skills.rest
microsoft
microsoftOFFICIAL
Explore all skills by this author →
Website𝕏@OpenAtMicrosoftGitHub

privacy-standards

Maps privacy standards, data-flow heuristics, and DPIA thresholds for planning reviews.

1.4k|284|Updated Nov 2, 2025
Search Tags:#NIST#gdpr#ccpa#Privacy#Data Governance#compliance planning#dPIA
One-click install
npx skills add https://github.com/microsoft/hve-core --skill privacy-standards
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: privacy-standards
Source: https://github.com/microsoft/hve-core/tree/main/.github/skills/project-planning/privacy-standards
Command: npx skills add https://github.com/microsoft/hve-core --skill privacy-standards

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Privacy reviews often stall because teams lack a consolidated reference for standards like GDPR, CCPA/CPRA, NIST Privacy Framework, NISTIR 8062, and OWASP privacy risks, making it hard to reason about data flows, decide when a DPIA is warranted, and cite stable source references.

Core Features & Use Cases

  • Standards Reference Library: Provides paraphrased, attributed summaries of NIST Privacy Framework, NISTIR 8062, GDPR, CCPA/CPRA, and OWASP Top 10 Privacy Risks with suggested citation fields for findings.
  • DPIA Threshold Heuristics: Supplies practical triggers for deciding when a data protection impact assessment or deeper legal review is warranted.
  • Data Governance Controls: Defines classification tiers, role-aware redaction, tiered retention, and tamper-evident audit expectations for release-readiness reviews.
  • Use Case: A privacy planner reviewing a new feature that collects location data can map the data lifecycle, check DPIA triggers under GDPR Art. 35, and record findings with citation fields like gdpr_article and nist_pf_category for the reviewer handoff.

Quick Start

Ask the privacy planner to assess whether the proposed data collection workflow requires a DPIA and which controls apply.

Frequently Asked Questions about privacy-standards

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decide when a DPIA is required for a new feature?▼

A DPIA is typically warranted when processing involves sensitive data, large-scale profiling or automated decisions, cross-organizational sharing, or novel hard-to-reverse controls. The DPIA threshold heuristics align with GDPR Art. 35 high-risk criteria and help decide whether to escalate to a formal assessment or legal review.

What privacy standards does this reference cover?▼

It covers the NIST Privacy Framework v1.0, NISTIR 8062 privacy engineering objectives, GDPR, CCPA/CPRA, and the OWASP Top 10 Privacy Risks. Each standard is paraphrased with attribution and paired with a suggested citation field for recording findings.

How do I classify data for privacy planning?▼

Use the five classification tiers: Public, Internal, PII, Sensitive-PII, and Regulated. Each tier maps to a control posture, from no special handling for public data to redaction, strict access, and DPIA triggers for sensitive or regulated data.

Does this skill provide legal advice for GDPR or CCPA compliance?▼

No. It is a planning aid that summarizes standards for privacy reasoning and review preparation. It explicitly does not substitute for qualified legal counsel or formal regulatory interpretation.

What citation fields should I use when recording privacy findings?▼

Use gdpr_article, ccpa_section, nist_pf_category, nistir8062_objective, and owasp_privacy_id. These fields let reviewers assert a stable source-control reference for each finding, control, or risk.

Related Skills

Explore More Legal & Compliance Skills→
spqwspqw

observable-framework-telemetry

Explain Observable Framework telemetry collection and disable it via environment variables.

Community
Basic
evolution-foundationevolution-foundation
520

ops-compliance-tracking

Track LGPD compliance requirements and audit readiness for Evolution API operations.

Official
Intermediate
jlawsjlaws
2

cmd-security-audit

Run STRIDE threat modeling and SAST vulnerability scans on codebases.

Community
Advanced
orqesaorqesa

conflict_resolution

Investigate workplace conflicts and document findings with legal compliance guidance.

Official
Advanced