— Risk & Compliance
Assesses personal-data processing and cross-border transfers against privacy policy and jurisdiction rules, producing a documented approval outcome with conditions, policy evidence and grounds for referral.
1–2 hours → ~5 minutes
For one document, brief or record at a time
No coding required
— USE CASES
Assesses a proposed activity against applicable privacy requirements, covering purpose, data categories, lawful basis, retention and security. Provides an approval note that distinguishes acceptable processing from proposals requiring conditions, specialist review or a stop.
Examines origin and destination countries, recipients and the proposed transfer mechanism against policy restrictions and jurisdiction guidance. Identifies unsupported restricted transfers and prohibited destinations, with the relevant policy evidence.
Checks proposals involving special-category or children's data for relevant safeguards and impact-assessment requirements. Flags missing special-category conditions or required data protection impact assessments as barriers to approval.
Provides a clause-supported record of the decision, conditions, mandatory checks and open questions. Makes the basis for approval or referral visible to privacy reviewers without treating missing evidence as clearance.
Privacy decisions become difficult to defend when processing details, transfer restrictions and internal policy are considered inconsistently. New personal-data processing is the typical trigger — assesses a proposed activity against applicable privacy requirements, covering purpose, data categories, lawful basis, retention and security. Provides an approval note that distinguishes acceptable processing from proposals requiring conditions, specialist review or a stop. Done properly it is defensible; done at pace it becomes a judgement call nobody can retrace. And "properly" usually means 1–2 hours of manual work.
Skillsize turns that work into a Skill: you supply the material, and what comes back is approval note with an outcome of Approve, Approve with conditions, Refer to DPO or Do not proceed, with conditions attached to the approval outcome. The criteria, ordering and review points that make the answer trustworthy are encoded in the Skill itself — which is the difference between a structured method and a prompt someone pastes in. The practical effect: 1–2 hours of manual work becomes a ~5 minutes run, held to an identical standard on the tenth engagement as on the first.
Privacy / Data-Transfer Approval exports as a structured SKILL.md file and is MCP-ready, so the same method runs in ChatGPT, Claude, Copilot or your own AI products. Adapt it to your methodology, and the intelligence stays yours — not locked to one vendor.
Assesses a data subject access request end to end and returns a governed decision on whether to fulfil it, fulfil it in part, refuse it with reasons or extend the deadline, having verified identity, mapped the request to the systems that actually hold the data and held the outcome for a data protection sign-off before anything is disclosed.
Pairs a full evidence set against every audit assertion or PBC item to produce a coverage matrix, naming the assertions nothing supports and the documents supporting nothing.
Fans multiple audit or review reports into individual findings, deduplicates repeats, and sorts them by severity into one consolidated register with sources retained.
Extracts documented controls and framework requirements, then grades every requirement covered, partial or absent for SOC 2 or ISO 27001 readiness.
Runs a scored risk and control self-assessment questionnaire and calculates residual risk identically every time, producing a register comparable across teams and quarters.
Researches a named regulation live, extracts every obligation with its clause reference, and maps each one against your own policies and controls to produce an obligation-level gap report with owners.
