gdpr-compliant
Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authentication flows, implementing logging, handling user data, writing retention/deletion jobs, designing cloud infrastructure, or reviewing pull requests for privacy compliance. Trigger this skill for any task involving personal data, user accounts, cookies, analytics, emails, audit logs, encryption, pseudonymization, anonymization, data exports, breach response, CI/CD pipelines that process real data, or any question framed as "is this GDPR-compliant
Profile →npx skills add github/awesome-copilot --skill gdpr-compliant --agent copilot
Same command for any agent — swap --agent for claude-code, codex, cursor.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# GDPR Engineering Skill Actionable GDPR reference for engineers, architects, DevOps, and tech leads. Inspired by CNIL developer guidance and GDPR Articles 5, 25, 32, 33, 35. > **Golden Rule:** Collect less. Store less. Expose less. Retain less. For deep dives, read the reference files in `references/`: - `references/data-rights.md` — user rights endpoints, DSR workflow, RoPA - `references/security.md` — encryption, hashing, secrets, anonymization - `references/operations.md` — cloud, CI/CD, incident response, architecture patterns --- ## 1. Core GDPR Principles (Article 5) | Principle | Engineering obligation | |---|---| | Lawfulness, fairness, transparency | Document legal basis for every processing activity in the RoPA | | Purpose limitation | Data collected for purpose A **MUST NOT** be reused for purpose B without a new legal basis | | Data minimization | Collect only fields with a documented business need today | | Accuracy | Provide update endpoints; propagate corrections to downstream stores | | Storage limitation | Define TTL at schema design time — never after | | Integrity & confidentiality | Encrypt at rest and in transit; restrict and audit access | | Accountability |
- 1. Core GDPR Principles (Article 5)
- 2. Privacy by Design & by Default
- 3. Data Minimization
- 4. Purpose Limitation
- 5. Storage Limitation & Retention
- 6. API Design Rules
- 7. Logging Rules
- 8. Error Handling
- 9. Encryption (summary — see references/security.md for full detail)
- 10. Password Hashing
- 11. Secrets Management
- 12. Anonymization & Pseudonymization (summary — see references/security.md)
- 13. Testing with Fake Data
- 14. Anti-Patterns
What does the gdpr-compliant skill do?
Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authentication flows, implementing logging, handling user data, writing retention/deletion jobs, designing cloud infrastructure, or reviewing pull requests for privacy compliance. Trigger this skill for any task involving personal data, user accounts, cookies, analytics, emails, audit logs, encryption, pseudonymization, anonymization, data exports, breach response, CI/CD pipelines that process real data, or any question framed as "is this GDPR-compliant
How do I install it?
Run `npx skills add github/awesome-copilot --skill gdpr-compliant --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From github/awesome-copilot, a repository with 37,432 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.