLAIMER: This is a draft produced by an AI assistant. It is NOT legal advice. Consult your DPO or legal counsel before adoption.
GDPR Article 30(1) Record of Processing Activities: PayRollMaster
| Field | Requirement | Value | Status |
|---|---|---|---|
| Purpose | Art. 30(1)(b) | Management of employee payroll, tax withholdings, and benefits distribution. | Provided |
| Data Subjects | Art. 30(1)(c) | Current employees, former employees. | Proposed |
| Data Categories | Art. 30(1)(c) | Identifiers (Name, SSN), Financial (Bank details), Professional (Salary). | Provided |
| Lawful Basis | Art. 6(1)(b) | Performance of a contract (Employment contract). | Proposed |
| Recipients | Art. 30(1)(d) | PayRollMaster (Processor), Tax Authorities, Pension Providers. | Provided |
| Transfers | Art. 30(1)(e) | USA. [TO CONFIRM: Transfer mechanism, e.g., Data Privacy Framework or SCCs]. | Gap |
| Retention | Art. 30(1)(f) | [TO CONFIRM: Local statutory tax/labor law requirements]. | Gap |
| Security | Art. 30(1)(g) | [TO CONFIRM: Technical and organizational measures by PayRollMaster]. | Gap |
Gaps and Assumptions
Retention: You must define the specific number of years records are kept based on your local jurisdiction's tax and labor laws.
Transfer Mechanism: Verify if the processor is certified under the EU-U.S. Data Privacy Framework or if Standard Contractual Clauses are signed.
- Security: Obtain a SOC2 or ISO 27001 report from the vendor to populate the security measures section.
Next steps
- Send the Intake Questionnaire to the HR department to confirm retention periods.
- Request the Data Processing Agreement (DPA) from PayRollMaster to verify Art. 28 compliance.
- Conduct a DPIA threshold screening as this involves large-scale financial and identification data.
DISCLAIMER: Not legal advice.
Connects securely to your tools. The creator never sees your data.
About this skill
This skill streamlines the production of GDPR-mandated documentation, specifically focusing on Article 30 Records of Processing Activities (ROPA) and Article 35 Data Protection Impact Assessments (DPIA). It addresses the technical challenge of converting unstructured business process descriptions into audit-ready registers and risk assessments. The tool enforces a strict drafting methodology that distinguishes between user-provided facts, proposed measures, and critical documentation gaps, ensuring that DPOs and legal counsel receive structured drafts rather than vague summaries.
What it does
- ROPA Generation drafts controller and processor records following Article 30 requirements, including lawful basis justification and retention logic.
- DPIA Screening performs threshold analyses against WP248 criteria to determine if a full assessment is legally required.
- Risk Assessment calculates inherent and residual risk scores for data subjects using a standardized likelihood-impact matrix.
- Transfer Analysis evaluates international data flows to identify necessary transfer mechanisms and adequacy requirements.
- Compliance Auditing reviews existing privacy documents against a quality checklist to flag critical omissions or legal misalignments.
How it works
- Intake gathers core processing details via a batched questionnaire covering data categories, subjects, and recipients.
- Drafting applies domain-specific templates to generate structured Markdown or CSV outputs tied to specific GDPR articles.
- Validation identifies missing mandatory fields and flags them as explicit gaps for the user to resolve.
- Review analyzes the draft for common pitfalls like vague purpose descriptions or missing Article 9 conditions for special category data.
Frameworks & tools
The skill is grounded in GDPR (EU and UK), utilizing European Data Protection Board (EDPB) guidelines, WP248 criteria, and standard risk-scoring methodologies.
Why this beats prompting it yourself
Generic prompts often invent retention periods or ignore the distinction between organizational risk and risk to individuals. This skill enforces strict accountability by citing relevant articles, flagging assumptions, and preventing the reproduction of real personal data during the drafting process.
Use cases
- Drafting a new ROPA entry for a cloud-based HR management system.
- Screening a proposed marketing automation tool to see if a DPIA is mandatory.
- Conducting a full DPIA for a large-scale data processing activity involving profiling.
- Auditing an existing processing register before a supervisory authority inspection.
Known limitations
This tool provides drafting assistance only and is not legal advice. It does not store or process real personal identifiers and requires human DPO or counsel sign-off for all deliverables.
Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Legal & Compliance.
Not legal advice. Does not store real PII. Requires manual verification of jurisdiction-specific adequacy decisions and national DPIA lists.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before buying a skill.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 10 days ago