diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 5c32d5e..351a332 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -20,7 +20,7 @@ { "name": "agentic-engineering", "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md", - "version": "7.5.0", + "version": "7.6.0", "source": "./plugins/agentic-engineering" }, { diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json index 5c32d5e..351a332 100644 --- a/.github/plugin/marketplace.json +++ b/.github/plugin/marketplace.json @@ -20,7 +20,7 @@ { "name": "agentic-engineering", "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md", - "version": "7.5.0", + "version": "7.6.0", "source": "./plugins/agentic-engineering" }, { diff --git a/docs/plugins.md b/docs/plugins.md index 88eb5de..da59bae 100644 --- a/docs/plugins.md +++ b/docs/plugins.md @@ -6,7 +6,7 @@ A **skill** teaches an assistant a task. An **agent** gives it a specialized rol | Plugin | Resources | Description | |--------|-----------|-------------| -| [`agentic-engineering`](../plugins/agentic-engineering/) | `accessibility-review`, `agent-improvement`, `agent-instructions`, `application-security`, `architecture`, `audit-support`, `autofix`, `brand-review`, `campaign-plan`, `check-skills`, `close-management`, `code-review`, `codeql`, `competitive-brief`, `connector-setup`, `content-creation`, `context7-mcp`, `conventional-release`, `debug`, `dependabot`, `dependency-scanning`, `deploy-checklist`, `design-critique`, `design-handoff`, `design-system`, `documentation`, `draft-content`, `email-sequence`, `financial-statements`, `find-skills`, `frontend-design`, `gh-cli`, `gh-stack`, `git-commit`, `github-actions-docs`, `github-actions-efficiency`, `github-actions-hardening`, `github-issues`, `gitops-cluster-debug`, `gitops-knowledge`, `gitops-tenant-onboarding`, `golang-pro`, `grilling`, `incident-response`, `journal-entry`, `journal-entry-prep`, `memory-management`, `metrics-review`, `performance-report`, `portfolio-maintenance`, `product-brainstorming`, `product-documentation`, `product-engineering`, `prometheus`, `promql`, `prototype`, `reconciliation`, `refactor`, `research-synthesis`, `roadmap-update`, `secret-scanning`, `self-improvement`, `seo-audit`, `siderolabs`, `skill-lifecycle`, `sox-testing`, `sprint-planning`, `stakeholder-update`, `standup`, `start`, `stripe-best-practices`, `stripe-docs`, `svelte-core-bestpractices`, `synthesize-research`, `system-design`, `task-management`, `tech-debt`, `test-driven-development`, `testing-strategy`, `update`, `upgrade-stripe`, `user-research`, `ux-copy`, `variance-analysis`, `ways-of-working`, `web-design-guidelines`, `workspace-conventions`, `write-contributing`, `write-docs-introduction`, `write-readme`, `write-spec` (skills) · `agent-improver`, `agentic-engineer`, `flux-troubleshooter`, `portfolio-surveyor` (agents) · `aws-knowledge`, `cloudflare-docs`, `context7`, `coroot`, `flux-operator-mcp`, `github`, `github-ghas-tools`, `kubescape`, `siderolabs-docs`, `stripe`, `svelte`, `terraform-registry` (MCP servers) | The autonomous engineering system for a whole repository portfolio, and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; operating, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use. Configured by the consumer's `AGENTS.md` | +| [`agentic-engineering`](../plugins/agentic-engineering/) | `accessibility-review`, `agent-improvement`, `agent-instructions`, `application-security`, `architecture`, `audit-support`, `autofix`, `brand-review`, `campaign-plan`, `check-skills`, `close-management`, `code-review`, `codeql`, `competitive-brief`, `connector-setup`, `content-creation`, `context7-mcp`, `conventional-release`, `danish-business-rules`, `debug`, `dependabot`, `dependency-scanning`, `deploy-checklist`, `design-critique`, `design-handoff`, `design-system`, `documentation`, `draft-content`, `email-sequence`, `financial-statements`, `find-skills`, `frontend-design`, `gh-cli`, `gh-stack`, `git-commit`, `github-actions-docs`, `github-actions-efficiency`, `github-actions-hardening`, `github-issues`, `gitops-cluster-debug`, `gitops-knowledge`, `gitops-tenant-onboarding`, `golang-pro`, `grilling`, `incident-response`, `journal-entry`, `journal-entry-prep`, `memory-management`, `metrics-review`, `performance-report`, `portfolio-maintenance`, `privacy-engineering`, `product-brainstorming`, `product-documentation`, `product-engineering`, `prometheus`, `promql`, `prototype`, `reconciliation`, `refactor`, `research-synthesis`, `roadmap-update`, `secret-scanning`, `self-improvement`, `seo-audit`, `siderolabs`, `skill-lifecycle`, `sox-testing`, `sprint-planning`, `stakeholder-update`, `standup`, `start`, `stripe-best-practices`, `stripe-docs`, `svelte-core-bestpractices`, `synthesize-research`, `system-design`, `task-management`, `tech-debt`, `test-driven-development`, `testing-strategy`, `update`, `upgrade-stripe`, `user-research`, `ux-copy`, `variance-analysis`, `ways-of-working`, `web-design-guidelines`, `workspace-conventions`, `write-contributing`, `write-docs-introduction`, `write-readme`, `write-spec` (skills) · `agent-improver`, `agentic-engineer`, `flux-troubleshooter`, `portfolio-surveyor` (agents) · `aws-knowledge`, `cloudflare-docs`, `context7`, `coroot`, `flux-operator-mcp`, `github`, `github-ghas-tools`, `kubescape`, `siderolabs-docs`, `stripe`, `svelte`, `terraform-registry` (MCP servers) | The autonomous engineering system for a whole repository portfolio, and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; operating, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use. Configured by the consumer's `AGENTS.md` | | [`vibe-coding`](../plugins/vibe-coding/) | `needs-stack-mapping`, `allowed-stack-guardrail`, `jargon-free-voice` (skills) · `vibe-coding-companion` (agent) | Build a product by conversation alone — plain-language companion agent + guardrailed needs-to-stack skills for people with no technical background | | [`ksail`](../plugins/ksail/) | `ksail` (skill) · `ksail` (MCP server) | Create and operate Kubernetes clusters and GitOps workloads with the KSail CLI — needs `ksail` on `PATH`; PolyForm Shield licensed | @@ -37,6 +37,7 @@ license file the plugin ships; keep both when you copy or redistribute those ski | `content-creation` | `agentic-engineering` | anthropics/knowledge-work-plugins | Apache-2.0 | | `context7-mcp` | `agentic-engineering` | upstash/context7 | MIT | | `conventional-release` | `agentic-engineering` | devantler-tech/agent-plugins | Apache-2.0 | +| `danish-business-rules` | `agentic-engineering` | devantler-tech/agent-plugins | Apache-2.0 | | `debug` | `agentic-engineering` | anthropics/knowledge-work-plugins | Apache-2.0 | | `dependabot` | `agentic-engineering` | github/awesome-copilot | MIT | | `dependency-scanning` | `agentic-engineering` | github/copilot-advanced-security-plugin | MIT | @@ -70,6 +71,7 @@ license file the plugin ships; keep both when you copy or redistribute those ski | `metrics-review` | `agentic-engineering` | anthropics/knowledge-work-plugins | Apache-2.0 | | `performance-report` | `agentic-engineering` | anthropics/knowledge-work-plugins | Apache-2.0 | | `portfolio-maintenance` | `agentic-engineering` | devantler-tech/agent-plugins | Apache-2.0 | +| `privacy-engineering` | `agentic-engineering` | devantler-tech/agent-plugins | Apache-2.0 | | `product-brainstorming` | `agentic-engineering` | anthropics/knowledge-work-plugins | Apache-2.0 | | `product-documentation` | `agentic-engineering` | devantler-tech/agent-plugins | Apache-2.0 | | `product-engineering` | `agentic-engineering` | devantler-tech/agent-plugins | Apache-2.0 | diff --git a/docs/skill-coverage.md b/docs/skill-coverage.md index e074da7..0d336e8 100644 --- a/docs/skill-coverage.md +++ b/docs/skill-coverage.md @@ -32,8 +32,8 @@ This is an engineering inventory. It makes no legal or compliance claim. | Area | Portfolio use | Bundled resources | Gap | Importance | Decision | |---|---|---|---|---|---| -| Privacy and GDPR | [contact handling][bs-contacts], [customer identity][bs-identity] and [invoices][bs-invoices] in the business-site portal; [guest RSVPs][wa-schema] in wedding-app | none | all of it | High | **Owned** by [#638](https://github.com/devantler-tech/agent-plugins/issues/638) | -| Danish commerce, consumer and accessibility rules | client sites with service offerings and booking ([ascoachingogvaner][asc-agents]); [business-site invoicing][bs-invoices] | `web-design-guidelines` covers UI accessibility review, not Danish law | the legal rules | High | **Owned** by [#639](https://github.com/devantler-tech/agent-plugins/issues/639) | +| Privacy and GDPR | [contact handling][bs-contacts], [customer identity][bs-identity] and [invoices][bs-invoices] in the business-site portal; [guest RSVPs][wa-schema] in wedding-app | `privacy-engineering` (purpose, legal basis, retention, rights, providers, transfers, impact assessments, breach reporting, with Danish additions) | what the skill's [source list](../plugins/agentic-engineering/skills/privacy-engineering/references/sources.md) says it does not claim: disputed interpretation and sector rules (health, finance, telecoms). Each product still names its own data, its accountable person and where its record of processing is kept | High | **Covered** since 7.6.0 by the first-party `privacy-engineering` ([#638](https://github.com/devantler-tech/agent-plugins/issues/638)): no upstream candidate could be adopted, as the candidate table says | +| Danish commerce, consumer and accessibility rules | client sites with service offerings and booking ([ascoachingogvaner][asc-agents]); [business-site invoicing][bs-invoices] | `danish-business-rules` (which rules apply and to whom: cookies, marketing, purchase information, withdrawal, subscriptions, invoices, accessibility); `web-design-guidelines` for accessible UI | everything its [source list](../plugins/agentic-engineering/skills/danish-business-rules/references/sources.md) lists as not covered, among them the E-commerce Act, price labelling in detail, invoices to private customers, environmental claims, sales law, payment rules, sector rules and sales to other countries | High | **Covered** since 7.6.0 by the first-party `danish-business-rules` ([#639](https://github.com/devantler-tech/agent-plugins/issues/639)): no upstream skill for Danish rules exists | | Application security and tenant isolation | the [business-site customer portal][bs-identity], [KHoist's data product API][khoist-api], tenant apps on the shared platform | `application-security` (threat model, access rules, tenant isolation, webhooks, uploads, limits and the tests that prove them). CI and supply chain: `github-actions-hardening`, `codeql`, `secret-scanning`, `dependency-scanning`, `dependabot`. Cluster tenants: `gitops-tenant-onboarding` | none in guidance. Each product still writes its own isolation tests, and its own instructions name its roles and tenants | High | **Covered** since 7.5.0 by the first-party `application-security` ([#640](https://github.com/devantler-tech/agent-plugins/issues/640)): no upstream candidate could be adopted, as the candidate table says | | SvelteKit and TypeScript | business-site [`web/`][bs-web], [wedding-app][wa-pkg], [ascoachingogvaner][asc-pkg] | `svelte-core-bestpractices` and the `svelte` documentation server (documentation, autofixer and playground links), beside the framework-neutral `frontend-design` and `web-design-guidelines` | none for Svelte. TypeScript itself is not treated as a gap; if that needs checking, add a TypeScript case to #651 | Medium | **Covered** since 7.0.0 ([#652](https://github.com/devantler-tech/agent-plugins/issues/652)) | | Astro | the [KSail docs][ksail-docs] and the [KHoist website][khoist-web] | `product-documentation`, `write-docs-introduction` | Astro framework guidance: the `astro` skill left the bundle in 7.0.0 | Medium | **Not bundled.