How to use the GDPR Engineering Guide agent skill

What is an agent skill and what does this one do?

An agent skill is a folder of instructions that an AI coding agent loads when a task matches the skill's description. This skill, named gdpr-compliant, is built from CNIL developer guidance and GDPR Articles 5, 25, 32, 33 and 35. Its central rule is: collect less, store less, expose less, retain less.

When the skill is active, the agent checks its work against a checklist of privacy practices. For example, it applies data minimisation to models and DTOs, masks card numbers so only the last four digits show, anonymises IP addresses in logs, returns generic error messages, and requires a retention period for every table that holds personal data.

• Designing APIs: no personal data in URL paths or query strings, and ownership checks on every resource.
• Data models: separate create, read and update objects, and a RetentionExpiresAt field on personal data tables.
• Logging: mask the last octet of IPv4 addresses, and never log passwords, tokens or full request bodies that may contain personal data.
• Passwords and secrets: Argon2id or bcrypt for hashing, and a KMS for secrets.
• Retention and deletion: scheduled jobs rather than manual clean-up.

Install the skill from the ZIP file

Download the ZIP file for this skill from this page. Unzip it into one of two locations. For a personal setup that applies to all your projects, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder so it is shared with everyone who works in the repository.

If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

Check what the skill needs before you rely on it

The skill lists no required tools or packages. It does not run scripts and does not use the network, so installing it does not add executable code to your machine. The skill is made of Markdown instructions and reference files: SKILL.md, references/data-rights.md and references/Security.md.

The skill does not scan your code or enforce anything by itself. It guides the agent's suggestions and reviews. Your own tests, linters and review process are still what catch problems.

How do you trigger the skill with natural requests?

You do not need a special command. The skill's description lists the tasks it covers, so the agent loads it when your request involves personal data or privacy. Describe the work in plain language and mention the privacy angle if you want to be sure.

The description names triggers such as designing APIs, writing data models, building authentication flows, implementing logging, handling user data, writing retention or deletion jobs, reviewing pull requests for privacy compliance, and questions framed as "is this GDPR-compliant?".

• "Review this pull request for GDPR privacy issues."
• "Design the data model for user profiles with a retention policy."
• "Is this logging code GDPR-compliant?"
• "Write a nightly job that deletes inactive accounts after 12 months."
• "Add a data export endpoint for users."

What does the agent produce with this skill?

The output is guidance applied to your code or design. For a logging change, the agent should point out which values must not be logged and suggest masking IP addresses. For an API, it should check authentication, ownership validation and error responses. For a data model, it should ask for a retention period and a RetentionExpiresAt column.

The skill's reference files also cover user rights endpoints, such as a data export at GET /api/v1/me/data-export and erasure at DELETE /api/v1/me, plus encryption and envelope encryption patterns. Ask the agent to load the relevant reference when you need that detail.

Safety notes and limits

The skill is engineering guidance inspired by CNIL and GDPR articles. It is not legal advice and cannot decide your legal basis for processing. For that you need a lawyer or your Data Protection Officer.

Do not rely on the skill alone to prove compliance in a production audit. It is a guide, and its visible text is the only part you can check directly. The skill also does not apply to projects outside the GDPR, where following its rules may add cost without benefit.

• Not a substitute for legal advice or a Data Protection Officer.
• Not an audit tool and not a code scanner.
• Not needed for non-EU or non-GDPR projects.

Tips for getting better results

Give the agent concrete context. Name the table, endpoint or log statement you are changing, and say what personal data it touches. Specific input produces specific advice.

Use the skill during design, not only at the end. The skill's rules are easiest to apply when a table or endpoint is first created, because the guidance says retention and collection limits should be set at schema design time.

• Paste the code or schema you want reviewed, not just a description.
• Ask for the reason behind each suggestion so you can judge it.
• Check the agent's output against your legal team's requirements.