Search the docs, videos, blog, apps, teams, skills and release notes.
At a glance
What it is
Produce a GDPR data-processing assessment, an Article 28 controller-to-processor DPA, or a sub-processor disclosure, covering lawful basis, transfer mechanism (SCCs and the transfer impact assessment), DPIA triggers, retention, and the data-subject-rights workflow.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
Each of these library teams gives its bots this skill. Import one and look inside first.
The whole file, exactly as it downloads. Read it before you rely on it.
SKILL.md
175 lines · 1,256 words
Templates only - not legal advice. Have an attorney review before signing or distributing.
Three modes:
Assess mode - answer "is this data flow GDPR-compliant?" with a structured analysis
DPA mode - generate a Data Processing Agreement template (Article 28-compliant)
Produce a GDPR data-processing assessment, an Article 28 controller-to-processor DPA, or a sub-processor disclosure, covering lawful basis, transfer mechanism (SCCs and the transfer impact assessment), DPIA triggers, retention, and the data-subject-rights workflow.
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for
Paste it into your agent's instructions (CLAUDE.md, AGENTS.md or a custom GPT), or add it to a bot in Murage.
Ask Ember for the bot, then switch the skill on in its settings.
Step 1
Send your Chief of Staff this message. It proposes the bot and its role first, and creates it when you say go.
Send this to Ember
“Create a bot that uses the Legal - GDPR / Data-Processing Toolkit skill, and show me the plan first.”
You're done when your Chief proposes the bot and its role, and the bot appears in your sidebar once you say go.
Step 2
You're done when you see the bot’s skills and the library.
Step 3
You're done when the skill shows as on for that bot.
Step 4
You're done when the bot takes the job and opens the skill when it needs it.
Prefer to do it yourself? Choose + in the sidebar, then New Bot.Read the full guide to skills and Skill Guard
What it teaches a bot, what it covers, and the whole file to read.
The principle
Three modes:
What it covers
Required inputs (ask upfront)
Assess mode
DPA mode
DPIA mode
Cross-border transfer cautions
Output footer (REQUIRED on every generated document)
DPIA mode - assess whether a Data Protection Impact Assessment is required, and scaffold one if so
Important: GDPR is enforced by 27 different national supervisory authorities, each with their own guidance. This skill produces structured outputs, not advice. A privacy attorney must review.
Jurisdiction - primary country + state/province (default flagged: EU member state)
Industry - affects special category data, retention requirements
Mode - assess / DPA / DPIA
Role - controller / processor / joint-controller
User geography - which EU/UK regions hold data subjects? Are non-EU subjects involved?
Data categories - basic / special category (Art. 9) / criminal-conviction (Art. 10) / children
Cross-border transfers - does data leave the EEA? to which countries? under what mechanism?
Sub-processors - list (name, location, purpose)
Retention - by category
Produce a table:
| Field | Detail |
|---|---|
| Personal data category | (e.g., name, email, IP, health) |
| Source | Direct / third party / public |
| Lawful basis | Consent / contract / legal obligation / vital interests / public task / legitimate interests |
| Purpose | What you use it for |
| Recipients | Internal teams, sub-processors, third-party recipients |
| Retention | Period + deletion trigger |
| International transfer? | Yes/no; mechanism if yes |
| Special category? | Yes (Art. 9) / no |
| Children? | Yes/no |
For each row, evaluate:
Lawful basis adequacy: is the chosen basis valid for the purpose? (e.g., consent for marketing must be opt-in, freely-given, specific, informed, unambiguous; legitimate-interests balancing test must be documented)
Purpose limitation: is data used only for the stated purpose, or repurposed?
Data minimization: is the data collected the minimum necessary?
Accuracy / rectification: is there a process to correct?
Storage limitation: retention defined and enforced?
Integrity / confidentiality: security measures appropriate?
Accountability: documented in RoPA (Art. 30)?
Transparency: disclosed in the privacy notice?
DSR rights: workflow exists for access / erasure / portability / restriction / objection / automated-decision rights?
Children: parental consent (Art. 8) under 16 (varies 13-16 by member state)?
Special category: explicit consent or other Art. 9(2) basis?