** The 7.0.0 entry in the plugin's [changelog][changelog] has the one command that installs `astro` from its upstream for work on these two sites | @@ -86,10 +86,13 @@ lists them: should-trigger, near-miss and over-trigger cases that #651's suite r | Application security | [`owasp-security`][c-agamm] | MIT, one maintainer | 2026-11-03 | Closest in content, with evaluation cases upstream. Its frontmatter uses a field the open skill format does not define, so the copy fails validation here unmodified, and its largest reference restates OWASP material under an MIT label | Rejected | | Application security | [`VibeSec-Skill`][c-vibesec] | Apache-2.0, one maintainer | 2026-02-17 | One long secure-coding file. Its name is not a valid skill name, so it fails validation unmodified | Rejected | | Application security | [the Trail of Bits collection][c-tob] | CC BY-SA 4.0, Trail of Bits | 2026-11-06 | Audit workflows for security researchers, not design guidance. Share-alike terms | Rejected for now: the licence review is #581's | -| Any gap | author a first-party skill | this repository | — | A maintained official candidate exists for every gap adopted so far. Application security is the one gap where none could be adopted, so `application-security` was built after the comparison above | Built only where the comparison rejects every candidate (#637's adoption-first workflow) | +| Privacy | [`gdpr-compliant`][c-ac] | MIT, github/awesome-copilot | 2026-03-30 | Engineering-focused and the closest fit, but it states coding preferences as legal duties, and two of the three reference files it links do not resolve | Rejected | +| Privacy | [`compliance-check`][c-kwp-legal] | Apache-2.0, Anthropic | 2026-11-09 | Written for an in-house legal team checking a business initiative across many jurisdictions; would not load for engineering work | Rejected | +| Privacy | [a collection of 824 privacy skills][c-mukul], [`secpriv-skill`][c-secpriv] | Apache-2.0 and MIT | 2026-03-16, 2026-10-06 | The first is too large to review for correctness. The second has no frontmatter, so it is not in the open skill format | Rejected | +| Danish rules | none found | — | — | Four repository searches on 2026-11-11 returned no skill for Danish or EU consumer, marketing or cookie rules | Built | +| Any gap | author a first-party skill | this repository | — | A maintained official candidate exists for every gap adopted so far. Application security, privacy and the Danish rules are the gaps where none could be adopted, so `application-security`, `privacy-engineering` and `danish-business-rules` were built after the comparisons above | Built only where the comparison rejects every candidate (the adoption-first workflow of #637) | -Candidates for privacy and Danish rules will be compared in #638 and #639, as the note under the -matrix says. The Sentry and [trailofbits/skills][c-tob] candidates above carry CC BY-SA 4.0 +The Sentry and [trailofbits/skills][c-tob] candidates above carry CC BY-SA 4.0 terms. Share-alike redistribution needs the review that [#581](https://github.com/devantler-tech/agent-plugins/issues/581) owns before anything under those terms is bundled. @@ -120,10 +123,11 @@ with SvelteKit and a Go server. An agent that trusts the card would choose `astr PR reports how many description characters it adds. 2. Application security and tenant isolation (#640). Covered in 7.5.0 by the first-party `application-security` skill. What remains is per product: the isolation tests themselves. -3. Privacy and GDPR (#638). Personal data in two products. +3. Privacy and GDPR (#638). Covered in 7.6.0 by the first-party `privacy-engineering` skill. 4. PostgreSQL schema and migrations (#653). Evaluated: the candidate was not adopted, so the gap stays open. -5. Danish commerce, consumer and accessibility rules (#639). +5. Danish commerce, consumer and accessibility rules (#639). Covered in 7.6.0 by the + first-party `danish-business-rules` skill, within the limits its source list states. 6. Prometheus and OpenTelemetry (#654). PromQL and alert rules adopted in 7.3.0; collector pipelines not added, as the matrix says. @@ -159,6 +163,9 @@ when an adoption issue above closes, or after #651's first two baselines. [c-ac]: https://github.com/github/awesome-copilot/tree/227949a7542a55d2155c00e7cdb998d9a0fee4f3/skills [c-agamm]: https://github.com/agamm/claude-code-owasp/tree/1ae29cb22518560e3625d77f2ae64f61647d9201/.claude/skills/owasp-security [c-vibesec]: https://github.com/BehiSecc/VibeSec-Skill/tree/0590993b35ad51961f65a4d01cf1196dfead05bb +[c-kwp-legal]: https://github.com/anthropics/knowledge-work-plugins/tree/e605d8ddbfb688da57dfaaceebd93f12a64ef1d3/legal/skills/compliance-check +[c-mukul]: https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/9b2ef9eae161c00a17241d42a388571321b33e9f +[c-secpriv]: https://github.com/facebookresearch/secpriv-skill/tree/70e1269a988cb401ac838164b3db9434ffa9f4ea [c-ch-pg]: https://github.com/ClickHouse/agent-skills/tree/d3b2b5ba43a8b80c2d08858b68d53edc701b5ace/skills/infra-postgres [c-bagel]: https://github.com/bagelhole/devops-security-agent-skills/tree/0365f57a079b1332f95cf26e31dd2d5332a8399f/devops/observability/opentelemetry [c-arsenal]: https://github.com/majiayu000/spellbook/tree/238e07625aeca5bcf0d6f7cb3e2d07f94c717194/skills/observability-sre diff --git a/plugins/agentic-engineering/.claude-plugin/plugin.json b/plugins/agentic-engineering/.claude-plugin/plugin.json index fd7df2f..5df3b2d 100644 --- a/plugins/agentic-engineering/.claude-plugin/plugin.json +++ b/plugins/agentic-engineering/.claude-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "agentic-engineering", "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md", - "version": "7.5.0", + "version": "7.6.0", "author": { "name": "devantler-tech", "url": "https://github.com/devantler-tech" diff --git a/plugins/agentic-engineering/.codex-plugin/plugin.json b/plugins/agentic-engineering/.codex-plugin/plugin.json index 00c64e1..f605816 100644 --- a/plugins/agentic-engineering/.codex-plugin/plugin.json +++ b/plugins/agentic-engineering/.codex-plugin/plugin.json @@ -1,7 +1,7 @@ { "name": "agentic-engineering", "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md", - "version": "7.5.0", + "version": "7.6.0", "author": { "name": "devantler-tech", "url": "https://github.com/devantler-tech" diff --git a/plugins/agentic-engineering/CHANGELOG.md b/plugins/agentic-engineering/CHANGELOG.md index 4e5fe69..e4ff8f0 100644 --- a/plugins/agentic-engineering/CHANGELOG.md +++ b/plugins/agentic-engineering/CHANGELOG.md @@ -1,5 +1,28 @@ # Changelog — `agentic-engineering` +## 7.6.0 — 2026-11-11 + +**Added** — two first-party skills for the rules around a product, both written from the +official texts and both careful to keep legal duties apart from recommendations. + +`privacy-engineering` helps an agent notice personal data in a change and handle it under the +GDPR and the Danish Data Protection Act: what is collected and why, the legal basis, retention, +people's rights, providers and transfers, impact assessments and breach reporting. It marks +each statement as law, authority practice or practice, names when a person has to decide, and +has worked checklists for a contact form, analytics, customer accounts, a new provider and +stored files (#638). + +`danish-business-rules` says which Danish rules a customer-facing site brings with it and +whether they apply: cookies, marketing messages, information before a purchase, the right to +withdraw, subscriptions, prices, invoices and accessibility. It starts from who the customer +is, gives each rule's section, and works through a brochure site, a consumer shop, a business +portal and a subscription checkout (#639). + +Neither skill gives legal advice or says that anything is compliant. Each lists its sources +with the date they were read, what it does not cover, and a review plan with the next review +due by May 2027. Upstream candidates were compared first for both and none could be adopted; +the comparison is on the coverage page. + ## 7.5.0 — 2026-11-10 **Added** — `application-security`, a first-party skill for the security decisions scanners cannot diff --git a/plugins/agentic-engineering/README.md b/plugins/agentic-engineering/README.md index 7d2f0a6..a3d3982 100644 --- a/plugins/agentic-engineering/README.md +++ b/plugins/agentic-engineering/README.md @@ -115,6 +115,7 @@ are maintained here. | Code review (CodeRabbit) | `code-review` (a local review with the CodeRabbit CLI), `autofix` (work through CodeRabbit's review threads on a pull request) | | Repository security | `dependency-scanning`, `dependabot`, `secret-scanning`, `codeql`, `github-actions-hardening`, `check-skills` (review a skill before installing it) | | Application security | `application-security` (a short threat model, access rules, tenant isolation, webhooks, uploads and limits, each with the test that proves it) | +| Privacy and Danish rules | `privacy-engineering` (personal data under the GDPR and Danish law, with law kept apart from recommendation), `danish-business-rules` (which Danish rules a shop, subscription, newsletter, cookie banner or invoice brings, and for whom) | | Library documentation | `context7-mcp` (current documentation for any library or framework, through the `context7` server) | | Go | `golang-pro` | | Kubernetes and GitOps | `gitops-cluster-debug`, `gitops-knowledge`, `gitops-tenant-onboarding`, `siderolabs` (Talos Linux and Omni) | diff --git a/plugins/agentic-engineering/plugin.json b/plugins/agentic-engineering/plugin.json index fd7df2f..5df3b2d 100644 --- a/plugins/agentic-engineering/plugin.json +++ b/plugins/agentic-engineering/plugin.json @@ -1,7 +1,7 @@ { "name": "agentic-engineering", "description": "The autonomous engineering system for repository portfolios and everything its agents need — engineer, read-only surveyor, meta-engineer and Flux troubleshooter agents; portfolio, product, spend and improvement workflows; GitHub, CodeRabbit review, security, library documentation, Go, Kubernetes, Flux, Talos, SvelteKit frontend, Stripe payments, engineering-practice, design, product-management, marketing, finance and productivity skills; and the MCP servers they use; configured by the consumer AGENTS.md", - "version": "7.5.0", + "version": "7.6.0", "author": { "name": "devantler-tech", "url": "https://github.com/devantler-tech" diff --git a/plugins/agentic-engineering/skills/danish-business-rules/SKILL.md b/plugins/agentic-engineering/skills/danish-business-rules/SKILL.md new file mode 100644 index 0000000..27a908f --- /dev/null +++ b/plugins/agentic-engineering/skills/danish-business-rules/SKILL.md @@ -0,0 +1,97 @@ +--- +name: danish-business-rules +description: Flag the Danish rules that apply to a customer-facing site, shop, subscription or invoicing flow - cookies, marketing messages, information before purchase, the right to withdraw, subscription terms, prices, invoices and accessibility - and whether each applies to consumers, businesses or both. Use for work on Danish sites and services. Not legal advice, and not for personal data or accessibility testing. +license: Apache-2.0 +--- + +# Danish business rules + +A site that sells, books, invoices or sends marketing in Denmark meets a handful of rules that +have nothing to do with code quality: what must be said before a purchase, when a customer may +change their mind, when a cookie needs a yes, what an invoice must show. They are easy to miss +because they sit in different acts with different authorities. This skill says which apply to +the change in front of you. It does not decide anything: the business that owns the site does, +through a named person. + +## What must not go wrong + +1. **Never say that a site is compliant, legal or approved.** Say which rules were checked, + what each requires and where it says so, and what a person still has to decide. +2. **Work out who the rules protect before listing them.** Most of these rules apply only + when the customer is a consumer. Some apply to everyone. The + [applicability questions](#which-rules-apply) come first. +3. **Keep law, authority practice and recommendation apart.** **Law** names its section. + **Authority practice** is an authority's published position. **Practice** is a + recommendation. Never present one as another. +4. **State only what the sources say.** Every rule in this skill was read in the source named + for it: the act, or where the table says so an authority's own guide. + If a question goes beyond it, say that it is not covered and escalate. Do not fill the gap + from memory. +5. **The business decides.** On a client's site the client is the trader the rules bind. You + flag, propose and record; the client's accountable person confirms. + +## When to use it, and when not + +Use it when a change to a Danish site or service: + +- adds or alters a checkout, booking, order or sign-up that costs money; +- adds a subscription, renewal or cancellation flow; +- shows prices or offers; +- adds analytics, tracking or anything else stored on the visitor's device; +- sends newsletters, offers or reminders; +- issues invoices or receipts; +- is a new site, or a site about to go live. + +Other questions have their own owner: + +| Question | Use instead | +|---|---| +| Personal data: purpose, retention, people's rights, providers | `privacy-engineering`, when installed | +| Who may see which record, sign-in, uploads, webhooks | `application-security`, when installed | +| How to test a page against accessibility criteria | an accessibility review skill; this skill only says whether the Danish act applies | +| Tax, contracts, sector rules (health, finance, food, alcohol, gambling) | not covered: escalate | + +## Which rules apply + +Answer these in order and write the answers in the pull request. + +1. **Who is the customer?** A consumer is a person acting mainly outside their trade. If the + site sells to consumers, the consumer rules below apply. If it sells only to businesses, + they do not, but the marketing, cookie, invoice and bookkeeping rules still do. If it sells + to both, treat the customer as a consumer unless the flow establishes otherwise: the trader + has to prove that a contract is not a consumer contract. +2. **Is a contract made online?** An order, booking or sign-up that obliges the customer to + pay brings the information, order-button and withdrawal rules. +3. **Is it ongoing?** A subscription or other running delivery adds rules on total cost, + termination and how to cancel. +4. **Is anything stored on or read from the visitor's device** beyond what the service + technically needs? Then consent comes first, whoever the visitor is. +5. **Does it send marketing by email, text message or similar?** Then prior consent, or the + narrow existing-customer exception, whoever the recipient is. +6. **Does the business issue invoices?** Then the invoice content and record-keeping rules. +7. **Does it sell to consumers online, and is the business more than a very small one?** Then + the accessibility act may apply. +8. **Whose site is it?** The trader is the business the customer deals with. Name it. + +The rules themselves, with their sections, are in [rules](references/rules.md). Worked +checklists for a brochure site, a consumer shop, a business portal and a subscription checkout +are in [scenarios](references/scenarios.md). The sources, the date each was read and what +this skill does not cover are in [sources](references/sources.md). + +## Escalate, do not decide alone + +Write **Needs a decision by** and the role when: + +- it is unclear whether customers are consumers, or which business is the trader; +- a flow removes or shortens the right to withdraw, or relies on an exception to it; +- a subscription binds the customer, renews, or changes price; +- marketing would be sent without a recorded consent; +- something is stored on the device before a yes, and someone calls it "necessary"; +- the business may be large enough for the accessibility act, or relies on an exemption; +- the question is about a rule this skill does not cover, or how a text is to be read. + +## What a change leaves behind + +The answers to the eight questions, the rules that follow from them with their sections, what +was built for each, what was left for a decision and who was asked. Never the word +"compliant". diff --git a/plugins/agentic-engineering/skills/danish-business-rules/references/rules.md b/plugins/agentic-engineering/skills/danish-business-rules/references/rules.md new file mode 100644 index 0000000..e2768ec --- /dev/null +++ b/plugins/agentic-engineering/skills/danish-business-rules/references/rules.md @@ -0,0 +1,121 @@ +# The rules, by topic + +Each row was read in the source named in [sources](sources.md), on the date given there. +"Who" says whom the rule protects: **C** consumers only, **B** business customers, +**Persons** natural persons, +**All** every visitor, recipient or customer. A section number is the act's own. Read the +section before relying on a summary. + +## Cookies and other device storage + +Act: the cookie order (BEK 1148 of 2011). Authority: the Agency for Digital Government. + +| Rule | Who | Law | +|---|---|---| +| Nothing is stored on, or read from, a visitor's device without consent given after adequate information | All | section 3(1) | +| The information is clear and easy to understand, says the purpose, says who stores or reads, and gives an immediate way to refuse or withdraw | All | section 3(2) | +| No consent is needed when storage only carries a transmission, or is technically required for a service the visitor expressly asked for | All | section 4 | + +**Practice.** Load nothing that needs consent before the yes. Make "no" as easy as "yes". +Keep the list of what is set, by whom and why, next to the code that sets it. A cookie that +keeps a login or a basket working fits the wording of the exception. Whether anything else +does is the business's call, and the authority's guidance is to be read first. + +## Marketing messages + +Act: the Marketing Practices Act (consolidated act 1420 of 2024). Authority: the Consumer +Ombudsman. + +| Rule | Who | Law | +|---|---|---| +| No direct marketing by electronic mail, automated calls or fax without prior consent. The person is told the consent can be withdrawn, and withdrawing is easy and free | All | section 10(1) | +| Exception: a business that got a customer's electronic address in a sale may market its own similar products to that customer, if the customer could decline, easily and free, when the address was given and in every later message | All | section 10(2) | +| Marketing by electronic mail is recognisable as marketing, says on whose behalf it is sent, and gives an address for stopping it | All | section 10(3) | +| Other channels to a named person, such as post: not when the person has declined, or is on the civil register's list of people who decline marketing | Persons | section 10(4) | +| No phone call or personal visit to a consumer to sell something unless the consumer asked for it first. The exceptions for phone calls are orders for books, subscriptions to newspapers and periodicals, insurance, and rescue or patient-transport subscriptions | C | Consumer Contracts Act, section 4 | +| Facts claimed in marketing can be documented | All | section 13 | + +**Authority practice** (the Consumer Ombudsman's published guidance on unsolicited +messages). The ban covers every recipient: consumers, businesses and public authorities. A +trader may not ask for consent by sending an email or text message. Consent is voluntary, +informed and specific: a pre-ticked box, or consent placed in the terms, is not valid, and a +purchase may not depend on it. The consent names the business, the channel and the kinds of +product. + +**Practice.