1---
2name: gdpr-data-handling
3description: Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.
4---
5 
6# GDPR Data Handling
7 
8Practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls.
9 
10## When to Use This Skill
11 
12- Building systems that process EU personal data
13- Implementing consent management
14- Handling data subject requests (DSRs)
15- Conducting GDPR compliance reviews
16- Designing privacy-first architectures
17- Creating data processing agreements
18 
19## Core Concepts
20 
21### 1. Personal Data Categories
22 
23| Category               | Examples                    | Protection Level   |
24| ---------------------- | --------------------------- | ------------------ |
25| **Basic**              | Name, email, phone          | Standard           |
26| **Sensitive (Art. 9)** | Health, religion, ethnicity | Explicit consent   |
27| **Criminal (Art. 10)** | Convictions, offenses       | Official authority |
28| **Children's**         | Under 16 data               | Parental consent   |
29 
30### 2. Legal Bases for Processing
31 
32```
33Article 6 - Lawful Bases:
34├── Consent: Freely given, specific, informed
35├── Contract: Necessary for contract performance
36├── Legal Obligation: Required by law
37├── Vital Interests: Protecting someone's life
38├── Public Interest: Official functions
39└── Legitimate Interest: Balanced against rights
40```
41 
42### 3. Data Subject Rights
43 
44```
45Right to Access (Art. 15)      ─┐
46Right to Rectification (Art. 16) │
47Right to Erasure (Art. 17)       │ Must respond
48Right to Restrict (Art. 18)      │ within 1 month
49Right to Portability (Art. 20)   │
50Right to Object (Art. 21)       ─┘
51```
52 
53## Detailed worked examples and patterns
54 
55Detailed sections (starting with `## Implementation Patterns`) live in `references/details.md`. Read that file when the navigation summary above is insufficient.
56 
57## Best Practices
58 
59### Do's
60 
61- **Minimize data collection** - Only collect what's needed
62- **Document everything** - Processing activities, legal bases
63- **Encrypt PII** - At rest and in transit
64- **Implement access controls** - Need-to-know basis
65- **Regular audits** - Verify compliance continuously
66 
67### Don'ts
68 
69- **Don't pre-check consent boxes** - Must be opt-in
70- **Don't bundle consent** - Separate purposes separately
71- **Don't retain indefinitely** - Define and enforce retention
72- **Don't ignore DSARs** - 30-day response required
73- **Don't transfer without safeguards** - SCCs or adequacy decisions
74