/gdpr-compliance

name: gdpr-compliance
description: Ensure GDPR compliance for marketing activities including consent management, data processing, privacy notices, and data subject rights
license: MIT
metadata:
  author: ClawFu
  version: 1.0.0
  mcp-server: "@clawfu/mcp-skills"

GDPR Compliance for Marketing

> Ensure your marketing activities comply with GDPR requirements for consent, data processing, and privacy rights.

When to Use This Skill

• Designing consent collection flows
• Writing privacy notices
• Auditing marketing data practices
• Handling data subject requests
• Documenting lawful basis

Methodology Foundation

Based on **GDPR Articles 6, 7, 12-23** and **EDPB Guidelines**, covering:

• Lawful basis determination
• Consent requirements
• Transparency obligations
• Data subject rights
• Documentation requirements

What Claude Does vs What You Decide

| Claude Does | You Decide | |-------------|------------| | Explains GDPR requirements | Business risk tolerance | | Drafts compliant language | Implementation priority | | Identifies gaps | Legal interpretation | | Creates documentation | DPO consultation needs | | Suggests controls | Resource allocation |

Instructions

Step 1: Lawful Basis Assessment

**Six Lawful Bases (Article 6):**

| Basis | Marketing Use | Documentation Needed | |-------|---------------|----------------------| | **Consent** | Email marketing, cookies, tracking | Consent records | | **Contract** | Customer communications | Contract terms | | **Legitimate Interest** | Soft opt-in, B2B marketing | LIA document | | **Legal Obligation** | Regulatory comms | Legal reference | | **Vital Interest** | Rarely applicable | - | | **Public Task** | Rarely applicable | - |

**Marketing Activity Mapping:**

| Activity | Typical Basis | Requirements | |----------|---------------|--------------| | Email newsletter | Consent | Double opt-in, easy unsubscribe | | Existing customer upsell | Legitimate Interest | LIA, opt-out available | | Cold B2B outreach | Legitimate Interest | LIA, clear identity | | Website cookies | Consent | Banner, granular choices | | Retargeting ads | Consent | Cookie consent | | Lead magnets | Consent | Clear purpose, separate consent |

Step 2: Consent Requirements

**Valid Consent Criteria (Article 7):** | Requirement | What It Means | Example | |-------------|---------------|---------| | Freely given | No bundling, no penalty | Separate from T&Cs | | Specific | Clear purpose stated | "Marketing emails about [X]" | | Informed | Who, what, why explained | Privacy notice linked | | Unambiguous | Clear affirmative action | Unchecked checkbox | | Withdrawable | Easy to revoke | One-click unsubscribe |

**Consent Record Requirements:**

Record for each consent:
- Who consented (identifier)
- When (timestamp)
- What they consented to (purpose)
- How (mechanism)
- What they were told (notice version)

Step 3: Privacy Notice Requirements

**Required Elements (Articles 13-14):**

| Element | First-Party Data | Third-Party Data | |---------|------------------|------------------| | Controller identity | Required | Required | | DPO contact | If applicable | If applicable | | Purposes | Required | Required | | Lawful basis | Required | Required | | Recipients | Required | Required | | Transfers | If applicable | If applicable | | Retention | Required | Required | | Rights | Required | Required | | Withdrawal | If consent | If consent | | Complaint right | Required | Required | | Source | N/A | Required |

Step 4: Data Subject Rights

**Rights Framework:**

| Right | Timeline | Marketing Impact | |-------|----------|------------------| | Access (Art. 15) | 1 month | Provide all marketing data | | Rectification (Art. 16) | 1 month | Update preferences | | Erasure (Art. 17) | 1 month | Remove from lists | | Restriction (Art. 18) | 1 month | Pause processing | | Portability (Art. 20) | 1 month | Export in machine format | | Objection (Art. 21) | Immediate for marketing | Stop direct marketing |

Step 5: Documentation & Records

**Required Documentation:** 1. Records of Processing Activities (ROPA) 2. Legitimate Interest Assessments 3. Consent records and mechanisms 4. Privacy notices (versioned) 5. Data Subject Request log 6. Breach notification procedures

Examples

Example 1: Marketing Email Consent Flow

**Input:**

Design a GDPR-compliant consent flow for:
- SaaS product newsletter
- Product updates
- Promotional offers
- Third-party partner offers

**Output:**

## GDPR-Compliant Email Consent Flow

### Consent Collection UI

---

**Signup Form Fields:**

Email: [________________]

[ ] I agree to receive the monthly newsletter with industry insights [ ] I agree to receive product updates and feature announcements [ ] I agree to receive promotional offers and discounts [ ] I agree to receive relevant offers from our trusted partners

[Sign Up]

By signing up, you confirm you've read our [Privacy Notice]. You can withdraw consent anytime via unsubscribe link or contacting us.

**Design Requirements:**
- All checkboxes unchecked by default
- No "select all" option
- Each purpose separate
- Privacy notice linked, not buried
- No dark patterns

---

### Consent Record Structure

```json
{
  "email": "user@example.com",
  "consents": [
    {
      "purpose": "newsletter",
      "granted": true,
      "timestamp": "2026-01-31T10:30:00Z",
      "source": "signup_form_v3",
      "notice_version": "privacy_v2.1"
    },
    {
      "purpose": "product_updates",
      "granted": true,
      "timestamp": "2026-01-31T10:30:00Z",
      "source": "signup_form_v3",
      "notice_version": "privacy_v2.1"
    },
    {
      "purpose": "promotional",
      "granted": false,
      "timestamp": null,
      "source": null,
      "notice_version": null
    },
    {
      "purpose": "third_party",
      "granted": false,
      "timestamp": null,
      "source": null,
      "notice_version": null
    }
  ],
  "ip_address": "1