** Record who consented, when, to what text and how. Put the unsubscribe link in +every message and honour it at once. + +## Before a consumer orders online + +Act: the Consumer Contracts Act (consolidated act 1184 of 2025). Authority: the Consumer +Ombudsman. + +| Rule | Who | Law | +|---|---|---| +| A contract is a consumer contract when the customer acts mainly outside their trade. The trader has to prove that it is not | C | section 2 | +| Before a distance contract, the consumer is told clearly: the main characteristics; who the trader is, with address, phone and email; the total price including taxes and delivery costs; for subscriptions and open-ended contracts the total cost per billing period; payment and delivery terms; whether there is a right to withdraw and how to use it, or that there is none; the contract's length, how to end it and any minimum period | C | section 8(1) | +| From 27 September 2026 the list is longer: environmentally friendly delivery options where there are any, the main elements of the legal guarantee, and a producer's durability guarantee of more than two years where one is offered, among others. The consolidated text read here predates this, so read the amending act for the full list and for what is shown just before the order | C | act 558 of 2025, amending sections 8 and 12 | +| Where the order is placed, it is stated clearly that it obliges the consumer to pay. The main characteristics, total price, cost per period, length and minimum period are shown prominently just before the order | C | section 12(1) | +| A button that places the order is labelled "ordre med betalingsforpligtelse" or similar, in an easily legible way | C | section 12(2) | +| If those two rules are not met, the consumer is not bound by the order | C | section 12(3) | +| After the order the consumer gets a confirmation of the contract on a durable medium, such as an email: within a reasonable time, and at the latest when the goods are delivered or before the service starts. It holds the pre-contract information unless that was already given on a durable medium | C | section 13(1) and (2) | +| An invitation to purchase gives the product's main characteristics, the trader's name and address, unusual payment or delivery terms, and any right to withdraw | C | Marketing Practices Act, section 6(2) | +| Prices to consumers are stated clearly, by rules set under the act | C | Marketing Practices Act, section 14 | + +**Practice.** Show the full price early, not only at the last step. Put the trader's +identity on every page, not only in the terms. + +## The right to withdraw + +| Rule | Who | Law | +|---|---|---| +| A consumer may withdraw from a distance contract within 14 days without giving a reason | C | Consumer Contracts Act, sections 18(1) and 19(1) | +| The period runs from the day the contract is made for a service, and from receipt for goods. For several goods in one order that arrive separately, it runs from receipt of the last one | C | section 19(2) | +| The period does not start until the consumer has the information about the right to withdraw on a durable medium. Without it, the right lasts up to 12 months beyond the 14 days | C | section 19(3) and (4) | +| There are exceptions, among them a service fully performed with the consumer's prior express consent and acknowledgement that the right is lost, and goods made to the consumer's specification | C | section 18(2) | +| Where there is no right to withdraw, the consumer is told so before ordering | C | section 8(1) | +| A consumer who withdraws from a service that was started at their express request within the 14 days can be charged for the part delivered, in reasonable proportion to the whole, and only if they were told of the right to withdraw and of the amount | C | section 25(1) and (2) | +| For distance contracts made through an online interface, the consumer can also withdraw with a withdrawal function. It is labelled "Fortryd aftale" or equally clear, is available throughout the period, and is prominent and easy to reach. It lets the consumer send a statement with their name, the contract and where the confirmation is to go, through a confirmation step labelled "Bekræft fortrydelse" or equally clear. The trader then sends a receipt on a durable medium without undue delay, with the content and the time. The function and where to find it are part of the pre-contract information | C | section 20 a and section 8(1), as changed by act 723 of 2025, in force from 19 June 2026 | + +**Practice.** Relying on an exception is a decision for the business: escalate it, and +collect the consumer's express consent in the flow when the exception needs it. + +## Subscriptions and other running contracts + +| Rule | Who | Law | +|---|---|---| +| A consumer may end a contract for running delivery of goods or services with one month's notice to the end of a month, once five months have passed. A longer notice cannot be agreed | C | Consumer Contracts Act, section 28(1) and (5) | +| A standard-form contract says clearly with what notice, and from when, the consumer can end it | C | section 28(3) | +| Ending the contract is possible on the same medium or technical platform on which it was made | C | section 28 a | +| The act has exceptions and a longer period for some costly contracts | C | section 28(2) and (4) | + +**Practice.** A subscription bought on the site is cancelled on the site, in as few steps as +buying it took. State the renewal date and price before each renewal. + +## Invoices and records + +| Rule | Who | Label and source | +|---|---|---| +| An invoice to another business shows: its date; a sequential number; the seller's VAT registration number; the seller's and the buyer's name and address; the quantity and nature of what was supplied; the delivery date if it differs; the price per unit without VAT and any discount; the VAT rate; and the VAT amount | B | **Authority practice**: the tax authority's legal guide, section A.B.3.3.1.4, which cites section 58(1) of the VAT order | +| Simplified invoices exist for some sales. When one is allowed, and what a private customer must be given, is not covered here | not read | not read: escalate | +| Accounting records are kept safely for five years from the end of the financial year they belong to | All | **Law**: Bookkeeping Act, section 12 | +| A consumer who is billed for a service on account gets a specified bill | C | **Law**: Marketing Practices Act, section 15 | + +**Practice.** Number invoices in the system, never by hand. Do not delete an invoice: credit +it. The five years is a minimum that the privacy rules do not shorten: say so in the +retention plan. + +## Accessibility + +Act: the Accessibility Act for products and services (act 801 of 2022), in force from +28 June 2025. + +| Rule | Who | Law | +|---|---|---| +| Services in scope may be offered only if they meet the act's accessibility requirements. Online shops and other e-commerce services for consumers are in scope | C | sections 1, 4 and 6(1) | +| A very small business that offers services is exempt from the requirements for services. Very small means fewer than ten people and at most EUR 2 million in yearly turnover or balance sheet | C | section 6(3), with the definition in section 3 | +| A requirement does not apply where it would change the service fundamentally or be a disproportionate burden. The business makes and documents that assessment | C | sections 8 and 9 | + +**Practice.** Build to the Web Content Accessibility Guidelines at level AA whether or not +the act applies: it is cheaper than retrofitting, and a business that grows loses the +exemption. Whether the exemption applies is the business's decision, on its own numbers. diff --git a/plugins/agentic-engineering/skills/danish-business-rules/references/scenarios.md b/plugins/agentic-engineering/skills/danish-business-rules/references/scenarios.md new file mode 100644 index 0000000..dcc3c4b --- /dev/null +++ b/plugins/agentic-engineering/skills/danish-business-rules/references/scenarios.md @@ -0,0 +1,125 @@ +# Worked scenarios + +Four sites, each run through the eight applicability questions in the skill's entry file. The +rules and their sections are in [rules](rules.md). "Decide" marks what the business has to +decide; an agent proposes and records. + +## A brochure site + +A site that presents a business and takes enquiries. Nothing is sold on it. + +- **Customer and contract.** No contract is made on the site, so the order, withdrawal and + subscription rules do not come into play. If the site states prices to consumers, they are + stated clearly (Marketing Practices Act, section 14), and factual claims can be documented + (section 13). +- **Device storage.** Analytics, embedded video, maps and social buttons usually store or + read something on the device: consent first, with a way to say no (cookie order, + section 3). A banner can be left out only when everything the site stores or reads is within + the exception (section 4): list all of it, including pixels and fonts or scripts loaded + from elsewhere, before concluding that. +- **Marketing.** A newsletter sign-up needs a recorded consent (section 10(1)). An enquiry is + not a consent to marketing. +- **Accessibility.** No online sale to consumers, so the accessibility act's e-commerce rule + does not apply. **Practice:** build to level AA anyway. +- **Decide.** Whether anything on the site needs consent, and which tools are worth it. +- **Not covered here.** The E-commerce Act's duty to identify the business on its site, + which reaches sites that sell nothing, and any rules for the business's own sector (health + services, for example, have rules on how they are advertised). Escalate both. +- **Elsewhere.** The contact form's personal data belongs to privacy guidance. + +## A consumer shop + +A site that sells goods to consumers. + +- **Customer.** Consumers, so every consumer rule applies. +- **Before the order.** The information of the Consumer Contracts Act, section 8(1): the + goods, the trader with address, phone and email, the total price with taxes and delivery, + payment and delivery terms, and the right to withdraw with its conditions. +- **The order.** The page says the order obliges the customer to pay, shows the goods and + the total price just before, and labels the button "ordre med betalingsforpligtelse" or + similar. Otherwise the customer is not bound (section 12). +- **After the order.** A confirmation on a durable medium, such as an email, with the + pre-contract information, at the latest on delivery (section 13). +- **Withdrawal.** 14 days from receipt of the last item in the order, no reason needed + (sections 18 and 19), with a + withdrawal function on the site: a "Fortryd aftale" entry, a statement, a "Bekræft + fortrydelse" step and a receipt by email (section 20 a). Goods made to + the customer's specification are an exception (section 18(2)), and the customer is told + before ordering that those goods cannot be returned this way (section 8(1)). The + exception names the goods made to specification, not the whole order, so a basket can + hold both kinds. How a mixed basket and the + withdrawal function treat the excepted items is not covered here: escalate. +- **Marketing.** Offers to past customers fit the existing-customer exception only for the + shop's own similar products, with an opt-out at purchase and in every message + (section 10(2)). +- **Invoices and records.