CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

gdpr-data-handling

Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design. Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews.

60

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./plugins/hr-legal-compliance/skills/gdpr-data-handling/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

51%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured overview with excellent progressive disclosure, but it spends much of its budget restating GDPR fundamentals Claude already knows and offers no sequenced, executable workflow for the processes it covers. Moving the textbook article listings into the reference and adding a short DSR/consent step sequence with validation checkpoints would lift the weakest dimensions.

Suggestions

Trim the Article 6 lawful-bases tree and Article 15-21 rights listing to a compact non-obvious summary (or move them to references/details.md), keeping only guidance Claude would not already know such as the protection-level table.

Add a short numbered workflow in the body for the highest-frequency process — e.g. handling a data subject request from intake to response — with explicit validation checkpoints, since erasure and restriction are destructive operations.

Make the body's guidance more executable by including a few concrete specifics (e.g. consent record fields to store, retention-policy enforcement approach) rather than deferring all implementation detail to the reference.

DimensionReasoningScore

Conciseness

The Article 6 lawful-bases tree and the Article 15-21 rights listing restate standard GDPR knowledge Claude already has, so the body includes unnecessary explanation even though the protection-level table and Do's/Don'ts add value. Matches the "mostly efficient but includes some unnecessary explanation" anchor; not 2 because there is no heavy padding, not 4 because the core-concepts section could be trimmed to non-obvious details.

3 / 5

Actionability

The Do's/Don'ts give concrete policy directives ("Don't pre-check consent boxes", "30-day response required", "SCCs or adequacy decisions") but the body contains no executable steps, commands, or implementation specifics — all of those are deferred to references/details.md. Fits the "some concrete guidance but incomplete; missing key details" anchor rather than the mostly-executable anchor 4.

3 / 5

Workflow Clarity

The body presents no sequenced workflow at all — no consent-capture flow, no DSR response steps, no validation checkpoints — despite covering destructive operations like erasure. It scores above the incoherent anchor 1 only because process constraints ("Must respond within 1 month") are present; it lacks even the rough sequence of anchor 3.

2 / 5

Progressive Disclosure

The body is a well-sectioned overview that points to a single one-level-deep reference ("Detailed sections (starting with `## Implementation Patterns`) live in `references/details.md`"), which was verified to exist and to contain the promised section header. Clear split, easy navigation, well-signaled reference — matches the top anchor.

5 / 5

Total

13

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it names concrete capability areas, includes an explicit and specific 'Use when...' clause with natural trigger terms, and occupies a well-delineated GDPR niche. Minor gaps in capability coverage and trigger synonyms keep specificity and trigger quality at 4 rather than 5.

DimensionReasoningScore

Specificity

Names the GDPR domain plus several specific capability areas — "consent management, data subject rights, and privacy by design" — matching the anchor that lists several specific actions with minor gaps. Not 5 because notable capabilities (retention, breach notification, DPAs) are absent; not 3 since more than 1-2 concrete actions are named.

4 / 5

Completeness

Explicitly answers both questions: the what ("Implement GDPR-compliant data handling with consent management, data subject rights, and privacy by design") and the when ("Use when building systems that process EU personal data, implementing privacy controls, or conducting GDPR compliance reviews") with concrete trigger phrases. This matches the top anchor; not 4 because the when-clause is already explicit and specific.

5 / 5

Trigger Term Quality

"GDPR", "EU personal data", "consent", "privacy controls", and "compliance reviews" are natural terms users would say, giving good coverage. A few common variations are missing ("data subject requests", "right to erasure", "data protection"), so it falls short of the comprehensive-synonym anchor 5.

4 / 5

Distinctiveness Conflict Risk

"GDPR-compliant", "EU personal data", and "data subject rights" establish a clear niche with distinct triggers and minimal conflict risk against generic document, code, or security skills. Not 4 because the triggers are strongly discriminating rather than merely "mostly distinct".

5 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

wshobson/agents

Path

plugins/hr-legal-compliance/skills/gdpr-data-handling/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.