gdpr-data-handling Skill (wshobson): GDPR Code Patterns

Gives Claude a GDPR checklist and code patterns for consent, access requests, retention and breach response in systems that hold EU personal data.

Installs: 15.2K; on skills.sh
Stars: 42.1K; on GitHub
Files: 1; besides SKILL.md
Updated: Oct 2026; last repo commit

gdpr-data-handling makes Claude work from a GDPR playbook when you build consent flows, handle data subject requests or review a system for compliance. The SKILL.md lists personal data categories, the six lawful bases and the data subject rights, with do and don't lists. Worked code sits in references/details.md.

The SKILL.md describes itself as a practical implementation guide.

Good for

Developers building features that process EU personal data
Teams adding consent management or data subject request handling
Engineers preparing a GDPR compliance review

Install gdpr-data-handling

Claude Code

Copy this prompt.

Install the gdpr-data-handling skill in Claude Code. Run this command:

/plugin marketplace add wshobson/agents
/plugin install hr-legal-compliance@claude-code-workflows

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

The plugin route installs the whole hr-legal-compliance plugin: 2 skills and 2 agents (counted from the repo tree). The skills-only routes install just this skill without the agents, commands or hooks, per the README. Pick one route, not both.

From the project README. Source.

What's in the skill

When it loads

Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.

Sections in SKILL.md

When to Use This Skill
Core Concepts
1. Personal Data Categories
2. Legal Bases for Processing
3. Data Subject Rights
Detailed worked examples and patterns
Best Practices
Do's
Don'ts

Key facts

Author: wshobson (repo owner)
Repo: wshobson/agents
Installs on skills.sh: 15,168
Repo stars: 42,081
License: MIT
Last repo commit: 2026-10-30
Files in the skill folder: 2 files including SKILL.md

What it includes

A table of basic, sensitive, criminal and children's data
Shows the protection level each category needs, such as explicit consent for sensitive data.
Personal Data Categories
The six lawful bases under Article 6
Lists consent, contract, legal obligation, vital interests, public interest and legitimate interest.
Legal Bases for Processing
Access, rectification, erasure, restriction, portability, objection
Notes the one-month response window.
Data Subject Rights
Collect and record consent
Worked example in references/details.md.
Pattern 1: Consent Management
Handle a DSAR end to end
Worked example in references/details.md.
Pattern 2: Data Subject Access Request
Define and enforce retention
Worked example in references/details.md.
Pattern 3: Data Retention
Build privacy into the architecture
Worked example in references/details.md.
Pattern 4: Privacy by Design
Respond to a data breach
Worked example in references/details.md.
Pattern 5: Breach Notification
Legal basis, transparency, rights, security, breach response, documentation
A checklist at the end of references/details.md.
GDPR Implementation Checklist
Do's and don'ts
Includes minimizing data, encrypting PII, no pre-checked consent boxes and no bundled consent.
Best Practices

From the official docs

Permissions

Low risk

The skill bundles no scripts, but its worked examples include code that deletes and anonymizes personal data. Test those paths on sample data before you use them on real records.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Examples delete and anonymize user data
references/details.md shows an erasure handler that calls delete_user_data on each data source, and a retention job that runs delete_old_data or anonymize_old_data after a cutoff date. Claude adapts these into your code. Run them against test data first and review any deletion logic before it touches production. github.com
Generated code handles personal data
The consent, access request and breach patterns write code that stores or exports personal data. Review it like any other code that handles PII. github.com

Questions

What does the gdpr-data-handling skill do?

It gives Claude GDPR reference tables and five worked implementation patterns: consent, data subject access requests, retention, privacy by design and breach notification.

Is it legal advice?

The SKILL.md calls itself a practical implementation guide for developers and makes no claim to be legal advice. Treat it as developer guidance, and ask a qualified lawyer or your data protection officer about your own case (our advice, not the skill's).

When does Claude use it?

The description says to use it when building systems that process EU personal data, implementing privacy controls or conducting GDPR compliance reviews.

How do I install it?

Use the install box above. The skill folder has 2 files: SKILL.md and references/details.md.

Is it safe to install?

It bundles no scripts, only two markdown files. Claude writes code into your project from its patterns, including examples that delete or anonymize user data, so review that code and test it on sample data before you ship it.

Does it cover data transfers outside the EU?

Briefly. Its don't list says not to transfer data without safeguards such as SCCs or adequacy decisions.

Information

updated Nov 2, 2026

Repository: wshobson/agents
Folder: plugins/hr-legal-compliance/skills/gdpr-data-handling

wshobson/agents skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3

wshobson/agents README · github.com
gdpr-data-handling SKILL.md · github.com
gdpr-data-handling references/details.md · github.com