** Accounting records kept five years (Bookkeeping Act, + section 12). What a private customer must be given for each sale is not covered here: + escalate. +- **Device storage.** A cookie that keeps the basket working fits the wording of the + exception (cookie order, section 4). Anything else is stored only after consent + (section 3), unless the business decides that it falls within the exception. +- **Accessibility.** In scope unless the business is very small. +- **Decide.** Whether the business counts as very small, which exceptions to withdrawal it + relies on, and who pays for returns. + +## A business portal + +A site where companies order services or manage an account. + +- **Customer.** Businesses only, so the consumer information, order-button, withdrawal and + subscription rules do not apply, **if the flow establishes that each customer is a + business**: for example by requiring a company registration number. The trader has to + prove a contract is not a consumer contract (Consumer Contracts Act, section 2). A + sole trader buying for private use is a consumer. If such an order can get through, it + is a consumer contract: the order button, information and withdrawal rules then apply, + and an order placed with another button label does not bind the customer + (section 12(3)). Refuse such orders or build the consumer flow. +- **Marketing.** The consent rule for email covers business recipients too: the act says + "anyone" (section 10(1)), and the Consumer Ombudsman applies it that way. +- **Invoices.** A full invoice with every item, because a business customer needs it to + recover its own VAT. +- **Device storage.** The same consent rule as for any visitor. +- **Accessibility.** The act's e-commerce rule is about services for consumers, so it does + not reach a portal that serves only businesses. It may if consumers can order. +- **Not covered here.** The E-commerce Act's rules on ordering and on identifying the + business, which also protect business customers. Escalate. +- **Decide.** How the portal establishes that a customer is a business, and what happens + when one is not. + +## A subscription checkout + +A site that sells a monthly service to consumers. + +- **Before the order.** Everything a shop shows, plus the total cost per billing period, the + contract's length, how to end it and any minimum period (section 8(1)). The same four are + shown prominently just before the order (section 12(1)). +- **Withdrawal.** 14 days from the day the contract is made (sections 18 and 19), with the + withdrawal function (section 20 a). If the service starts within those days, collect the + customer's express request for that, and tell them what they will owe if they withdraw: + only then can the part already delivered be charged, in reasonable proportion to the + whole (section 25). +- **Ending it.** One month's notice to the end of a month once five months have passed, and + no longer notice can be agreed (section 28). The customer can cancel on the site, because + that is where they signed up (section 28 a). +- **A minimum period** cannot hold the customer longer than that, outside the act's + exceptions (section 28(2) and (4)): whatever the terms say, after five months they can + give one month's notice. A shorter minimum, three months for + example, is inside the limit. It is shown before the order with the other terms + (sections 8(1) and 12(1)), and it does not remove the 14 days. +- **Renewal and price changes.** State the next renewal date and price in the account and + before each renewal. **Practice**, and a change of price is a decision. +- **Marketing, storage, invoices, accessibility.** As for a consumer shop. +- **Decide.** Whether to have a minimum period within that limit, what happens to access + after cancellation, and any price change. + +## Checking that the skill is used well + +A good result answers the eight questions, lists only rules that follow from the answers, +gives each rule's section, separates **Law**, **Authority practice** and **Practice**, and +marks every decision with who is asked. A bad result lists every rule for every site, or says +the site "complies with Danish law". + +Requests that should lead here: a checkout, a booking with payment, a subscription or its +cancellation, a newsletter, a cookie banner, an invoice template, a site about to go live in +Denmark. Requests that should not: what personal data a form may collect, who may see an +order, how to test colour contrast, a site that neither targets nor operates in Denmark. diff --git a/plugins/agentic-engineering/skills/danish-business-rules/references/sources.md b/plugins/agentic-engineering/skills/danish-business-rules/references/sources.md new file mode 100644 index 0000000..c7dbeb7 --- /dev/null +++ b/plugins/agentic-engineering/skills/danish-business-rules/references/sources.md @@ -0,0 +1,59 @@ +# Sources, what is not covered, and how this skill is kept current + +Every rule in this skill was read in the source named here. "Read" is the date the text was +last compared with the skill. + +| Source | Covers | Applies to | In force or dated | Read | +|---|---|---|---|---| +| [Cookie order, BEK 1148 of 9 December 2011](https://www.retsinformation.dk/eli/lta/2011/1148) | Consent for storing or reading information on a device (sections 3 and 4) | Anyone who stores or reads, in Denmark | In force | 2026-11-11 | +| [Marketing Practices Act, consolidated act 1420 of 2 December 2024](https://www.retsinformation.dk/eli/lta/2024/1420) | Marketing messages (section 10), misleading omissions and purchase information (section 6), documentation (section 13), prices (sections 14 and 15) | Traders marketing in Denmark | In force; the database lists a later amending act of 30 December 2024 that was not compared | 2026-11-11 | +| [Consumer Contracts Act, consolidated act 1184 of 28 September 2025](https://www.retsinformation.dk/eli/lta/2025/1184) | Consumer contracts (section 2), phone and doorstep selling (section 4), information (section 8), the order (section 12), the confirmation (section 13), withdrawal (sections 18, 19 and 25), running contracts (sections 28 and 28 a) | Traders contracting with consumers | In force. It predates the two amending acts below, which are both in force now | 2026-11-11 | +| [Act 723 of 20 June 2025 amending the Consumer Contracts Act](https://www.retsinformation.dk/eli/lta/2025/723) | The withdrawal function (section 20 a) | Distance contracts made through an online interface | In force from 19 June 2026; not yet in the consolidated text above | 2026-11-11 | +| [Act 558 of 27 May 2025 amending the Marketing Practices Act and the Consumer Contracts Act](https://www.retsinformation.dk/eli/lta/2025/558) | New pre-contract information on delivery options, the legal guarantee and durability guarantees. Read for those items only; its other changes are listed under "Not covered" | Traders contracting with consumers | In force from 27 September 2026; not yet in the consolidated texts above | 2026-11-11 | +| [Bookkeeping Act, act 700 of 24 May 2022](https://www.retsinformation.dk/eli/lta/2022/700) | Keeping accounting records five years (section 12) | Businesses with a bookkeeping duty in Denmark | In force | 2026-11-11 | +| [The tax authority's legal guide, section A.B.3.3.1.4](https://info.skat.dk/data.aspx?oid=2068789) | What an invoice shows; cites section 58(1) of the VAT order | VAT-registered businesses in Denmark | Guide edition 2026-2 | 2026-11-11 | +| [Accessibility Act for products and services, act 801 of 7 June 2022](https://www.retsinformation.dk/eli/lta/2022/801) | Scope (section 1), the duty (section 4), services and the exemption for very small service businesses (section 6), other exemptions (sections 8 and 9) | Products and services offered to consumers in the EU | In force from 28 June 2025 | 2026-11-11 | +| [The Consumer Ombudsman on unsolicited electronic messages](https://forbrugerombudsmanden.dk/alle-emner/uanmodede-henvendelser/uanmodede-elektroniske-henvendelser-spam) | How the ban on unsolicited messages is applied: who is covered, how consent is asked for and what makes it valid | Traders marketing in Denmark | Authority practice, as published on the day read | 2026-11-11 | + +Authorities whose guidance to read before deciding: the Consumer Ombudsman for marketing and +consumer contracts, the Agency for Digital Government for cookies, the Safety Technology +Authority for e-commerce under the accessibility act, the Business Authority for bookkeeping +and the tax authority for invoices. Their guidance is **Authority practice**. Apart from the +one page in the table, it was not summarised here. + +## Not covered + +This skill was written from the acts above and nothing else. It does not cover, and must not +be stretched to: + +- the E-commerce Act's rules on information about the service provider. The act's text could + not be read in the official database when this skill was written; +- the detailed price-labelling rules set under the Marketing Practices Act, section 14; +- environmental claims and sustainability labels in marketing, and the rest of what act + 558 of 2025 added from 27 September 2026 (repair scores, software updates, changes to + what is shown just before the order); +- the VAT order's own text, when a simplified invoice is allowed, invoices to private + customers, VAT rates, or sales to other + countries; +- the accessibility requirements themselves (the act's annex) and public bodies' own + accessibility law; +- sector rules: health, finance, food, alcohol, tobacco, gambling, travel; +- sales law: defects, guarantees, delivery, complaints, and the information about + complaint bodies a shop has to give; +- payment rules, including fees for paying by card; +- anything outside Denmark, including where another country's consumer law applies to a + Danish shop that sells abroad. + +For each of these, say "not covered by this guidance" and escalate. + +## Review plan + +- **At every change to this skill**: re-read each source the changed text relies on, and + update its date. +- **At least every six months**, next by 2027-05-11: open every link, confirm each + consolidated act is still the one in force, look for amending acts, and re-read the tax + authority's guide, which is reissued twice a year. +- **At once** when an act above is amended or consolidated again, or when someone reports a + difference between the skill and a source. The source is right; the skill has a defect. +- **Who**: the repository that holds this skill's source. A review is recorded as a change to + the dates in the table, with what was found. diff --git a/plugins/agentic-engineering/skills/privacy-engineering/SKILL.md b/plugins/agentic-engineering/skills/privacy-engineering/SKILL.md new file mode 100644 index 0000000..b5031db --- /dev/null +++ b/plugins/agentic-engineering/skills/privacy-engineering/SKILL.md @@ -0,0 +1,114 @@ +--- +name: privacy-engineering +description: Handle personal data under the GDPR and Danish data protection law - purpose, legal basis, retention, people's rights, processors, transfers, impact assessments and breach reporting, with law kept apart from recommendation. Use when a change collects, stores, shares or logs data about people, such as a contact form, analytics, customer accounts or new hosting. Not legal advice, and not for cookie banners. +license: Apache-2.0 +--- + +# Privacy engineering + +Personal data is any information about a person who can be identified: a name, an email +address, an IP address, a guest's dietary note. Most privacy failures are small decisions that +nobody made on purpose: a field collected because it might be useful, a log that keeps +everything, a provider added without asking where it stores data. This skill makes those +decisions visible. It does not make them. The organisation responsible for the data decides, +through a named person. + +## What must not go wrong + +1. **Never say that something is compliant or lawful.