ropa-first-draft
From the author
Use this skill when a company needs its record of processing activities for the first time, or has one that is really a list of tools, and asks "build our RoPA", "records of processing", "data map for GDPR", "Article 30 record", "what personal data do we process and why", "data inventory for privacy" or "our DPO needs a processing register". Drafts the record by processing activity from systems, vendors and team interviews, with purposes, data and subject categories, proposed legal bases, recipients, transfers and concrete retention, plus a separate processor record when the company processes data for customers, and a notes file of open questions per owner.
Install
npx skills add better-isms/grcskills --skill ropa-first-draft -a claude-code
Installs to .claude/skills/ropa-first-draft/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 82
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- soa-first-draftbetter-isms/grcskillsUse this skill when a company has a risk assessment and treatment plan and now needs its first statement of applicability, and asks "build our SoA", "draft the statement of applicability", "which controls apply to us", "SoA from the risk treatment plan", "justify inclusions and exclusions" or "our SoA says implemented everywhere". Drafts one row per control of the reader's framework with the inclusion decision, the risk or obligation behind it, an implementation status taken from records, an evidence pointer and an owner role, and writes a CSV statement plus notes of open decisions.Data★ 51
- privacy-policy-draftingseb1n/awesome-ai-agent-skillsDraft privacy-policy language and a review checklist tailored to a business model, data practices, and relevant jurisdictions. Use when the user requests a privacy policy or needs to map disclosures for GDPR, CCPA, or similar frameworks; do not use it to guarantee legal compliance.Legal★ 229
- gdprThomasMoreAI/legal-skills-openUse when the user asks about GDPR — lawful bases for processing, data subject rights (DSRs), Records of Processing Activities (ROPA, Article 30), Data Protection Impact Assessments (DPIA, Article 35), international data transfers (SCCs, adequacy, TIA), controller vs processor obligations, breach notification (Articles 33–34), or DPO appointment. For controllers, processors, and sub-processors operating in the EU/EEA or targeting EU residents.Legal★ 95
- security-policy-draftingbetter-isms/grcskillsUse this skill when a company needs its information security policy set written or rebuilt, or asks "write our security policies", "draft the information security policy", "we need policies for the audit", "policy pack for a startup", "our template policies are 40 documents nobody reads" or "which policies do we actually need". Maps the policy set to the company's size and owners, drafts the top-level policy and the topic policies in testable language that reflects what the company does, flags commitments that need a decision, and prepares the approval and communication record for leadership.Security★ 51
- risk-register-first-passbetter-isms/grcskillsUse this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what are our top risks", "risk register from scratch", "our auditor wants a risk assessment" or "turn our incidents and findings into risks". Drafts 20 to 40 company-specific risk scenarios from the material the agent can reach, scores them against an agreed method, proposes owners and treatments, and writes a CSV register plus a notes file of assumptions and questions for owners.Security★ 51
- risk-treatment-plan-draftingbetter-isms/grcskillsUse this skill when a risk register has treatment decisions but no plan anyone can execute, or when someone asks "write the risk treatment plan", "turn the risk register into actions", "what do we do about our high risks", "treatment plan for the auditor", "budget the security roadmap from the risks" or "our treatment plan is just a list of controls". Turns each reduce, avoid or transfer decision into dated actions with an owner, budget, dependency and the record that will prove it was done, states the expected residual score and why, and adds interim measures for risks that stay high while the work runs. Writes a CSV plan and a short notes file.Planning★ 51
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in