Save to gdpr-assess-<flow>-<date>.md in the workspace. Include:
Executive summary (1-2 sentences: COMPLIANT / GAPS / NON-COMPLIANT)
Data flow map (Step 1 table)
Compliance check (Step 2 results, with severity per gap)
Remediation plan (priority order)
DPIA recommendation (yes/no + rationale)
Footer (disclaimer block - see below)
DPAs flow controller → processor. Confirm which side the user is on. If they're a processor (e.g., a SaaS company taking customer data), they need an "outbound" DPA template they offer to customers. If a controller (e.g., a business buying SaaS), they need a "vendor DPA" template they require sub-processors to sign.
Required Article 28 elements:
Subject matter and duration of processing
Nature and purpose of processing
Type of personal data processed
Categories of data subjects
Obligations and rights of controller
Processor obligations:
Process only on documented controller instructions
Confidentiality of processing personnel
Implement appropriate technical and organizational measures (Art. 32)
Engage sub-processors only with controller's prior written authorization (specific or general with right to object)
Assist controller with DSRs
Assist controller with security, breach notification, DPIA, and prior consultation obligations
Delete or return data at end of services (controller's choice)
Provide controller with information necessary to demonstrate compliance + allow audits
Sub-processor terms (flow-down: same data-protection obligations)
International transfer mechanism - append SCCs (2021/914) module 2 or 3 as applicable; UK Addendum if UK data; Swiss Addendum if Swiss data
Security measures - Annex II (technical and organizational measures)
Data breach notification - processor must notify controller "without undue delay" (recommend 24-48h)
Save to dpa-<counterparty>-<date>.md in the workspace.
DPIA is mandatory under Art. 35 when processing is "likely to result in a high risk." Mandatory triggers:
Systematic and extensive evaluation / profiling with legal or similarly significant effects
Large-scale processing of special categories or criminal-conviction data
Systematic monitoring of publicly accessible areas at scale
National supervisory authorities have published "DPIA always required" lists (e.g., CNIL, ICO, DSK). Cross-check the user's flow.
If no mandatory trigger but processing is novel / large-scale / uses new tech / involves vulnerable groups, recommend DPIA as best practice.
Required content:
Description of processing (purposes, categories, recipients, retention, transfers)
Necessity and proportionality - why this data, why this scope, alternatives considered
Consultation - DPO, data subjects (where appropriate), supervisory authority (Art. 36 prior consultation if residual risk is high)
Risks to data subjects - likelihood × severity for each identified risk
Measures to address risks - technical and organizational
Sign-off - DPO and accountable executive
Save to dpia-<flow>-<date>.md in the workspace.
After Schrems II (CJEU 2020), every transfer of EU personal data to a non-adequacy country requires:
A valid transfer mechanism (SCCs 2021/914, BCRs, derogations Art. 49)
A Transfer Impact Assessment (TIA) documenting that the destination's law and practice do not undermine the SCC protections
Supplementary measures where required (encryption, pseudonymization, contractual additions)
For US transfers: the EU-US Data Privacy Framework (DPF, July 2023) restored adequacy for certified US importers. UK and Swiss extensions exist but are separate frameworks.
These are technical and shifting - flag prominently for counsel.
End every generated GDPR document with this block, verbatim:
---
**DRAFT - NOT LEGAL ADVICE**
This document was generated as a starting template. It has not been reviewed by an attorney and may not comply with applicable law in your jurisdiction. Before signing, distributing, or relying on this document, you must:
1. Have a qualified attorney licensed in your jurisdiction review and revise it.
2. Verify all clauses are enforceable under applicable law.
3. Confirm it fits your specific situation, parties, and use case.
Generated by Wayland business-legal plugin. No warranty, express or implied.Templates only - not legal advice. GDPR enforcement is jurisdiction-by-jurisdiction; engage qualified privacy counsel.
SKILL.md
175 lines · 1,256 words
The text of SKILL.md is shown as it downloads, under the Apache-2.0 license, by Ferrox Labs. The license is the one in the file's own frontmatter.
Your new bot
Legal - GDPR / Data-Processing Toolkit bot
Waiting in your sidebar once you say go.
No account needed · Runs on the AI plan you already pay for