** Say what was checked, what the law + requires and where it says so, and what a person still has to decide. This skill is + engineering guidance, not legal advice. +2. **Keep law and recommendation apart.** In this skill **Law** marks a duty and names its + source. **Practice** marks a recommendation. Never present a practice as a legal + requirement, and never treat a legal duty as a preference. **Authority practice** marks a + supervisory authority's published position: not statute, but the yardstick it applies. +3. **No personal data without a written purpose and legal basis** before the change ships. The + engineer proposes both; the accountable person confirms them. +4. **Decide how long data is kept when the field is added**, not later. +5. **A suspected breach starts a clock.** Escalate at once; do not investigate alone first. +6. **Real personal data stays out of** test fixtures, issue text, prompts and screenshots. + Logs hold the identifiers an audit trail needs (who did what to which record), protected + and with a retention period, and never the content of the data. + +## When to use it, and when not + +Use it at requirements, design, review and delivery, when a change: + +- adds a form or a field about a person, or a place where such data rests; +- adds analytics, tracking, an embedded third-party script or an AI feature that reads + people's text; +- adds accounts, profiles, exports, backups or logs that hold identifiers; +- adds or changes a provider, a hosting location or anyone else who receives the data; +- sends email or messages to people. + +Other work has its own owner: + +| Task | Use instead | +|---|---| +| Who may read or change a record, tenant isolation, upload and webhook safety | `application-security`, when installed | +| Cookie banners, marketing consent, consumer and accessibility rules | separate law with its own rules: ask the accountable person | +| Data is leaking or was lost right now | `incident-response` first, with [the breach clock](references/obligations.md#breaches) from this skill | + +A repository's own instructions say which personal data it holds, who is accountable for it +and where its records are kept. They win over this skill wherever they are more specific. + +## The order of work + +Each step names what the law requires in [obligations](references/obligations.md). Worked +checklists for a contact form, analytics, customer accounts, a new provider and stored files +are in [scenarios](references/scenarios.md). + +1. **Find the personal data.** List each field, whose it is, and whether any of it is in a + protected group: health, beliefs, ethnicity, sexual orientation, union membership, + biometrics, criminal offences, children's data, national identity numbers. +2. **Name the role.** The controller decides why and how data is used. A processor handles + it for someone else, on written instructions. In client work the client is usually the + controller. The answer decides who must do every later step. +3. **Write the purpose and propose the legal basis.** One sentence of purpose per use. + Consent is one of six bases. For ordinary data it is often the wrong one; for data in a + protected group, explicit consent is often the only workable ground. +4. **Collect less and set the retention period.** Remove each field the purpose does not + need. Give every remaining one a period and a way it is deleted. +5. **Tell people.** List what must change in the privacy notice. +6. **Build people's rights in.** Access, correction, deletion, export and objection are + features with a one-month deadline, not support tickets. +7. **Check everyone who receives the data, and in which role.** A provider that handles data + for you is a processor and needs a data processing agreement. A recipient that decides its + own purposes, such as an authority or a bank, is a controller: the disclosure needs a + legal basis, not that agreement. + Each location outside the EU and EEA needs a transfer basis. +8. **Protect it** in proportion to the risk. +9. **Screen for an impact assessment.** A few questions decide whether a formal assessment is + needed before work starts. +10. **Leave the evidence**: the entry in the record of processing, the decisions and who made + them, and the tests for retention and deletion. + +For work in Denmark, or about people in Denmark, add [the Danish rules](references/denmark.md). +The sources, the date each was checked and how this skill is kept current are in +[sources](references/sources.md). + +## Escalate, do not decide alone + +Write **Needs a decision by** and the role, and stop that part of the work, when: + +- a breach is suspected: data lost, sent to the wrong person, or reachable by someone who + should not see it; +- the data is in a protected group, about children, or includes a national identity number; +- existing data would be used for a new purpose; +- data would go to a new recipient, or outside the EU and EEA; +- the impact assessment screen has a hit; +- a person asks for their data, its correction or its deletion; +- it is unclear who is the controller; +- the answer depends on how a legal text is read. + +An agent proposes and prepares. A person accountable for the data decides. + +## What a change leaves behind + +| Evidence | Where it lives | +|---|---| +| Fields, purpose, legal basis, retention, recipients | The record of processing, or the repository's privacy notes if that is where it is kept | +| What changed in the privacy notice | The pull request, and the notice itself | +| Provider agreement and transfer basis | With the contracts; the pull request links them, never copies them | +| Retention and deletion working | A test that old data is deleted or anonymised, and that deleting a person removes them everywhere except what the accountable person has decided must be kept, with the legal ground for each | +| Decisions, and who made them | The pull request or the issue | diff --git a/plugins/agentic-engineering/skills/privacy-engineering/references/denmark.md b/plugins/agentic-engineering/skills/privacy-engineering/references/denmark.md new file mode 100644 index 0000000..f5cd6e6 --- /dev/null +++ b/plugins/agentic-engineering/skills/privacy-engineering/references/denmark.md @@ -0,0 +1,46 @@ +# Denmark + +The GDPR applies in Denmark directly. The Danish Data Protection Act adds national rules on +top. Everything below was read in the consolidated act no. 289 of 8 March 2024 and in the +Danish Data Protection Agency's own guidance on 2026-11-10; the links and dates are in +[sources](sources.md). Section numbers are the act's. Check for later amendments before +relying on a detail. + +## What the act adds + +| Topic | Law | What it means for a change | +|---|---|---| +| Children's consent online | When consent is the basis for an online service offered directly to a child, the child's own consent counts from the age of **15** (the act's words: "mindst 15 år"). Below that, a holder of parental responsibility gives or approves it (section 6(2) and (3)). It was 13 in the original 2018 act, so older material is out of date | A sign-up that relies on consent and may reach children needs an age question and a parental route, decided by the accountable person | +| National identity numbers (CPR) | A private organisation may process them only when a law requires it, with the person's consent, or in the narrow cases the act lists (section 11(2)). They may not be published without consent (section 11(3)) | Do not add a CPR field "to be sure who it is". If one is needed, name the legal ground, and keep the number out of URLs, logs and email | +| Criminal offences | A private organisation may process such data only with explicit consent, or for a legitimate interest that clearly outweighs the person's (section 8(3)) | Escalate before storing anything about offences or suspicions | +| Employment | Employee data may be processed where employment law or a collective agreement requires it, or on consent (section 12) | Staff systems are in scope like customer systems | +| Passing consumer data on for marketing | Before a company passes a consumer's data to another company for direct marketing, it must check in the civil register whether the person has declined marketing (section 13) | Any feature that shares customer lists is an escalation | +| Penalties | Breaches can be punished with a fine, or prison for up to six months (section 41) | Not a design input. It is why "probably fine" is not an answer | + +## The Danish Data Protection Agency's practice + +The agency (Datatilsynet) is the supervisory authority. The points below are **Authority +practice**: its published positions. They are not statute, and they are not optional either: +the agency applies them when it judges whether security was appropriate under Art. 32. + +- **Email with confidential or sensitive data is encrypted in transit**, with TLS 1.2 as the + minimum. The level follows a risk assessment: a large amount of sensitive data may need the + content itself encrypted. Nobody can consent to weaker security than the risk calls for. +- **Breaches are reported through the business portal Virk**, without undue delay and where + feasible within 72 hours of becoming aware, unless the breach is unlikely to be a risk to + people. If that cannot be judged in time, report. + The hours run through weekends and holidays. A report can be filed with what is known + and completed later. A late report must explain the delay. +- **Impact assessments**: the agency publishes a list of processing that always needs one, + beside the general screening criteria. The list is not restated here: read it at the + source before deciding that no assessment is needed. + +**Practice.