Start from the Privacy & Data Protection project template in Manager: processing records, DPIAs, data subject requests, breaches and processors in one project. Built around the GDPR; the legal assessment stays with you.
Each activity carries lawful basis, data categories, retention and owner: your Art. 30 record.
Requests get a Due date one month out; Open DSARs and Open Breaches show what is running.
Each processor has its DPA, sub-processors and transfer mechanism on record.
The GDPR governs personal data about people in the EU. Article 5 sets the principles; each processing needs one of six lawful bases (Art. 6). Records of processing (Art. 30) and DPIAs for high risk (Art. 35) show you comply.
People may request access, erasure and more, answered within one month (Art. 12). Breaches go to the supervisory authority within 72 hours unless unlikely to pose a risk (Art. 33), and to those affected if the risk is high (Art. 34).
Where each duty of the regulation lives in your project.
| GDPR | In Manager |
|---|---|
| Records of processing (Art. 30) | Processing Activity items with Role, Lawful Basis, Data Categories, Retention and Owner. |
| DPIA (Art. 35) | A DPIA item linked to its Processing Activity; mitigations are child Action Items. |
| Data subject rights (Art. 12-23) | A DSAR item with Request Type, Received and Due. |
| Breach notification (Art. 33-34) | A Breach item with Severity, Notifiable (Yes, No, TBD) and Detected. |
| Processors and transfers (Art. 28, Chapter V) | A Processor item with Sub-processors, DPA Owner and Transfer Mechanism (None, SCC, Adequacy, BCR). |
| Accountability (Art. 5(2)) | The privacy-review skill, dated wiki pages, item Activity and the audit log. |
Connect your AI agent over MCP; it creates the project from the template.
Say to your agentManager: Create a project from the Privacy & Data Protection template.
Record each activity with its purpose, lawful basis and retention; run a DPIA where risk is high.
Say to your agentManager: Run the ropa skill and interview me about how we process personal data.
Record each vendor handling personal data, and sign the DPA before any data flows.
Say to your agentManager: Run processor-management and ask me which vendors handle personal data for us.
Log each request; the agent sets its Due date, you verify identity and fulfill it.
Say to your agentManager: Run dsar-handling for the request that just came in.
Log a breach the moment you learn of it, assess the risk and decide who must be notified.
Say to your agentManager: We may have a data breach, so run breach-response now and ask me what happened.
A project created from the Privacy & Data Protection template starts with these work item types and statuses. You can adapt all of them to your team later.
An entry in the record of processing (Art. 30).
An impact assessment for high-risk processing (Art. 35).
A data subject request with its statutory deadline.
A personal data breach on the 72-hour clock (Art. 33/34).
A processor with its DPA and transfer mechanism (Art. 28).
The default type: a follow-up task.
These skills come with the template in Manager:
privacy-principlesThe reference: principles, lawful bases, rights.
ropaBuild and publish the record of processing.
dpiaScreen, assess, mitigate, approve.
dsar-handlingDeadline, identity check, fulfillment.
breach-responseAssess, notify, record who was told when.
processor-managementDPA, transfers, clean offboarding.
consent-retentionConsent checks, retention, erasure.
privacy-reviewPeriodic check for stale records and missed deadlines.
The template organizes the work. Whether a lawful basis holds or a breach is reportable is yours to decide, with your data protection officer or counsel.
Attach signed DPAs and notifications as proof, but keep the person's data out of DSAR items. Activity and the audit log show who decided what.
A breach is usually a security incident too; in the app, link it to a Risk or Finding in an ISMS project.
Open DSARs and Open Breaches show what is running, and each item's Activity shows what was decided and when.
Get early access