How to use the GDPR Data Handling agent skill

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md file and optional supporting files. When a request matches the skill's description, the agent reads the instructions and follows them. This skill is named gdpr-data-handling and is described as a way to implement GDPR-compliant data handling with consent management, data subject rights and privacy by design.

In practice, the agent answers GDPR questions and designs systems with privacy in mind. It explains the six Article 6 lawful bases, sorts personal data into basic, sensitive (Art. 9), criminal (Art. 10) and children's categories, and lists the data subject rights such as access, rectification, erasure, restriction, portability and objection.

• Explains lawful bases: consent, contract, legal obligation, vital interests, public interest and legitimate interest
• Classifies personal data into basic, sensitive, criminal and children's categories
• Outlines data subject rights and the 30-day response guidance
• Applies do's and don'ts such as opt-in consent, data minimisation and retention limits
• Points to references/details.md for worked examples, including a consent data model and ConsentManager class

How do you install the GDPR Data Handling skill?

Download the ZIP of the skill from the page where you found this guide, then unzip it. You can install it for yourself or for a single project.

For a personal install, unzip the folder into ~/.claude/skills/. For a project install, unzip it into the project's .claude/skills/ folder. The skill folder should contain SKILL.md and references/details.md.

In the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills

How do you trigger the skill with a natural request?

You do not need a special command. Ask in plain language about a task the skill covers. The skill's description mentions building systems that process EU personal data, implementing privacy controls and conducting GDPR compliance reviews, so requests on those topics are the most likely to load it.

Be specific about the system or task. Naming the data you handle and the purpose gives the agent what it needs to apply the right lawful basis and controls.

• "Design a consent flow for a newsletter signup that serves EU users."
• "Which lawful basis should we use for storing customer order history?"
• "We need to handle a data subject access request. What steps do we take and what is the deadline?"
• "Review this signup form for GDPR problems with pre-ticked boxes or bundled consent."
• "Classify the fields in our health intake form under GDPR."

What kinds of tasks work well?

The skill suits design and planning work. It is most useful when you are deciding how data should be collected, stored, shown to users and deleted, and when you want a checklist for a review.

Examples of what people typically do with it include designing consent storage, mapping which lawful basis fits each feature, drafting a plan for handling access or erasure requests, and preparing questions for a compliance review.

• Model consent records with purpose, timestamp, policy version and audit log entries
• Decide whether a feature needs opt-in consent or another lawful basis
• Plan how to respond to access, erasure or portability requests
• Check a design against minimisation and retention rules

What does the skill need and what should you watch for?

The skill lists no requirements. It does not run scripts and does not use the network. Its files are SKILL.md and references/details.md, both plain text.

The skill is a practical guide, not legal advice. It can be incomplete or out of date, and it does not cover non-EU regimes such as CCPA or UK-specific rules. It also does not scan your code or data, so it cannot tell you whether a live system is compliant.

• Requirements: none listed
• Runs scripts: no
• Uses network: no
• Not a substitute for a qualified lawyer or data protection officer
• Does not cover CCPA or UK-specific rules
• Does not automatically check real code or data

What tips help you get better answers?

Give the agent the context it lacks: where the users are, what data you collect, why you collect it and how long you keep it. Ask it to check a specific design rather than GDPR in general. For worked examples, ask it to read the reference file, since the main SKILL.md only gives a summary.

Always verify decisions with your legal or privacy team before relying on them.

• Name the purpose for each data field
• Say whether minors or special-category data are involved
• Ask for the reference examples when you need code patterns
• Treat outputs as a starting checklist, not a final sign-off