** For a Danish audience, write the privacy notice in Danish and in plain words. +Keep the record of processing where the accountable person can show it on request. + +## Not covered here + +Cookies and similar technologies, marketing by email or text message, consumer rights, price +and subscription information, invoicing and accessibility are separate Danish rules with +their own authorities. Treat each as a question for the accountable person until guidance for +them exists. diff --git a/plugins/agentic-engineering/skills/privacy-engineering/references/obligations.md b/plugins/agentic-engineering/skills/privacy-engineering/references/obligations.md new file mode 100644 index 0000000..2fcdc3a --- /dev/null +++ b/plugins/agentic-engineering/skills/privacy-engineering/references/obligations.md @@ -0,0 +1,94 @@ +# What the law requires, and what is only good practice + +Article numbers are those of the GDPR (Regulation (EU) 2016/679). **Law** is a duty in the +regulation. **Practice** is a recommendation: a sound default, not a legal requirement. +**Authority practice** is a supervisory authority's published position: not statute, but the +yardstick it applies. Follow it unless the accountable person decides otherwise and records +why. Read the article itself before relying on a summary; the links are in +[sources](sources.md). + +## The principles and the legal basis + +| Topic | Law | Practice | +|---|---|---| +| Purpose | Data is collected for stated, explicit purposes and not reused in a way that does not fit them (Art. 5(1)(b)) | Write the purpose as one sentence a customer would understand, in the pull request | +| Legal basis | Every use needs one of six: consent, a contract with the person, a legal obligation, vital interests, a public task, or legitimate interests that the person's own interests do not override (Art. 6(1)) | Propose the basis and the reason. A reply to an enquiry rarely needs consent; a newsletter usually does | +| Consent, when it is the basis | Freely given, specific, informed and unambiguous; provable; as easy to withdraw as to give (Art. 4(11), Art. 7) | Store when and how consent was given, and to which text | +| Minimisation | Only data that the purpose needs (Art. 5(1)(c)) | Remove optional fields that nobody can explain. Free-text fields attract data nobody asked for | +| Retention | Kept no longer than the purpose needs (Art. 5(1)(e)) | A period for every field, chosen by the accountable person, and a job that enforces it. The law sets no general number of months | +| Protected groups | Health, ethnicity, political opinions, beliefs, union membership, genetic and biometric data, sex life and orientation may be processed only when **both** hold: a legal basis under Art. 6, and one of the conditions in Art. 9(2). The conditions include the person's explicit consent (a), duties under employment law (b), vital interests (c), data the person has plainly made public (e), legal claims (f), and care by a health professional bound by secrecy (h). Criminal-offence data has its own rule (Art. 10) | Do not collect them by accident: a "notes" field on a booking form will receive health data. To collect them on purpose is a decision for the accountable person: for a small business the workable condition is usually explicit consent, given for that purpose and recorded | +| Accountability | The controller must be able to show that the principles are met (Art. 5(2)) | Keep the decisions with the change that made them | + +## Roles and recipients + +| Topic | Law | Practice | +|---|---|---| +| Controller and processor | The controller decides purposes and means (Art. 4(7)). A processor acts for the controller (Art. 4(8)) and only on documented instructions (Art. 28(3)(a)) | Write down which you are, per data set. An agency that builds and hosts a client's site is normally the client's processor | +| Processor contract | A contract with the contents of Art. 28(3) before any processor receives data. A processor needs the controller's authorisation for each sub-processor (Art. 28(2)) | Keep a list of providers that receive personal data, with what they receive and where | +| Record of processing | Controllers and processors keep a record (Art. 30). The exemption for organisations under 250 people does not cover processing that is regular, risky or about protected groups (Art. 30(5)), so it rarely applies | Update the record in the same change that adds the processing | +| Transfers outside the EU and EEA | Allowed only with an adequacy decision, appropriate safeguards such as standard contractual clauses, or a narrow exception (Art. 44 to 49) | Check where each provider stores and reaches data, including support access. Read the Commission's list of adequacy decisions on the day you decide: it changes | + +## People's rights + +| Topic | Law | Practice | +|---|---|---| +| Information | Tell people at collection who you are, why, on what basis, for how long, who receives the data and what their rights are (Art. 13; Art. 14 when the data comes from someone else) | List the notice changes in the pull request. Link the notice where the data is collected | +| Access, correction, deletion, restriction, export, objection | Art. 15 to 21. Export applies to data the person provided, when the basis is consent or contract (Art. 20). Objection to direct marketing is absolute (Art. 21(2) and (3)) | One function that finds a person in every store, including logs, backups and providers. Test it | +| Deadline | An answer within one month, extendable by two further months for complex requests, with notice inside the first month (Art. 12(3)) | Record when the request arrived. Escalate it the day it arrives | +| Automated decisions | A person may not be subject to a decision with legal or similarly significant effect that is based only on automated processing, with listed exceptions (Art. 22) | Flag any feature that scores, ranks or rejects people | + +## Design, security and assessment + +| Topic | Law | Practice | +|---|---|---| +| By design and by default | Build the principles into the design, and by default process only what each purpose needs (Art. 25) | Optional collection is off until the person switches it on | +| Security | Measures appropriate to the risk. The regulation names pseudonymisation and encryption as examples and fixes no algorithm (Art. 32) | Encrypt in transit and at rest, limit who can read, log access to sensitive records. Use `application-security` for access rules | +| Impact assessment | Required before processing that is likely to result in a high risk (Art. 35(1)), in particular large-scale use of protected groups, systematic evaluation of people with significant effects, and large-scale monitoring of public places (Art. 35(3)) | Screen every new processing with the questions below. Two or more hits: an assessment is normally needed. National authorities also publish lists of processing that always needs one: read the list for your country at its source | +| Prior consultation | When an assessment shows that the risk stays high even with the planned measures, the controller consults the supervisory authority before the processing starts (Art. 36) | Treat "high risk remains" as a stop, not as a note in the assessment | +| Data protection officer | Required for public bodies and for core activities of large-scale monitoring or large-scale use of protected groups (Art. 37) | If one exists, involve them at design, not at release | + +### Screening for an impact assessment + +Count the hits. The criteria come from the European data protection authorities' guidelines on +impact assessments. + +1. Does it score, profile or predict people? +2. Does it decide automatically with legal or similar effect? +3. Does it monitor people systematically? +4. Does it use protected-group data or other highly personal data? +5. Is it large in scale: many people, much data, a long time or a wide area? +6. Does it combine data sets collected for different purposes? +7. Is it about vulnerable people: children, employees, patients? +8. Does it use a new technology or a new way of using one? +9. Does it stop people from using a service or a right? + +No hit: record that the screen was done. One hit: an assessment can still be required, so +weigh the risk and read the authority's list of processing that always needs one, then have the +accountable person decide either way. Two or more: escalate before building. + +## Breaches + +**Law.** A personal data breach is a breach of security that leads to loss, alteration, +unauthorised disclosure of or access to personal data (Art. 4(12)). The controller reports it +to the supervisory authority without undue delay and, where feasible, within 72 hours of +becoming aware of it, unless it is unlikely to result in a risk to people (Art. 33(1)). A +processor tells its controller without undue delay (Art. 33(2)). When the risk to people is +high, they are told too (Art. 34). Every breach is documented, reported or not (Art. 33(5)). + +**Practice.** The clock starts when someone in the organisation knows, so the engineer who +notices says so at once, to the accountable person, with what is known. Keep the logs. Do not +decide alone that it is "not a breach": an email to the wrong recipient is one. + +## Practices often mistaken for law + +- Masking addresses in logs, random instead of sequential identifiers, a particular cipher or + key length: good defaults, chosen by risk. The regulation requires appropriate security, + not these measures. +- A fixed retention period such as "12 months": the law requires a period that fits the + purpose, and other laws (bookkeeping, for example) may set a minimum. +- "We need consent for everything": consent is one basis of six, and a wrong choice of basis + is itself a defect. +- Cookie banners: storing or reading information on a person's device is governed by + separate rules on electronic communications, beside the GDPR. +- "The data is anonymous": data is anonymous only when nobody can reasonably re-identify the + person. Hashed or pseudonymised data is still personal data (Art. 4(5), Recital 26). diff --git a/plugins/agentic-engineering/skills/privacy-engineering/references/scenarios.md b/plugins/agentic-engineering/skills/privacy-engineering/references/scenarios.md new file mode 100644 index 0000000..9051dbd --- /dev/null +++ b/plugins/agentic-engineering/skills/privacy-engineering/references/scenarios.md @@ -0,0 +1,120 @@ +# Worked scenarios + +Five changes that come up again and again. Each lists the questions to answer, what is law +and what is practice, the evidence the change leaves, and when to stop and escalate. Article +numbers are explained in [obligations](obligations.md). + +## A contact form + +**Ask.** Which fields does answering an enquiry need? Where does a submission go: a mailbox, a +database, a provider? Who reads it? How long is it kept after the enquiry is closed? + +- **Law.** A purpose and a legal basis (Art. 5(1)(b), Art. 6). Only the fields the purpose + needs (Art. 5(1)(c)). Information at collection (Art. 13). A retention period + (Art. 5(1)(e)). A processor contract with the form or mail provider (Art. 28). +- **Practice.** Name, a way to reply and the message are usually enough. Say next to a + free-text field not to send sensitive details. Do not reuse addresses for a newsletter: + that is a new purpose and needs its own basis. Keep submissions out of application logs. + Delete on a schedule, not by hand. Send the notification email as a short notice or a + link, not as a copy of the submission, when a submission may hold confidential or + sensitive details. A third-party spam check or captcha is a provider that receives + visitors' data and may store things on their device: treat it as a new provider. Limit + how often the form can be sent. +- **A field meant to collect protected-group data** (a question about health, for + example) is a decision, not a field: escalate it, and build the rest of the form + meanwhile. If the accountable person approves it: + - **Law.** It needs a legal basis under Art. 6 and a condition under Art. 9(2), and + security that fits the higher risk (Art. 32). + - **Practice.** The workable condition is usually explicit consent given for that + purpose. Give the field its own short retention, and keep it out of notification + emails and logs. + - **Authority practice.** In Denmark, such data sent by email is encrypted in transit + ([Denmark](denmark.md)). +- **Evidence.** The field list with the purpose, the proposed basis and who confirmed it, the + retention period and the job that enforces it, the notice text, and the provider entry. +- **Escalate** when the form invites health, children's or identity-number data, or when + submissions are to be used for marketing. + +## Analytics and tracking + +**Ask.** What question is the measurement for? Does it identify people or devices? Who is the +provider, and where does it store and reach the data? Does anything get stored on or read +from the visitor's device? + +- **Law.** Online identifiers and IP addresses can be personal data (Art. 4(1), Recital 30). + The same duties as any processing: purpose, basis, notice, processor contract, transfer + basis (Art. 5, 6, 13, 28, 44 to 49). Storing or reading information on a device is governed + by separate rules on electronic communications as well. +- **Practice.** Prefer measurement that keeps no identifier and sets nothing on the device. + Do not send page addresses that contain identifiers or search terms. Keep product telemetry + off until it is switched on, and document exactly what it sends. +- **Evidence.** The list of events and properties, the provider and location, the basis, and + whether consent is collected and how it is honoured. +- **Escalate** every time: whether consent is needed, and whether a provider outside the EU + and EEA is acceptable, are decisions for the accountable person. + +## Customer accounts + +**Ask.** What does an account hold? What happens when it is closed? Can the person see, fix, +export and delete their data without writing to anyone? + +- **Law.** People's rights with a one-month deadline (Art. 12(3), Art. 15 to 21). Design that + collects only what each purpose needs by default (Art. 25). Security appropriate to the risk + (Art. 32). In Denmark, the age of 15 for a child's own consent to an online service. +- **Practice.** Delegate sign-in to an identity provider. Build export and deletion as + functions that reach every store, and test them. On closure, delete or anonymise what no + ground requires keeping. Grounds include another law, such as bookkeeping, and a legal + claim, such as an open dispute (Art. 17(3)). The accountable person decides them before + anything is deleted, and each kept item has its reason and its end date. + Send as little personal data by email as possible. +- **Evidence.** The data map per account, the deletion and export tests, and the list of data + kept after closure with the reason for each. +- **Escalate** when an account can belong to a child, when accounts are shared across + organisations, or when data must be kept after a deletion request. + +## A new provider or hosting location + +**Ask.** Which personal data will the provider receive, including through logs, backups and +support access? Where is it stored, and from where can it be reached? Whose sub-processors +are involved? + +- **Law.** A processor contract before any data flows (Art. 28). Authorisation for + sub-processors (Art. 28(2)). A transfer basis for any location or access outside the EU and + EEA (Art. 44 to 49). An updated record of processing (Art. 30). If you are a processor + yourself, your controller's authorisation before you add the provider. +- **Practice.** Choose a region in the EU or EEA, and check that backups and support stay + there too. Read the provider's terms on using customer content for its own purposes, + including to train models. Plan how the data comes back or is deleted when the contract ends. +- **Evidence.** The provider entry: what it receives, where, under which agreement and + transfer basis, and who approved it. +- **Escalate** every time a provider is added, replaced or moved to a new region. + +## Stored files, backups and logs + +**Ask.** Which stores hold personal data without anyone meaning them to: uploads, exports, +backups, logs, error reports, search indexes, caches, analytics tables? + +- **Law.** Retention and deletion apply to every copy (Art. 5(1)(e), Art. 17). Security + appropriate to the risk (Art. 32). A breach of any copy is a breach (Art. 4(12), Art. 33). +- **Practice.** Log events and identifiers, not content. Give backups a retention period and + say how a deleted person is handled when a backup is restored. Use made-up data in tests + and demos; if production data must be copied, strip the personal data first. Keep personal + data out of URLs, because URLs end up in logs. +- **Evidence.** The list of stores with their retention, and the test that deletion reaches + each of them. +- **Escalate** when a store cannot honour deletion, or when production data has already been + copied somewhere it should not be. + +## Checking that the skill is used well + +Requests that should lead here: adding a contact form, adding analytics, adding customer +accounts, changing hosting or a provider, deciding where files or backups are stored, logging +user activity, sending a newsletter. + +Requests that should not: who may read a record (access control), a cookie banner's wording +(separate rules), renaming a variable called `user`, performance work on a table that happens +to hold names. + +A good result names the personal data, separates **Law** from **Practice**, proposes rather +than decides the purpose and basis, sets a retention period, lists the evidence, and marks +what needs a decision and by whom. A bad result says "this is GDPR compliant". diff --git a/plugins/agentic-engineering/skills/privacy-engineering/references/sources.md b/plugins/agentic-engineering/skills/privacy-engineering/references/sources.md new file mode 100644 index 0000000..78fe5ce --- /dev/null +++ b/plugins/agentic-engineering/skills/privacy-engineering/references/sources.md @@ -0,0 +1,36 @@ +# Sources, and how this skill is kept current + +Every legal statement in this skill comes from one of these. The date is when the source was +last read against the skill. + +| Source | Used for | Checked | +|---|---|---| +| [Regulation (EU) 2016/679, the GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) | Every article cited in [obligations](obligations.md) | 2026-11-10 | +| [Danish Data Protection Act, consolidated act no. 289 of 8 March 2024](https://www.retsinformation.dk/eli/lta/2024/289) | Sections 6, 8, 11, 12, 13 and 41 in [Denmark](denmark.md) | 2026-11-10 | +| [Datatilsynet: legislation overview](https://www.datatilsynet.dk/regler-og-vejledning/lovgivning) | Which act and orders are in force | 2026-11-10 | +| [Datatilsynet: secure transmission](https://www.datatilsynet.dk/regler-og-vejledning/behandlingssikkerhed/katalog-over-foranstaltninger/sikker-transmission) (page updated 2025-10-17) | Encryption of email in transit | 2026-11-10 | +| [Datatilsynet: reporting a breach](https://www.datatilsynet.dk/sikkerhedsbrud/anmeld-sikkerhedsbrud), with its breach guidance of May 2025 | The reporting route and the 72 hours | 2026-11-10 | +| [Datatilsynet: impact assessments](https://www.datatilsynet.dk/regler-og-vejledning/behandlingssikkerhed/konsekvensanalyse) | The agency's list of processing that always needs one | 2026-11-10 | +| [Datatilsynet: transfers to third countries](https://www.datatilsynet.dk/internationalt/tredjelandsoverfoersler) | Where to read the current transfer rules | 2026-11-10 | +| [Datatilsynet: GDPR for small businesses](https://www.datatilsynet.dk/regler-og-vejledning/gdpr-univers-for-smaa-virksomheder) | Plain-language starting point for a small controller | 2026-11-10 | +| [European Data Protection Board: guidelines](https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en) | The impact assessment criteria, consent, controller and processor roles | 2026-11-10 | +| [European Commission: adequacy decisions](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) | Which countries data may go to without further safeguards. Not restated here, because the list changes | 2026-11-10 | + +## What this skill does not claim + +It summarises. It does not interpret disputed points, it does not cover sector rules (health, +finance, telecoms), and it does not replace the accountable person or a lawyer. Where a +summary and the source differ, the source is right and the skill has a defect: report it. + +## Review plan + +- **At every change to this skill**: re-read each source the changed text relies on, and + update its date. +- **At least every six months**: open every link, confirm the act's consolidated number is + still the one in force, and read the agency's news for changed positions. The next review + is due by 2027-05-10. +- **At once** when the Danish act is amended or consolidated again, when the European + board publishes or replaces guidelines the skill relies on, or when someone reports a + difference between the skill and a source. +- **Who**: the repository that holds this skill's source. A review is recorded as a change to + the dates in the table, with what was found.